Microsoft Entra ID Experts in Munich

Led the end-to-end integration and migration architecture for decommissioning SAP IS-U market communication and transitioning to Salesforce Marketing Cloud (SFMC) with E.ON IT Services — covering regulated EDIFACT market messaging, a three-phase data migration (transfer of market message inventory after cutover), redesign of market communication processes, and full GDPR and German energy-market compliance.

• Designed the three-tier target architecture (SAP IS-U → NScale B2B gateway → SFMC) processing 50,000–100,000 EDIFACT messages daily within sub-5-minute SLAs.
• Architected the three-phase data migration: 36 months of historical data, zero-loss cutover of in-flight market messages, and near-real-time CDC synchronization.
• Delivered secure, BDEW/GDPR-compliant integration (AS2/OFTP2, RFC/IDoc, REST APIs, OAuth 2.0, Azure AD, AWS S3) achieving >99.5% uptime, <0.1% migration discrepancy, and RTO <4 hours.
• Applied BPMN to model and optimize the market communication processes.

Technologies: SAP IS-U, NScale, Salesforce Marketing Cloud, EDIFACT, OAuth 2.0, Azure AD, AWS S3, BPMN, Jira, Confluence, Draw.io

• Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
• Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
• Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
• Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
• Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
• Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
• Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
• Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
• Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
• Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.

• Development of an AI-powered project organization tool for a civil engineering company that intelligently links project, task, tender, schedule, and document data through a knowledge graph.
• Implementation of AI features for document analysis, information extraction, context-based assistance, and voice-based data capture based on Microsoft Azure AI, reducing administrative effort, making information available faster, and supporting project teams in decision-making.
• Tech stack: Python, React, TypeScript, FastAPI, Claude Code, Codex, Graphify, PostgreSQL, Microsoft Azure AI Foundry, Azure OpenAI, Azure AI Speech, Azure AI Document Intelligence, Microsoft Graph, Microsoft Entra ID, Docker, Git, CI/CD.

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

• Processing and coordination of IT tickets (Helix, Omnitracker) incl. VIP support and remote support (Microsoft Teams, RDP, FastViewer)
• Onsite support at the main location as well as support for modern conference and meeting room technology (e.g. MeetingBoard 75 Pro)
• User and rights management in Active Directory (Active Roles), Azure AD, Exchange and MDM
• VDI support and monitoring with Citrix Director and Aruba Networking
• Endpoint management and policy administration via Ivanti
• Deployment, configuration and lifecycle management of clients (Dell notebooks, iPhones, iPads)
• Hardware rollouts for new employees incl. shipping across Germany
• Asset and license management as well as organization of site migrations

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• Build and operate an end-to-end MLOps platform on Azure ML and Kubernetes (Kubeflow) for the automated deployment, monitoring, and scaling of forecasting models (including Temporal Fusion Transformer, Informer, Autoformer).
• Implement CI/CD pipelines in Azure DevOps for the full ML lifecycle – from resource provisioning (Terraform), data transformation (Hugging Face Datasets, Pandas, PyTorch, CUDA cluster) through training and evaluation to model registry and endpoint deployment.
• Integrate MLflow for experiment tracking, model versioning, performance monitoring, and automated registration in the Azure Model Registry.
• Develop and containerize PyTorch training jobs (Azure Notebook, Jupyter Notebooks) for price and time series forecasting (PFC models) with automatic rollout via Azure ML Endpoints and REST/gRPC interfaces, Docker containerization, secured with OAuth 2.0.
• Set up monitoring and alerting mechanisms (Prometheus, MLflow Metrics), log centralization, and cost monitoring.
• Automate infrastructure provisioning and model deployment using Terraform, Helm, and Azure CLI; connect to existing market data systems and event pipelines.
• Migrate existing workloads and databases (IONOS → Azure, MongoDB) with integration into central MLOps workflows and internal networks.
• Extend the platform with LLM-based tools (LangChain, LangServe) to integrate GPT-based analysis modules into existing Spring Boot services for market anomaly detection and automated reports.
• Analyze and architect a software solution to process large volumes of data efficiently (>3000 messages/sec.) (market data store).
• Spring Boot / Java 21 container development with RabbitMQ for distributing stock market data via MongoDB (Kubernetes) with fast storage of data in Redis RMaps, deduplication, forwarding messages to Read Model queues, and building Read Models for UI display in MongoDB.
• Integration of RESTHeart to create a REST API for MongoDB.
• Build an Angular frontend to simplify data queries and master data maintenance.
• Agentic coding with remote and local LLMs (Claude Sonnet, Ollama Qwen) and MCP servers.
• Develop Python scripts for transforming and cleaning incoming stock market data (Pandas, scikit-learn).

