Multi-Cloud Experts in Germany

• Electronics – Surface Solutions | Carve-out of IT, data and system landscape*

• Separation of a full business division's IT, data and system landscape following divestment across cloud, on-premises and connected laboratory systems; centrally governed investment envelope in the three-digit m€ range

• Laboratory notebook and laboratory analytics platform stream: Palantir Foundry, Snowflake, Signals Notebook, Power BI and connected laboratory instrumentation; SharePoint and JIRA; site transition completed without interruption to laboratory operations

• Decision authority and escalation point for business, IT infrastructure, IT security and vendors; separation executed across globally distributed users and systems and handed over on schedule, avoiding a contractual penalty for the client

• Strategic planning, detailed technical preparation and operational management of an email gateway migration in a security-critical government environment.
• Preparation of the technical specification and development of technical concepts and migration approaches in line with BSI requirements.
• Technical requirements management with business units, information security and operations.
• Coordination of external service providers, integrators and implementation partners; maintenance of project plans, milestones, resources, risks and dependencies.
• Regular reporting to project management, the program environment and internal stakeholders.

Support for Transformation Projects:

• Expert CTO advisory and enterprise architecture consulting for several short-term transformation projects, ensuring measurable improvements in project outcomes and technical business alignment.
• Supporting strategic IT initiatives for diverse clients, driving digital transformation and optimizing technology operations to increase business value and operational efficiency.

• Architected and deployed private cloud data platform on VMware vSphere, integrating Greenplum MPP, Apache Kafka, Kubernetes, and Apache Solr, and developed real-time ingestion pipelines with Kafka Connect and Schema Registry.
• Led Oracle Exadata to Greenplum migration, rearchitected data models, optimized storage, implemented RabbitMQ with Debezium for CDC, and deployed VectorDB for Generative AI.
• Designed and executed multi-cloud migration PoC across AWS, Azure, and GCP, defined KPIs for throughput, latency, and cost efficiency, executed bulk data transfers, validated analytics and streaming workloads, and delivered full-scale architecture recommendations.
• Assessed legacy on-premises infrastructure and designed modern cloud-native data platforms using Greenplum and containerized microservices, advising on scalability, disaster recovery, and high-availability.

Red Hat OpenShift Container Platform

Scope:

• Operation and configuration of the Red Hat OpenShift Container Platform, including network, storage, and security design.
• Implementation of centralized observability solutions (Prometheus, Grafana, alerting).
• Development of CI/CD pipelines, GitOps workflows, and automation frameworks.
• Training and enablement of operations and development teams.

Result: Accelerated service delivery, transparent operational metrics, and sustainable knowledge transfer.

Cloud Journey Kickoff on STACKIT

• Helped the client kickstart their cloud journey on sovereign EU STACKIT platform.
• Bootstrapped IAC & GitOps architecture with Opentofu and ArgoCD.
• Setup platform fundamentals for a fresh, holistic cloud experience: Kubernetes, external secrets, certificate management, gateway API, DNS & routing, observability basics.

• Optimizing and accelera­tion of our Gitlab CI pipeline

• Conceptual work for the PoC of the Zero Trust system

• Extension of the policy-engine backend in Go

• Extension of the policy-testing mechanism in Python

• Architectural design of the PEP component of Zero Trust

• Documentation of the product

• Technologies: Zero Trust, Go, Python, Gitlab CI, Docker, JWT, Domain-Driven Design

Conversational AI assistant for cloud infrastructure and security queries

• Designed FastAPI backend with multi-turn conversation handler, token budgeting, and context window management.
• Integrated Amazon Bedrock (Claude 3 Sonnet/Haiku); built RAG pipeline with MongoDB chat history and semantic search.
• Implemented Factory Pattern for modular LLM provider switching; reduced model onboarding effort by 60%.
• Reduced LLM inference cost by 35% through model tiering (Haiku vs Sonnet) and prompt/entity consolidation.

Tech: Python, FastAPI, Amazon Bedrock, MongoDB, Streamlit, Pydantic.

• Azure Landing Zone architecture: Design and implement a hub-spoke, multi-region-capable Azure landing zone that provides the secure, scalable and highly available foundation for autonomous driving and parking data/ML platforms.
• Compliance through Azure Policy: Enforce security and compliance standards across Azure subscriptions via Azure Policy (guardrails, deny/audit/deploy-if-not-exists), consistently achieving top-tier infrastructure security scores.
• Infrastructure-as-Code: Automate provisioning and configuration of Azure resources with Terraform and Bicep, with changes delivered through reviewed CI/CD pipelines.
• Azure Databricks and Unity Catalog: Extensive experience operating Azure Databricks with Unity Catalog for centralized data governance, access control, lineage and auditing across workspaces.
• Monitoring and observability: Built and run infrastructure monitoring and logging with Azure Monitor, Prometheus, Grafana and Loki, covering platform health, alerting, troubleshooting and capacity trends.
• Platform at scale: Architected and operate cloud data/ML platforms supporting multi-PB vehicle data ingestion and simulation; orchestrate Argo Workflow-based recompute and autolabeling services scaling to 100k+ concurrent pods on AKS.
• Reproducible ML: Established reproducible training environments with dataset versioning and provenance tracking, enabling auditing and experiment reliability.
• Operational excellence: Automated GitHub organization management and CI/CD pipelines, improving developer productivity and deployment reliability; automated recurring operational processes.
• FinOps: Developed transparent resource utilization and cost-tracking for multi-project Azure environments.
• Leadership: Technical lead for infrastructure topics, collaborating with development, DevOps and security teams; technical interviewer and recruitment panel member for scaling the engineering team.

