Multi-Factor Authentication Experts in Germany

• Program management for the development of an IoT platform on behalf of Deutsche Telekom IoT and 1NCE
• Structuring and coordinating the project teams and stakeholders involved to ensure robust project and decision-making structures
• Coaching project participants on the organization, collaboration, and implementation of the platform initiative

Financial services provider, >10,000 employees

• Entra ID: App Registrations, Hybrid Identities, group and permission concepts, Conditional Access, MFA, RBAC, and PIM.
• Azure IaaS/PaaS, Networking, Security, Governance, Monitoring, and automation with Bicep and PowerShell.
• Consulting and technical support for internal cloud projects.

• Gathering information
• Creating rollout wave concepts
• Coordinating employees
• Monitoring and managing activities
• Project management including analysis and reporting to the board
• Creating instructions and specifications
• Training floorwalkers
• Supporting the rollout on site
• VIP support
• Introducing SharePoint

• Administration and further development of the M365 environment, including Teams, Exchange Online, Intune, and SharePoint Online
• Development of dashboards for performance monitoring with Microsoft Power BI
• Implementation of user requirements and processes with low-code/no-code technologies (Power Apps, Power Automate)
• Use of Jira and Azure DevOps to plan and implement user stories in an agile project context
• Participation in daily stand-ups, sprint planning, sprint reviews, and retrospectives as the technical point of contact
• Planning and implementation of security policies using Azure Conditional Access and multi-factor authentication
• Configuration and deployment of clients and applications via MECM (SCCM) and Baramundi

Further development of a software solution for managing audit applications and audit notifications according to §106d SGB V for the Association of Statutory Health Insurance Physicians in Hamburg.

• Developed numerous features, optimised performance, refactored code and analysed errors
• Refactored the development container setup
• Optimised the Gitlab-CI build pipeline
• Introduced improvements to the team workflow

Topics:

• Further development of the CRM system NKAM and technical separation of “direct” and “indirect” sales
• Redesign of the discount management area and outsourcing to another system.
• Designing numerous improvements on the wholesale side to reduce manual effort down to the level of user stories.

Conducting a GAP analysis to assess existing security measures → identifying critical vulnerabilities

Developing an action plan that takes risk and cost-effectiveness into account

Introducing an IT maturity model based on BSI guidelines

Advising management on compliance, governance, and security strategy

Establishing internal processes for a sustainable security organization

• PROBLEM: GTM effort is guesswork across fragmented identities and channels, with no closed feedback loop.
• BUILT: Cost-pyramid engine (L0–L3): identity resolution across ~25k entities, explainable intent scoring, and a closed decision loop (propose → execute → evaluate → learn) with calibration.
• IMPACT: Shipped v1.3.1 with a live demo; 99% of operations resolve at the free L0 tier (CI-enforced); $0 to run without any API key.

• Fine-tuned and evaluated alternative backbone architectures for the AFFGAN handwriting style encoder to better capture writer-specific features, benchmarking against the original baseline architecture and replacing the legacy VGG19 architecture with a custom Transformer-based encoder.
• Extended the system beyond word-level synthesis to line-level handwriting generation, integrating and adapting an existing line-generation architecture to support full-sentence output.
• Deployed the handwriting generation pipeline as a web application, enabling users to select a writing style, input custom text, and instantly generate a corresponding handwriting image.
• Integrated TrOCR into a teacher–student distillation framework to evaluate and improve readability of generated handwriting, improving OCR accuracy by 20% over the baseline.
• Boosted user-study pick-rates by 40%, demonstrating a significant leap in the perceptual quality and realism of the generated handwriting compared to the baseline model.

Tech: PyTorch, Python, GANs, CNN, ViT, TrOCR, Streamlit, CUDA.

• Conceptual consulting for securing business processes
• Consulting for planning and implementing IT and IT security projects
• Security and policy checks, process optimization, contingency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept and for Digid GmbH.
• 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
• 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
• 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
• 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
• 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recording and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Analysis of the current IT architecture of all 23 companies.
• Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
• Preparation of a security zone concept.
• Preparation of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network Segmentation and Access Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of offers.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on introducing and initially operating an ISMS based on ISO27001.
• Auditing the IT environments of the GLS country companies.
• Analysis and assessment of IT security risks and derivation of required measures.
• Development of proposed solutions in coordination with the relevant stakeholders.
• Project management and transition of the ISMS to later operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Preparation of security policies based on ISO 2700x.
• Assumption of the interim role of Information Security Officer.
• 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
• Review and update of the IT contingency manual.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Preparation of detailed-level designs for cloud products.

Evaluation and selection of a new endpoint management platform for an environment with around 50,000 clients. Support for a manufacturing company in evaluating a future endpoint management platform as a possible replacement for the existing client management solution. Conducting a structured software selection process including proof of concept as well as preparing the decision basis for the Enterprise Architecture Board (EAM). Defining the technical requirements and evaluation criteria and creating a short list of possible solutions (Tanium, Baramundi, Microsoft Intune / MECM). Planning and supporting the technical proof of concept as well as evaluating the architecture and operations aspects of the different platforms. In addition, evaluating tools for migrating existing software packages from the Ivanti DSM environment. Comparing and testing IDERI Move and PACE for the automated transfer of the existing package structure to the new platform, with the goal of significantly reducing migration effort. Support in selecting the required Tanium modules as well as preparing the decision documents for the Enterprise Architecture Board.

Tools: Tanium, Baramundi, Microsoft Intune, Microsoft MECM, Ivanti DSM, IDERI Move, Pace, Windows 10, Windows 11, Windows Server. VDI

• Analysis and optimization of the VMware environment for operation in a KRITIS environment
• Planning and implementation of updates to the VMware and hardware environment in a KRITIS environment
• Set up Skyline Health Diagnostics
• Review of the existing documentation
• Training and onboarding of new internal employees
• Support with migration and upgrade projects
• Preparations for moving scripts in the virtualization environment to GitLab
• Ticket processing with Service.Now

• Processing and coordination of IT tickets (Helix, Omnitracker) incl. VIP support and remote support (Microsoft Teams, RDP, FastViewer)
• Onsite support at the main location as well as support for modern conference and meeting room technology (e.g. MeetingBoard 75 Pro)
• User and rights management in Active Directory (Active Roles), Azure AD, Exchange and MDM
• VDI support and monitoring with Citrix Director and Aruba Networking
• Endpoint management and policy administration via Ivanti
• Deployment, configuration and lifecycle management of clients (Dell notebooks, iPhones, iPads)
• Hardware rollouts for new employees incl. shipping across Germany
• Asset and license management as well as organization of site migrations

• Led remote IT and cybersecurity operations, including secure device deployment, app distribution, compliance monitoring, and endpoint security using Microsoft Intune and Defender for Endpoint.
• Managed Identity and Access Management (IAM) with Microsoft Entra ID, including implementing role-based access control, conditional access, VPN configuration, and Multi-Factor Authentication (MFA).
• Supported and secured Cloud PCs, provided technical remote support, and optimized performance within the Microsoft 365 Business environment.