Multi-Factor Authentication Expert

• Patch management and system hardening for Linux and Windows via AWS Systems Manager, including Maintenance Windows; image pipelines (AWS Image Builder), Ansible, and PowerShell DSC
• IT security & compliance: IAM/KMS/MFA, secrets management, Policy-as-Code (Checkov, tfsec, cfn-nag), AWS Config, CloudTrail, and Security Hub; infrastructure security audits, internal audits, penetration tests, and incident response exercises
• Analysis of cloud security reports and implementation of preventive measures; automated security and compliance tests; backup strategies using snapshots and S3 Glacier
• Administration of multiple AWS accounts (VPCs) with up to 2.500 Linux and Windows servers and hybrid networks
• Automation using Terraform, OpenTofu, CloudFormation, Ansible, and PowerShell DSC; CI/CD with GitLab CI and GitHub Actions
• Planning of rollouts, upgrades, and lifecycle management for key components; coordination with DevOps, security, and development teams; preparation of concepts and decision papers

• Program management for the development of an IoT platform on behalf of Deutsche Telekom IoT and 1NCE
• Structuring and coordinating the project teams and stakeholders involved to ensure robust project and decision-making structures
• Coaching project participants on the organization, collaboration, and implementation of the platform initiative

Financial services provider, >10,000 employees

• Entra ID: App Registrations, Hybrid Identities, group and permission concepts, Conditional Access, MFA, RBAC, and PIM.
• Azure IaaS/PaaS, Networking, Security, Governance, Monitoring, and automation with Bicep and PowerShell.
• Consulting and technical support for internal cloud projects.

• GfK Data center IT Infrastructure project onsite coordinator (Equinix DC FR2/FR7) training FEs in Equinix DC Carla, FNT, Jira Confluence, ServiceNow (Change/Problem/Incident MGMT), DCIM, ITSM, ITIL
• Reporting significant incidents as the on-site technical coordinator and initial point of contact for vendor escort and smart hands
• Utilizing CMDB-GUI, NIQ-Browser, CMDB-Filtering-GUI, OSS-Radar, BigBrother, CheckMK, and TTWOS for 2nd and 3rd level troubleshooting support
• Maintaining MDF, IDF, computer rooms, and closets; coordinating with service desk, reception, and security for visitor access
• Managing asset lifecycle including operation, retirement, stocking, and destruction with proper SanDisk procedures
• Leading footprint data centre optimization and reduction in FR2/FR7; handling network, server, storage, desktop, hosting, IT security, video conferencing, and telephone operations
• Coordinating server relocations, fibre optics/copper cable preparations, CMDB updates, and stakeholder cooperation
• Implementing IT infrastructure design, maintenance, configuration, and construction following Dell/HP/Apple ESD safety precautions
• Single POC for change management network, Star Track, backup & storage, cloud, Linux, Windows, EUS teams & Software Centre installs
• Successfully completed DC Footprint Reduction Project 2021/2022 and GfK New Hardware DC Refresh Initiative
• Planning, configuring, and installing Dematic server rooms and switch configurations in Heusenstamm, Wurzburg, Kahl am Main, and Graz Austria
• Providing on-site media equipment setup for HP, hospitals, manufacturers, and laboratories
• Ensuring professional rack and cable management following best practices
• Maintaining up-to-date plant maps accessible to all teams showing technology space and spare locations
• Offering technical assistance for live events, town halls, forums, streaming, and hybrid events on and off campus
• Providing second level support for Poly video conferencing systems across multiple time zones
• Conducting frequent computer room walkthroughs, recording power, cooling, alarm, security threats, and mapping wireless environment and access points

• Gathering information
• Creating rollout wave concepts
• Coordinating employees
• Monitoring and managing activities
• Project management including analysis and reporting to the board
• Creating instructions and specifications
• Training floorwalkers
• Supporting the rollout on site
• VIP support
• Introducing SharePoint

