Microsoft Sentinel Experts in Germany

Evaluation and selection of a new endpoint management platform for an environment with around 50,000 clients. Support for a manufacturing company in evaluating a future endpoint management platform as a possible replacement for the existing client management solution. Conducting a structured software selection process including proof of concept as well as preparing the decision basis for the Enterprise Architecture Board (EAM). Defining the technical requirements and evaluation criteria and creating a short list of possible solutions (Tanium, Baramundi, Microsoft Intune / MECM). Planning and supporting the technical proof of concept as well as evaluating the architecture and operations aspects of the different platforms. In addition, evaluating tools for migrating existing software packages from the Ivanti DSM environment. Comparing and testing IDERI Move and PACE for the automated transfer of the existing package structure to the new platform, with the goal of significantly reducing migration effort. Support in selecting the required Tanium modules as well as preparing the decision documents for the Enterprise Architecture Board.

Tools: Tanium, Baramundi, Microsoft Intune, Microsoft MECM, Ivanti DSM, IDERI Move, Pace, Windows 10, Windows 11, Windows Server. VDI

• Codebase Evaluation & Problem Design: Designed and stress-tested complex software engineering problems against large open-source Python codebases (including pandas), requiring deep context acquisition and architectural understanding to produce well-scoped, realistic problem statements aligned to strict correctness guidelines.
• Agent Failure Analysis: Assessed LLM coding agent solutions for correctness and completeness, identifying meaningful failures across edge case handling, dtype behaviour, and multi-column NaN propagation logic; documented findings with precision for downstream evaluation use.
• Programmatic Test Suite Development: Authored comprehensive pytest suites to programmatically verify agent-generated solutions against defined requirements, with deliberate coverage of boundary conditions and failure modes not caught by naive implementations.
• Containerised Environment Engineering: Built and debugged Docker environments for reproducible agent execution, including git-based repository provisioning, dependency pinning with npm ci, and multi-stage Dockerfile authoring across Linux-based containers.

• Implementation of specified DevOps solutions to automate infrastructure (Terraform, Bicep, CloudFormation, Ansible) on-premises datacenter (Ovirt, Proxmox, Ceph Cluster, MinIO) and private cloud.
• Administration, configuration and implementation of CI/CD DevOps pipelines (GitLab, GitFlow) to support development process (Artifactory, Prometheus, Istio, service mesh, Helm Chart, OpenShift (Red Hat Enterprise) / Kubernetes cluster), Red Hat Satellite.
• Administration, setup, monitoring and patching of Linux infrastructure based on Red Hat Enterprise for Dev, Test and QA.
• Use of Scrum and Kanban methods.
• Administration, configuration and implementation of security standards for deploying on Dev, Test, QA and Prod stages of the new ePA applications.
• Development of new plugins and add-ons needed on current infrastructure.
• Database support.
• Data analytics support (Python, Spark, Pandas, Power BI, Splunk Enterprise).
• Implementation of best practices for DevSecOps and BizDevOps using GitOps (ArgoCD), Streamlit framework, Semaphore Ansible UI.
• Configuration and testing of iperf, uperf, sysbench using benchmark-operator for external source data and IoT/MDM devices, creating reports via ELK / OpenSearch.
• Building a new Databricks platform to collect and analyze big data from different sources and IoT devices into Hadoop framework (Python, Pandas, PySpark, Power BI, Apache Airflow).
• Building backend data aggregation and processing to automate configuration deployment between different OpenShift clusters and big data framework (Python, Pandas, PySpark, Apache Spark, PostgreSQL, Django 2, Ansible Automation, Jira JSM).
• Building a new ML pipeline platform using Kubeflow, TensorFlow, KServe.
• Data extraction, transformation and loading from different data sources including structured and unstructured data to analytic DWH / big data cluster using Python, Pandas, Polars, Power BI, Django backend and PostgreSQL.
• Setup of new DevOps Test and QA HashiCorp Vault cluster for PKI and IAM.
• Configuration and testing of automated patching based on CVSS score, SIEM-integrated CVEs.
• Use of Nexpose and InsightVM to scan vulnerability events in network, host, container and application.
• Design and implementation of secure and scalable AWS architectures including VPC, EC2, S3, RDS and Route53 and similar setups on Azure and GCP.
• Automated system provisioning and deployment using CloudFormation templates.
• Configuration of IAM roles, policies and permissions to ensure secure access control.
• Patch management, backup automation and disaster recovery setup on AWS infrastructure.
• Monitoring and optimization of system performance using AWS CloudWatch and AWS Trusted Advisor.
• Support of VMware services (vSphere, Aria, Horizon) and the virtual desktop environment.
• Development and maintenance of CI/CD pipelines using Jenkins, GitLab CI/CD and AWS CodePipeline with interface to Nutanix.
• Configuration of AWS CloudWatch to monitor application performance and system events.
• Planning and execution of migration of on-premises applications to AWS cloud platforms.
• Deployment of containerized applications using Docker and Kubernetes in AWS environments.
• Deployment of internal software packages between availability zones using AWS CodeDeploy.
• Building and deploying ML models using Scikit-learn, XGBoost and Spark MLlib including hyperparameter tuning, model evaluation and production deployment.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Integration of Post-Quantum Cryptography (PQC) algorithms into high level protocols.
• Security of implementations of Post-Quantum Cryptography algorithms.
• Transition to Post-Quantum public key infrastructures.
• Security evaluations of Post-Quantum Cryptography (PQC) primitives.
• Drone Cybersecurity
• Satellite Cybersecurity
• AI Security

