Okta Experts in Germany

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

Conversational AI assistant for cloud infrastructure and security queries

• Designed FastAPI backend with multi-turn conversation handler, token budgeting, and context window management.
• Integrated Amazon Bedrock (Claude 3 Sonnet/Haiku); built RAG pipeline with MongoDB chat history and semantic search.
• Implemented Factory Pattern for modular LLM provider switching; reduced model onboarding effort by 60%.
• Reduced LLM inference cost by 35% through model tiering (Haiku vs Sonnet) and prompt/entity consolidation.

Tech: Python, FastAPI, Amazon Bedrock, MongoDB, Streamlit, Pydantic.

Development and further development of an internal platform for managing and providing technical resources, virtual machines, and infrastructure services. The platform supports self-service processes and covers functions that are conceptually comparable to cloud management solutions like Azure or AWS.

• Responsible involvement in the design, development, and implementation of new backend and frontend features
• Hands-on development with Java, Spring Boot, Python, and Angular
• Implementation of REST interfaces, business logic, validations, and integrations into existing system landscapes
• Further development of modern web interfaces with Angular, including connection to backend services
• Participation in architecture and design decisions within the team, especially with regard to scalability, maintainability, and clean interfaces
• Containerization and deployment of applications with Docker, Kubernetes, and Helm
• Support with CI/CD processes and deployment to Kubernetes-based environments
• Work in the environment of vSphere, Broadcom, GitLab CI/CD, ArgoCD, Maven, npm, and NuGet
• Close collaboration with developers, business teams, DevOps, and other technical stakeholders
• Analysis of technical requirements, deriving suitable solutions, and independent implementation in an agile team
• Use of GitHub Copilot to support code generation, refactoring, test case creation, and technical documentation

Methods/ tools/ technologies: Languages & frameworks: Java (21), Spring Boot (4.x), Python, Angular, Robot Framework, Kubernetes, Helm Persistence: PostgreSQL, MongoDB, Hibernate, Liquibase Architecture & communication: REST, gRPC, GraphQL, Apache Kafka, OpenAPI, Microservices, Event Driven, Domain Driven Design Cloud & infrastructure: Terraform, Docker, Rancher, Helm, Ansible Security: OAuth2, MS (Entra ID), web security, Keycloak (extensions for detailed group rights) DevOps: GitLab CI/CD, Ansible, Maven, Gradle, Grafana, Prometheus, Git, GitHub Copilot Testing & QM: JUnit, Robot Framework, automated component and integration tests, E2E tests with Playwright, Testcontainers, EasyMock Methodology & approach: Kanban, JIRA, Confluence, Clean Code

• Remodeling of the system architecture for an Azure-based platform aimed at rapid development of new functionalities
• Modeling of a staging concept for the fulfillment of diverse customer and QA needs
• Creation of requirements for, and oversight of, a proof-of-concept supplier project for a Flutter app with highly advanced BLE functionalities
• Comparison of multiple observability platforms for feasibility and requirements fit within the project environment
• Creation of a mobile app architecture based on domain-driven architecture
• Position of technical advisor and accountable solution architect for two development teams
• Execution of architecture reviews and alignment of changes with architectural expectations
• Skills & Technologies: Microsoft Azure , App Services, NodeJS Mono-repository, microservice architecture, domain driven design, self contained systems, requirements engineering, CI/CD, DevOps, API design, solution architecture

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

Enterprise & Cloud Security Architect supporting the modernization of the SDK application landscape as part of the KVNeo transformation program. Responsible for enterprise architecture, cloud governance, security architecture, and the definition of technical standards for strategic business applications.

Key responsibilities include architecture governance, target architecture development, cloud and integration architecture, security-by-design, and the translation of regulatory requirements into sustainable technical solutions across multiple business domains.

Responsibilities and achievements

• Designed and reviewed target architectures for strategic insurance applications and enterprise services.
• Developed architecture documentation based on Arc42 and Architecture Decision Records (ADRs).
• Defined governance models, architecture principles, and technical guidelines for cross-domain initiatives.
• Supported the modernization of archive, document management, and output management platforms.
• Designed integration architectures using REST APIs and event-driven communication patterns.
• Led architecture discussions with enterprise architects, development teams, product owners, and business stakeholders.
• Translated regulatory requirements such as DORA and ISO/IEC 27001 into practical architecture decisions.
• Designed security concepts covering Identity & Access Management, authorization, authentication, auditability, and logging.
• Supported SIEM integration, security monitoring, and enterprise logging concepts.
• Evaluated technical risks, technical debt, and architecture improvements while providing decision papers for architecture boards.
• Established architecture governance processes and contributed to enterprise-wide transformation initiatives.
• Supported cloud governance activities and the definition of secure cloud architecture standards.
• Facilitated architecture workshops and coordinated cross-functional stakeholders across business and IT.