• Administration and further development of the M365 environment, including Teams, Exchange Online, Intune, and SharePoint Online
• Development of dashboards for performance monitoring with Microsoft Power BI
• Implementation of user requirements and processes with low-code/no-code technologies (Power Apps, Power Automate)
• Use of Jira and Azure DevOps to plan and implement user stories in an agile project context
• Participation in daily stand-ups, sprint planning, sprint reviews, and retrospectives as the technical point of contact
• Planning and implementation of security policies using Azure Conditional Access and multi-factor authentication
• Configuration and deployment of clients and applications via MECM (SCCM) and Baramundi

• Led QA and test automation for a distributed industrial IoT and data-integration platform connecting shop-floor systems with enterprise applications.
• Designed and maintained automated API and UI tests using Playwright, TypeScript, and Python, covering REST APIs, authentication, resource management, integrations, permissions, and end-to-end workflows.
• Tested distributed services, data pipelines, messaging infrastructure, containerized applications, and integrations across Kubernetes, OpenShift, Docker, and Docker Compose environments.
• Performed functional, integration, regression, endurance, resilience, load, chaos, and exploratory testing across complex distributed systems.
• Used Chaos Mesh and Toxiproxy for network fault injection, latency, packet loss, and partition scenarios to validate system resilience and failure handling.
• Automated infrastructure provisioning, configuration, and environment setup with Ansible and managed deployments using Kubernetes and Helm.
• Tested integrations with industrial protocols, messaging systems, databases, HTTP/REST APIs, and external enterprise systems using simulators, emulators, and dedicated test environments.
• Worked with MQTT, Kafka, SQL databases, InfluxDB, REST APIs, OAuth 2.0, JWT, LDAP, Active Directory, OpenLDAP, mTLS, TLS, MFA, SSO, and RBAC.
• Investigated and resolved 40+ defects across backend services, integrations, distributed components, and web applications, using AI-assisted analysis with Claude to accelerate debugging, test design, and root-cause investigation.
• Improved deployment reliability through Kubernetes/OpenShift configuration and health-check tuning and monitored distributed systems using Grafana, Prometheus, and Loki.
• Collaborated with developers and product teams on sprint planning, technical refinement, quality strategy, release testing, and continuous improvement.
• Applied AI-assisted and agentic testing approaches to expand automated coverage and identify complex edge cases.

Designed a global SD-WAN / SASE solution (Paloalto Prisma Access or Cisco Secure Connect) and integrated it with the data center infrastructure (Cisco ACI, Cisco Catalyst/Nexus Switches, Cisco WLAN Controller, Cisco ISE)

Further development of a software solution for managing audit applications and audit notifications according to §106d SGB V for the Association of Statutory Health Insurance Physicians in Hamburg.

• Developed numerous features, optimised performance, refactored code and analysed errors
• Refactored the development container setup
• Optimised the Gitlab-CI build pipeline
• Introduced improvements to the team workflow

Conducting a GAP analysis to assess existing security measures → identifying critical vulnerabilities

Developing an action plan that takes risk and cost-effectiveness into account

Introducing an IT maturity model based on BSI guidelines

Advising management on compliance, governance, and security strategy

Establishing internal processes for a sustainable security organization

Topics:

• Further development of the CRM system NKAM and technical separation of “direct” and “indirect” sales
• Redesign of the discount management area and outsourcing to another system.
• Designing numerous improvements on the wholesale side to reduce manual effort down to the level of user stories.

• PROBLEM: GTM effort is guesswork across fragmented identities and channels, with no closed feedback loop.
• BUILT: Cost-pyramid engine (L0–L3): identity resolution across ~25k entities, explainable intent scoring, and a closed decision loop (propose → execute → evaluate → learn) with calibration.
• IMPACT: Shipped v1.3.1 with a live demo; 99% of operations resolve at the free L0 tier (CI-enforced); $0 to run without any API key.