• Partner directly with C-level leadership (CEO, CAIO, CTO) on architecture, OKR strategy, and cross-team roadmap prioritization, translating strategic goals into structured engineering requirements.
• Surfaced and mapped technical debt across the entire organization with C-level leadership and co-defined a prioritized remediation strategy, balancing debt paydown against feature delivery.
• Led code reviews and technical standards across the team, fostering a mentor-first environment with two-way feedback dialogue — pairing on complex pipeline work and unblocking junior engineers on async architecture patterns.
• Re-architected the AI companion's core processing pipeline from synchronous to asynchronous with a queue-based worker architecture, enabling horizontal scalability and cutting upload processing time ~4x (from ~22s to 5–10s) while improving response accuracy.
• Designed an AI-driven document intelligence workflow with automatic multi-document classification, per-document summarization, and relevance guardrails for the patient care journey.
• Built a unified patient memory system (short- and long-term context) bridging the document vault and chatbot into a single bidirectional, context-aware platform.

• Applied modern JavaScript features, including ES6+ syntax, destructuring, modules, array methods, and asynchronous programming, to develop efficient and readable frontend code.
• Implemented frontend integration patterns for PHP and Laravel backend services, connecting React interfaces to REST APIs and handling structured JSON data.
• Developed interactive, functional component-based frontend applications using React Hooks, JavaScript, and TypeScript, alongside backend applications and RESTful APIs using Python, Django, Flask, and FastAPI, focusing on reusable components, modular architecture, maintainability, and efficient data processing.
• Maintained a dynamic portfolio platform using PHP, Laravel, Livewire, and MySQL, implementing end-to-end functionality across frontend interfaces, backend services, and database operations.
• Validated server-side request handling, routing, middleware, and form validation using Laravel features to support reliable application workflows and consistent data processing.
• Designed and managed relational database structures using MySQL and Laravel Eloquent ORM, implementing data models, relationships, database migrations, and efficient queries for content management.
• AI-powered applications integrating Large Language Models (LLMs) through external APIs and locally hosted models, exploring practical use cases for conversational AI, intelligent automation, and AI-assisted workflows.
• Built local AI applications and developer tools for running, configuring, and interacting with locally hosted language models, gaining experience with local inference, model integration, and privacy-conscious AI workflows.
• Explored Retrieval-Augmented Generation (RAG) approaches to combine language models with external knowledge sources, enabling context-aware responses based on relevant application data and retrieved information.
• Integrated AI services with backend APIs and application components, developing reusable modules for model communication, response processing, error handling, and data exchange.

• Spring Boot Software Engineer
• DevOps Engineer (Kubernetes, Azure DevOps)

Toolstack: Java, Spring Boot, Kubernetes, Helm, GitOps, ArgoCD, Docker, Azure DevOps, CI/CD Pipelines, Git, Postgres

AI Assistance and Target Vision for Partially Autonomous Energy Portfolio Management

Building an AI control layer directly on the up-to-date daily live portfolio of a large energy provider — not as an isolated pilot, but as an operational extension of the existing DB1 and portfolio management. The goal is the gradual development from assistance through monitoring/alerting to analysis agents with Human-in-the-Loop approvals, supplemented by a role-specific System of Engagement alongside the BI System of Record. At the same time, the business case, target vision and management pitch compared with static monthly reporting are being developed.