Technologies & Methods Microsoft Azure • Arc42 • Architecture Decision Records (ADR) • REST APIs • Event-Driven Architecture • Microsoft Entra ID • Active Directory • IAM • SIEM • Cloud Governance • Enterprise Architecture • Security Architecture • Azure API Management • Jira • Confluence • Draw.io • DORA • ISO/IEC 27001 • Agile • Scrum

• Supporting several agile teams in the new product development of an enterprise CRM and ERP application
• Web frontend development with Angular 17–21 (microfrontends, Domain-Driven Design, MDB-Bootstrap)
• Backend development with C# and .NET 7–10, MongoDB, MassTransit, RabbitMQ, Entity Framework Core, ElasticSearch (microservices, DDD)
• Technical feature design for assigned tasks
• Technical architecture design including forward-looking planning of AI-supported extension options
• Proof-of-concept implementation of AI-supported workflows with n8n and a locally hosted LLM (Ollama)
• Coordination with stakeholders and Product Owners, support with sprint planning

Result: Delivery of production-ready microservices and frontend modules in agile sprint cycles.

Environment: .NET 7–10 · Angular 17–21 · C# · TypeScript · OpenAPI · Microfrontends · DDD · Kubernetes · Docker · Helm · MS SQL Server · PostgreSQL · MongoDB · MassTransit · RabbitMQ · EF Core · ElasticSearch · Kibana · Azure DevOps · KeyCloak · n8n · Ollama

• Operative end-to-end recruiting in a mid-sized company environment. Main focus on filling IT positions specializing in Data Integration (Junior – Team Lead).
• Stakeholder management, active sourcing.
• Ensuring an optimal candidate experience, conducting interviews.
• Key hires: Team Lead Data Integration, Backend Engineer.
• Tools: LinkedIn Recruiter, Personio, Slack

• Establishing Identity & Directory Management as a new (split-off) team & product within the IAM cluster.
• Leading the “Identity & Directory Management” product (8 people) as Product Owner.
• Concept for ‘Digital Identities’, i.e. IDs with n users/accounts and strategy for a modernized product offering.
• Upgrading APIs, migrating to a containerized infrastructure, rolling out international markets & standardized solutions across the REWE enterprise group.
• Tech: OpenText™ (NetIQ) eDirectory & Identity Manager, LDAP, SAP HR/HCM, Docker/Kubernetes/Podman, REST APIs, Microsoft Active Directory & Entra ID, postgresDB, Keycloak, Ansible, Cyberark (PAM), Apache Kafka, Jira, Confluence, Miro.