• Fine-tuned and evaluated alternative backbone architectures for the AFFGAN handwriting style encoder to better capture writer-specific features, benchmarking against the original baseline architecture and replacing the legacy VGG19 architecture with a custom Transformer-based encoder.
• Extended the system beyond word-level synthesis to line-level handwriting generation, integrating and adapting an existing line-generation architecture to support full-sentence output.
• Deployed the handwriting generation pipeline as a web application, enabling users to select a writing style, input custom text, and instantly generate a corresponding handwriting image.
• Integrated TrOCR into a teacher–student distillation framework to evaluate and improve readability of generated handwriting, improving OCR accuracy by 20% over the baseline.
• Boosted user-study pick-rates by 40%, demonstrating a significant leap in the perceptual quality and realism of the generated handwriting compared to the baseline model.

Tech: PyTorch, Python, GANs, CNN, ViT, TrOCR, Streamlit, CUDA.

• Strategic consulting for securing business processes
• Consulting on the planning and implementation of IT and IT security projects
• Security and policy checks, process optimization, emergency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2026: Analysis and assessment of an IT security architecture in terms of its existing design and the components in use. Development of proposed solutions to maximize security and reduce complexity. Development of a Zero Trust strategy and IT security architecture for DG Nexolution EG.
• 2026: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2025: Consulting on a DLP concept for Digid GmbH.
• 2025: Advised a customer following a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations to improve IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Development of a DNS concept, including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Development of a DHCP concept, including consulting on DHCP design, a central DHCP management system and automation. Consulting on the operation of the relevant products, their operating processes, and updates to IT documentation and IT service descriptions for Thyssenkrupp Marine Systems.
• 2024: Assessment of the current state and evaluation of the network and security infrastructure established by the providers in terms of the overall architecture, including its design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the findings to C-level management, including their causes and possible solutions, with the required decision documents. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on addressing findings from an IT security assessment of the IT infrastructure; conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX); developing a new security architecture based on Zero Trust; redesigning a Cisco ISE implementation; and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), the Federal Institute for Geosciences and Natural Resources (until 05/2023), and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Development and review of white papers for infrastructure and security architectures; planning new network infrastructures for the German Aerospace Center.
• 2022: Development of a concept for the technical and process-based modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, implementing Network Access Control, and delivering an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for the Federal Employment Agency.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including analysis and recommendations for remediation based on risk and likelihood of occurrence for customer ifi GmbH.
• 2021: Consulting, solution design and sub-project management for the introduction of a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic endpoint assignment) for office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure, including the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks, and wireless LAN, including support for implementation for the Federal Institute for Geosciences and Natural Resources.
• 2021: Development of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level 3 policies and development of procedures for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of the outsourcing of the LAN/WLAN infrastructure to a managed service provider, and development of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for a customer's “Transition of SIEM/SOC Services” project to a shared environment, and taking on the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop on a future Mobile Device Management implementation for customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for the introduction of a firewall rule management tool and recertification of NAC endpoints based on 802.1x and MAB for customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Assessment and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture in terms of the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Recommendations to improve infrastructure stability and operations. Development of a network segmentation concept and project management for implementing the measures identified in the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Assessment of the current IT architecture across all 23 companies.
• Recommendations for optimizing the IT infrastructure and a comparison of the traditional perimeter security concept with the Zero Trust model.
• Development of a security zone concept.
• Development of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the cybersecurity program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project leads and experts.
• Project area: Network Segmentation and Access-Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT-Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of bids.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on the introduction and initial operation of an ISMS based on ISO27001.
• Auditing the IT environments of GLS subsidiaries.
• Analysis and assessment of IT security risks and identification of required measures.
• Development of proposed solutions in coordination with relevant stakeholders.
• Project management and handover of the ISMS for ongoing operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Strategic and solution consulting for major enterprise customers and financial and insurance customers across Germany on Cisco and Meraki security products and services, such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and setup of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Development of security policies based on ISO 2700x.
• Took on the interim role of Information Security Officer.
• 2017: Development of an emergency plan for VPV Lebensversicherungs-AG.
• Review and update of the IT emergency handbook.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Development of detailed-level designs for cloud products.