• Investigation PoC and exchange and refinement of an existing cloud and IoT power plant control solution for certificate management of renewable energy power plants (solar, wind, biomass and others) of the largest European renewable energy power plant operator in this field, including investigation of the IoT devices used in the field and their integration and network connection with the aim of automated PKI key management.
• Messaging with Kubernetes for large API-connected enterprise applications
• Risk and Attack Vector Analysis, Software Quality & Bug Assessments
• Agile Workload Scheduling via Jira & ConJluence
• Evaluation of message streams Pub/Sub for MQ and KaJka.
• Various tests with “best design approaches” regarding resilience patterns such as Circuit Breaker Designs, Throughput Measurement and Monitoring, Bulkhead Governors - for robust EA design
• Integration of API Management with IBMs API Connect to Kubernetes - for agnostic Microservices API Management Designs. Google Apigee
• Solution Health Check Approaches for Load Burst Situations + Remedy
• Research and investigation of available potential subcontractors in the coordinating role as Solution Manager. CIS20 Controls.
• Dread and Stride Security Assessments.

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.

• Drive migration of enterprise authorization platform from Styra DAS to open-source OPA via Skipper (Zalando's Golang-based ingress proxy) integration
• Optimise k8s resources and integrate native Prometheus metrics with OPA
• Migrate from internal monitoring solution to Prometheus CRs + Dash0

Tech Stack: Java/Kotlin, Golang, Python, Spring Boot, AWS, Kubernetes, Docker, OpenTofu, Prometheus, Grafana

• Build and operate an end-to-end MLOps platform on Azure ML and Kubernetes (Kubeflow) for the automated deployment, monitoring, and scaling of forecasting models (including Temporal Fusion Transformer, Informer, Autoformer).
• Implement CI/CD pipelines in Azure DevOps for the full ML lifecycle – from resource provisioning (Terraform), data transformation (Hugging Face Datasets, Pandas, PyTorch, CUDA cluster) through training and evaluation to model registry and endpoint deployment.
• Integrate MLflow for experiment tracking, model versioning, performance monitoring, and automated registration in the Azure Model Registry.
• Develop and containerize PyTorch training jobs (Azure Notebook, Jupyter Notebooks) for price and time series forecasting (PFC models) with automatic rollout via Azure ML Endpoints and REST/gRPC interfaces, Docker containerization, secured with OAuth 2.0.
• Set up monitoring and alerting mechanisms (Prometheus, MLflow Metrics), log centralization, and cost monitoring.
• Automate infrastructure provisioning and model deployment using Terraform, Helm, and Azure CLI; connect to existing market data systems and event pipelines.
• Migrate existing workloads and databases (IONOS → Azure, MongoDB) with integration into central MLOps workflows and internal networks.
• Extend the platform with LLM-based tools (LangChain, LangServe) to integrate GPT-based analysis modules into existing Spring Boot services for market anomaly detection and automated reports.
• Analyze and architect a software solution to process large volumes of data efficiently (>3000 messages/sec.) (market data store).
• Spring Boot / Java 21 container development with RabbitMQ for distributing stock market data via MongoDB (Kubernetes) with fast storage of data in Redis RMaps, deduplication, forwarding messages to Read Model queues, and building Read Models for UI display in MongoDB.
• Integration of RESTHeart to create a REST API for MongoDB.
• Build an Angular frontend to simplify data queries and master data maintenance.
• Agentic coding with remote and local LLMs (Claude Sonnet, Ollama Qwen) and MCP servers.
• Develop Python scripts for transforming and cleaning incoming stock market data (Pandas, scikit-learn).

• Led remote IT and cybersecurity operations, including secure device deployment, app distribution, compliance monitoring, and endpoint security using Microsoft Intune and Defender for Endpoint.
• Managed Identity and Access Management (IAM) with Microsoft Entra ID, including implementing role-based access control, conditional access, VPN configuration, and Multi-Factor Authentication (MFA).
• Supported and secured Cloud PCs, provided technical remote support, and optimized performance within the Microsoft 365 Business environment.