MobileIron Experts in Germany

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

• Conceptual consulting for securing business processes
• Consulting for planning and implementing IT and IT security projects
• Security and policy checks, process optimization, contingency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept and for Digid GmbH.
• 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
• 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
• 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
• 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
• 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recording and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Analysis of the current IT architecture of all 23 companies.
• Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
• Preparation of a security zone concept.
• Preparation of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network Segmentation and Access Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of offers.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on introducing and initially operating an ISMS based on ISO27001.
• Auditing the IT environments of the GLS country companies.
• Analysis and assessment of IT security risks and derivation of required measures.
• Development of proposed solutions in coordination with the relevant stakeholders.
• Project management and transition of the ISMS to later operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Preparation of security policies based on ISO 2700x.
• Assumption of the interim role of Information Security Officer.
• 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
• Review and update of the IT contingency manual.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Preparation of detailed-level designs for cloud products.

• Led remote IT and cybersecurity operations, including secure device deployment, app distribution, compliance monitoring, and endpoint security using Microsoft Intune and Defender for Endpoint.
• Managed Identity and Access Management (IAM) with Microsoft Entra ID, including implementing role-based access control, conditional access, VPN configuration, and Multi-Factor Authentication (MFA).
• Supported and secured Cloud PCs, provided technical remote support, and optimized performance within the Microsoft 365 Business environment.

• Construction of the data center in Oberkochen (Defence area)
• Planning of the fiber-optic ring, simulation of Wifi coverage
• Installation plan for WAN and LAN cables for office and production (infrastructure)
• Adaptation of the SAP system (R3) for the Oberkochen site (software)
• IT transformation of the SAP system to SAP HANA
• Planning of network infrastructure and server technologies in the SAP environment
• Pré-Sales support and establishment of change management
• Independent coordination of Utilities according to Time, Budget and Quality
• Mapping of the project in MS-Projekt and SERVICENow
• Development and design of hardware and software
• Demand management and portfolio management
• Establishment of a risk register and migration plan
• Preparation of documents supporting payment in coordination with the responsible financial and commercial functions
• Budget: 5 Mio. - 34 FTE

• Project manager for transition and migration of IPC Trader Telephony to 3CX-based dispatcher and Cloud9-based trader telephony
• Planned and managed company-wide replacement of IPC Trader Telephony with 3CX and Cloud9 solutions
• Continuous improvement of implementation processes and development and execution of optimization measures
• Planned, coordinated and tracked delivery of IT equipment and service provision at all sites
• Led a team of IT site managers to ensure IT services were delivered on time, within budget and with required quality
• Defined project scope in coordination with all business resources
• Planned and executed software and hardware rollouts, including user support during implementation
• Communicated with key customers and service organizations and collaborated with traders, telephony architects, app owners, testers and technical IPC teams
• Conducted stakeholder analysis for creation and maintenance of change management processes
• Managed full change process: prepared change requests, defended them in change board, communicated at company and user level, and supported change implementation

• Replacing an RIS and PACS system in combination with three different software solutions, with a focus on redesigning and further developing existing processes.
• Ensuring that the individual solutions work together and are integrated into an overall solution to optimally support medical professionals in their daily work.
• Overall project management, including managing three service providers.
• Use of technologies and solutions such as RIS, PACS, Smart Reporting and artificial intelligence.
• Leading the RIS & PACS replacement at a hospital.
• Supporting the communications strategy.
• Coordinating external and internal resources.
• Stakeholder management.
• Managing steering committees.

• Plan & Prepare (Site Design & Readiness): Inventory & Design: Dell PowerEdge R-Series, Aruba Switches (L2/L3), Notebooks/Peripherals; Serial Numbers/Asset Tags, IPv4/IPv6 Addressing, VLAN/DHCP/DNS Plan

• Runbooks/MOPs: Site Rollout Runbook, Backout Strategy (<15–30 min), Risk Register, Communication Matrix; Approvals via CAB/Change

• Images/Packages: Golden Image (Win10/11), Driver Packs, BIOS/UEFI Baseline; O365/Teams/OneDrive-KFM; BitLocker Policies; MECM/SCCM, Intune/Autopilot, MDT/WinPE

• Logistics: Shipping/Customs Clearance, RMA/DOA, On-Site Spares; Tools (Barcode Scanners, Label Printers), "Go-Bag" (Cables, SFPs, Console Cables)

• Deliver (On-Site Implementation): Endpoints: Swap & Migration (USMT/OneDrive KFM), Peripherals (ATB/BT Printers, Scanners, Boarding Gate HW); Domain Join, Compliance Checks, O365 Activation, Printers/Queues, Network Drives

• Acceptance: Functional Tests for DCS/CUTE/CUPPS/CUSS Stations, Ticketing/Check-in Workflows, Boarding Gates

• Servers (R-Series): Rack & Stack, Cabling (PDU Redundancy, Fiber/Copper), Labeling/Nomenclature; Firmware/RAID (PERC), Lifecycle Controller, iDRAC Network; Windows Server 2022/2025 + CIS/BSI Hardening; Agents (Backup/AV/EDR/Monitoring), Time Service/NTP Auth, Syslog/SNMPv3