• As part of the project, I was responsible for operating a Citrix farm for 600 users, including optimizing the user experience and ensuring high availability.

• I managed and optimized the entire application landscape of a major customer, evaluated and implemented application updates, and ensured the compatibility and security of the software in use.

• I managed user accounts, implemented security policies, and monitored system performance.

• I administered Azure Entra ID to control identities and access rights, implemented security policies, and synchronized on-premises directories with the cloud.

• I implemented and managed Microsoft Intune for central management of client devices, including the configuration and management of BitLocker for disk encryption.

• I managed file servers and NTFS permissions to ensure secure and efficient data access management.

• I handled change requests and last-level support tickets efficiently to solve complex system issues and improve user satisfaction.

• I supported and advised the customer team on various topics and projects, identified areas for improvement, and implemented best practices.

Technologies used:

• Citrix XenApp and XenDesktop
• Microsoft Windows Server 2012R2 and 2022
• Exchange 2016 and Exchange Online
• Entra ID (Azure AD)
• Entra ID Connect
• BitLocker
• PowerShell scripting
• Microsoft Intune
• LDAP (Lightweight Directory Access Protocol)
• DNS services (Domain Name System)
• Active Directory Certificate Services (AD CS)

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action

• PRISMA project
• Ansible automation
• Windows third level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

• Setting up a centralized security monitoring system (SIEM)
• Integrating and onboarding log sources (Windows, network, applications)
• Developing dashboards and alert structures
• Structuring data models for efficient analysis

• Analyzed existing SOC infrastructure and assessed security operations

• Transitioned to a new operating model including security monitoring, incident response, and threat intelligence

• Coordinated between internal teams, external partners, and service providers

• Implemented Microsoft Intune: configuration, compliance policies, and BYOD management

• Implemented Microsoft Defender: endpoint and network protection, automated threat detection, and incident response

• Trained IT security teams and end users

• Deployed Microsoft Sentinel: integration with existing systems, automation of playbooks

• Introduced Conditional Access: policies, MFA, and creation of reports and dashboards

• Managed project from initiation to closure including change, risk, and acceptance management

• Handled project controlling regarding schedule, costs, and quality

• Managed requirements: gathering, classifying, and evaluating IT security requirements

• Designing the information security process based on ITIL 4
• Designing the ITIL 4 incident and change management processes
• Creating information security policies for the bank
• Support in the project for internal audit findings
• Advising on the setup of the bank's internal control systems (ICS)
• Advising on setting up ICS processes
• Advising and supporting security architecture and risk analysis of the existing IT landscape, including IT security architecture, data management, data compliance & physical security
• Advising and project leadership for the security concept of the bank's assets
• Advising and support in contracts with external service providers to meet the bank's regulatory (BAIT; MaRisk; DORA; NIS2; GDPR) and information security requirements
• Support in planning and implementing a SOC/SIEM and risk management
• Support for the spam email team in analyzing and handling incidents

• Implementing secure cloud configurations with Azure Private Link, Network Security Groups, Microsoft Defender for Cloud, and Azure Regulatory Compliance for NIST 800-53, PCI DSS, and HIPAA/HITRUST, resulting in an 88% reduction in security incidents over the same period.
• Troubleshooting and supporting Microsoft Azure services, including Microsoft Sentinel (SIEM), Virtual Machines, Azure Monitor, and Azure Active Directory.
• Developing KQL queries to support the Log Analytics workspace and Microsoft Sentinel, resulting in 1 new SIEM dashboard and 4 workbooks.