• AI control layer: Design and build on the existing live portfolio data product (several million contracts) — development stages assistance → monitoring/alerting → agents with Human-in-the-Loop approvals.
• LLM-supported data analysis: Semantic queries, SQL/tool integration and additional RAG components based on portfolio, plan-versus-actual and data quality data (Azure OpenAI, Snowflake), with drill-downs to individual contract level.
• Analysis agents: Multi-stage agents for variance and driver analyses of churn, price adjustments, volumes and procurement costs.
• Views concept: Role-specific interfaces for business units, management and C-level as a System of Engagement alongside the BI System of Record.
• Business case & pitch: Target vision and cost-benefit argumentation compared with static monthly reporting.
• LLM setup (privacy & security): Coordination with IT Security and Data Protection — EU region, data separation and approval processes.
• Agent architecture: Multi-stage agent pipelines (analysis → validation → summary) with documented data sources, tool calls, review steps and source references for each statement.
• Data foundation: Built on the up-to-date daily DB1 data product (Snowflake, dbt) — portfolio, plan-versus-actual and data quality metrics as the common basis for all AI analyses.
• Guardrails & evaluation: Evaluation and approval processes for LLM responses relating to management-relevant statements — test sets, metrics and human review.
• Prototyping & validation: Iterative validation of agent responses with the business unit — test question catalogue, feedback loops and response quality for each release.
• Roadmap & development stages: Detailed stages from assistance → monitoring/alerting → partially autonomous management, including transition criteria and governance for each stage.
• Integration: Integration into the existing BI and data landscape — BI remains the System of Record, while the AI layer provides interactive drill-down paths as the System of Engagement.
• Enablement: Enablement of business users — prompting guides, training and an operating model for ongoing use.
• Management: Coordination of business units, Data Engineering, IT Security and Data Protection.
• Change Management: Communication and expectation management with business units and management throughout the development stages.

Results:

• Built on an existing up-to-date daily data product with several million contracts
• Established an LLM setup coordinated with Data Protection and IT Security in the EU region, including data separation and approvals
• Defined three development stages through to partially autonomous management
• Designed role-specific views for business units, management and C-level
• Developed the business case and management pitch for the development stages
• Established an iterative response-quality validation process with the business unit
• Designed the operating model for assistance operations and initiated validation

Stack: Azure OpenAI, Azure AI Foundry, Snowflake, dbt, React, TypeScript, Entra ID, RAG, Agentic AI, analysis agents, Human-in-the-Loop, Prompt Engineering, LLM Evaluation, LLMOps, GDPR / EU region, Azure DevOps, Python, SQL, Change Management

• Specialized in designing and implementing robust, secure cloud solutions for critical client infrastructure.
• Expertise in Microsoft Intune environment with a strong focus on system hardening and comprehensive policy management.
• Architected NIST and ISO/IEC 27000 compliant Mobile Device Management (MDM) infrastructure tailored for an international government defense aerospace project.
• Performed an architectural role for an offline Microsoft Endpoint Configuration Manager (MECM) environment, ensuring NIST compliance while handling complex manufacturing infrastructure.

• Designed and implemented Azure Kubernetes Clusters, and managed DNS and Firewall solutions, enhancing network security and reliability.
• Led projects using Agile Scrum methodologies to streamline development cycles and improve project efficiency.
• Fostered and maintained relationships with suppliers to ensure timely project deliverables and resource availability.
• Managed continuous integration and delivery (CI/CD) pipelines using Jenkins, Sonar, GitHub, Bitbucket, and Terraform within the BMW Azure Cloud environment.
• Utilized Fortify SSC and Contrast AST for robust application security testing.
• Directed DevOps engineering initiatives on the SAP Business Technology Platform (BTP), focusing on streamlining development and deployment processes.
• Service Now governance, risk und compliance (GRC&IRM).

• Replacement of a Java application and the Oracle DB for loading the internal WerWasWo system using SSIS.
• Development of SSIS packages to load text files into the database (SQL Server)
• Development of a database project for deployment on various servers
• Creation of queries to monitor the loading runs
• Development of a PowerShell script to automate the deployment of the SSDT projects.
• Oracle, SQL Developer, Microsoft SQL Server 2022 on-premises, SQL Server Management Studio v21, Visual Studio 2022, SSIS, SSDT, PowerShell.