• Network (Aruba): VLANs, LACP Trunks, MSTP Root; Portfast + BPDU-Guard at Edge; QoS (EF/AF); Dual-Stack (v4/v6), DHCP Relay. NAC/802.1X with ClearPass/Radius/TACACS+, Roles + MAB Fallback; Guest Isolation, ACLs (Guest→Mgmt deny). Telemetry: sFlow, SNMPv3, Syslog→SIEM; LLDP→Inventory/CMDB

• Airport-Specific: CUTE/CUPPS/CUSS Terminals; DCS/Amadeus/SITA Connectivity; FIDS (read-only); Bag Tag/Boarding Pass Printing; Changes During Off-Peak/Night Windows

• Stabilize (Hypercare): First-Day Support, KPI Tracking (Login Times, Ticket Volume, Error Classes), QoS Fine-Tuning

• Troubleshooting: Wireshark/iperf, Event Logs, Switch Counters, sFlow Flows; Fast Incident Handling as SPOC

• Knowledge Transfer: Short Training Sessions for Station Teams, Mini-Runbooks (Incident/Recovery)

• Close (Documentation & Handover): Documentation & CMDB: Final Configs (Switch/Server), Topology/Patch Plans, IP Tables, Serial Number/Asset Lists, Before/After Photos

• Acceptance & Sign-off: UAT Protocols, Functional Evidence (Use Cases), Return/Reuse of Old Hardware

• Lessons Learned: Risks, Standard Packages, Driver Freeze, "Known Issues"

• Interfaces/Communication: Station IT, Airport IT, SOC/NOC, Ground Ops/Ramp/Check-in, Providers (SITA/Amadeus). ITSM: ServiceNow (Inc/Req/Change/KB), Handover to BAU

• Project review, restructuring and PM for the migration of a total of 12,000 Windows workstation systems (650 applications) from SCCM or Empirum/Matrix42 to MS-Intune following a merger.
• Took over a significantly delayed and poorly managed project in the role of “firefighter”.
• Completely revised and adjusted/updated the planning of the customer and the service provider involved.
• Introduced planning baselining and the recording/mitigation of current risks.
• Introduced an efficient, partly automated planning/reporting interface between MS-Project Planning (service provider) and Jira (customer).
• Restructured meetings to increase efficiency and eliminate redundant appointments.
• Completed the analysis and design phase and prepared basic data for migrations from the heterogeneous systems of the two merged companies.
• Started the User Acceptance Test (UAT).
• Technologies: MS Autopilot, Zero Touch.

• Mobile Device & Mobile Application Management (MDM & MAM)
• MDM project management to comply with corporate policies
• Integration of new internally and externally hosted software solutions
• MDM & MAM system: Ivanti MobileIron EPMM
• Collaborative documentation processes and coordination of external service providers
• Organization of virtual training sessions for employee development
• Responsible for device administration and software distribution
• Interface management with the infrastructure provider
• Ensuring smooth IT operations
• Incident and change management
• Automation and optimization of IT infrastructure
• Creation of user documentation
• Handling and advising on customer inquiries and incidents
• Windows system administration
• Ticket system: Matrix42
• Network administration

• Extensive travel in Germany and abroad for Apple IT training
• Training from version 10.5 Leopard to macOS Sonoma

• Consulting for clients in Windows 11 migration, Microsoft Endpoint Manager (Intune/Autopilot, MECM), Microsoft 365
• Focus areas: Workplace modernization, client deployment, software lifecycle management

• Coordination and monitoring of required tasks and resources
• Coordination and ensuring the flow of information between involved departments
• Windows 10/11
• Time management and project control
• Integration of S/4HANA solutions in collaboration with business units
• Microsoft Project
• Confluence
• Jira
• Microsoft Office
• Microsoft Planner
• Responsible expert for client management environment services and patch management
• Coordination of interfaces and integration with existing systems
• Enable and enforce multi-factor authentication (MFA)
• Ensuring data migration and quality during the S/4HANA implementation
• Creation of a project structure plan
• Optimization of the design and implementation of service and client management processes
• Azure AD
• Project management & risk management
• Regular updates and drafting of decision documents for decision-makers
• Set up of an additional Linux-based infrastructure for administrative purposes
• Advising program management on transformation and migration projects
• PowerShell scripting
• Enhancement, maintenance and troubleshooting of the existing ERP application
• Synchronization with on-premises directories (Azure AD Connect)
• Conducting concept development and planning
• Procurement, integration, and deployment of MacBooks
• Autopilot
• Integration of systems into a client management system (Intune), Microsoft Defender, and Azure AD
• Implementation of single sign-on for mobile devices & PCs
• Migration from Active Directory to MS Intune
• Implementation and integration of SAP S/4HANA solutions
• Software packaging (MSI)
• Mobile device management with MS Intune and Mobile Iron
• Management of servers and services using Ansible
• MIM (Microsoft Identity Manager)
• Identity and permission management
• Access management

• External leadership & responsibility: providing and applying expertise in digital etiquette & digital AI competence on a contract basis.
• Change management & digital etiquette: enhancing the digital collaboration skills of all employees across hierarchies, with a sustainable impact on corporate culture.
• Training strategy & digitization: implementing central and decentralized training systems (online, in-person, hybrid) for the successful qualification of specialists and managers, and developing trainer guides for process training.
• Configuration manager: ensuring consistency, transparency and control of complex systems through structured configuration and change management.
• More efficient leadership: advising and enabling managers in digital communication, time management, artificial intelligence and ethics to increase efficiency and decision quality.