• Conceptual consulting for securing business processes
• Consulting on planning and implementation of IT and IT security projects
• Security and policy checks, process optimizations, emergency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept for Digid GmbH.
• 2025: Consulting a client after a cybersecurity attack that compromised the IT infrastructure and where the attacker obtained M365 tenant admin rights. Investigated the IT infrastructure and restored it. Developed recommendations to improve IT security.
• 2025: Continued the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Created a DNS concept including advice on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones, and automation. Created a DHCP concept including advice on DHCP design, a central DHCP management system and automation. Advised on operating the mentioned products, the operational processes, and updated IT documentation and IT service descriptions for Thyssenkrupp Marine Systems.
• 2024: As-is analysis and assessment of the network and security infrastructure established by providers in terms of overall architecture including design and components. Designed solution proposals to improve current operations for performance and security maximization as well as complexity reduction. Presented the results to C-level, their causes and possible solutions including required decision templates. Developed a SASE concept based on a zero-trust architecture for Norddeutsche Landesbank.
• 2024: Continued the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proofs of concept for DDoS protection and digital experience monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on zero trust, redesigning a Cisco ISE implementation, and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continued the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Federal Institute for Geosciences and Natural Resources (until 05/2023), and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Created and reviewed whitepapers for infrastructure and security architectures, and planned new network infrastructures for the German Aerospace Center.
• 2022: Developed a concept for the technical and procedural modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Developed a concept for migrating measurement data to a cloud environment, introduced network access control, and conducted an awareness training for Digid GmbH.
• 2022: Developed a network segmentation concept for DZ Hyp AG.
• 2022: Developed a network segmentation concept for the Federal Employment Agency.
• 2021: Developed a new load balancer architecture concept for Bundeswehr Fuhrparkservices GmbH.
• 2021: Conducted a vulnerability scan and penetration test of a web frontend including analysis and recommendations for remediation considering risk and likelihood for the client ifi GmbH.
• 2021: Consulting, design, and subproject management for implementing a network access control solution (certificate authentication and MAC address bypass) and macro segmentation (area and zone concept based on dynamic device assignment) in office and production IT for Vaillant Group GmbH.
• 2021: Upgraded and optimized LAN and WLAN infrastructure for United Nations Volunteers.
• 2021: Developed a target concept for modernizing the IT security infrastructure including the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet connections, admin and management networks, and the wireless LAN, including overseeing implementation for the Federal Institute for Geosciences and Natural Resources.
• 2021: Created a micro-segmentation concept based on Cisco DNA, SGT, and zero trust for Union Investment IT-Services GmbH.
• 2021: Reviewed and updated ISMS level 3 policies and created procedure instructions for Software AG.
• 2021: Project lead for the global tech refresh project Meraki WLAN 2.0, coordinated the outsourcing of LAN/WLAN infrastructure to a managed service provider, and created a WLAN concept for automated guided vehicles for Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the 'Transition of SIEM/SOC Services' project migrating a client to a shared environment, and took on the interim role of Head of Security Operations at Datagroup SE.
• 2021: Conducted a workshop for the future implementation of mobile device management for Allgeier Experts Go GmbH.
• 2021: Subproject management for implementing a firewall rule management tool and recertifying NAC endpoints based on 802.1x and MAB for Union Investment IT-Services GmbH.
• 2020: Developed a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recorded and analyzed the current network architecture including project initiation.
• Designed a micro-segmentation concept in the data center and access network.
• 2020: Infrastructure and security architecture audit for Stuttgarter Versicherung AG.
• Analyzed the IT infrastructure and security architecture regarding network and security component configurations. Also reviewed contracts, process documents, and manuals for completeness. Developed recommendations to improve the stability and operation of the infrastructure. Created a network segmentation concept and led the project to implement the measures from the audit.
• 2020: Consulting on setting up an ISMS-light for Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for Datagroup SE.
• Developed a future IT infrastructure and IT security architecture.
• Documented the current IT architecture of all 23 entities.
• Made recommendations to optimize the IT infrastructure and drafted a comparison of a traditional perimeter security concept versus a zero trust model.
• Created a security zone concept.
• Designed an IT infrastructure architecture in coordination with all entities.
• 2018 - 2019: Stream lead in the cybersecurity program at Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network segmentation and access control.
• Project area: Security architecture.
• Project area: Privileged, identity & access management.
• Project area: Simplify user authentication (MFA).
• Project area: Mobile & endpoint security.
• Project area: OT security.
• Project area: E-enabled aircraft.
• 2018: Security architecture consulting for Deutsche Lufthansa AG.
• Project management for the development, evaluation, and management of the company-wide information security architecture.
• Developed a security strategy and a roadmap to align the security architecture with the zero trust model.
• Evaluated market security solutions, services, and tools.
• Defined requirements for RFPs and assessed proposals.
• Developed, maintained, and monitored security architecture artifacts.
• Conducted security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for GLS IT Services GmbH.
• Advised on implementing and initially operating an ISMS based on ISO27001.
• Audited the IT environments of GLS country subsidiaries.
• Analyzed and assessed IT security risks and derived necessary measures.
• Developed solution proposals in coordination with relevant stakeholders.
• Managed the project and handed over the ISMS to operations.
• 2016 - 2018: Security pre-sales consultant for Cisco Systems GmbH.
• Provided nationwide strategic and conceptual consulting to major enterprise and financial and insurance clients on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch, and ISE.
• 2017 - 2018: Designed and implemented an ISMS for Verivox GmbH.
• Conducted various BIAs and gap analyses.
• Developed security policies based on ISO 2700x.
• Served as interim information security officer.
• 2017: Developed an emergency concept for VPV Lebensversicherungs-AG.
• Reviewed and updated the IT emergency manual.
• 2016: Consulting and project management for designing cloud & hosting services for Vodafone Group Services GmbH.
• Analyzed and optimized the sell-build-run process.
• Created detailed level designs for cloud products.

• Consulted on IT security and process optimization, focusing on NIS2 and risk requirements
• Troubleshot and optimized plant core networks using STP, certified hardware, and open-source components such as OPNsense
• Redesigned network segmentation for VLAN rollout in a hybrid multisite multicloud setup using Tailscale VPN
• Facilitated cross-departmental discussions to align technical and social requirements
• Optimized monitoring with Grafana, Telegraf, and SNMP configurations
• Prototyped network setup for a new plant, including VLAN separation with Tailscale VPN
• Automated various scenarios using Python and Bash scripting

• Designed and operated a GitOps-based Kubernetes platform, migrating services from AWS ECS to Amazon EKS.
• Built automated CI/CD pipelines for container build and deployment using GitLab CI, Helm, and Argo CD.
• Developed reusable Helm charts for Kubernetes resources (Ingress, Services, Secrets, HPA, ExternalDNS).
• Provisioned and managed EKS (Fargate and EC2) using Infrastructure as Code (Terraform / OpenTofu).
• Implemented OIDC-based authentication and authorization (Okta) for secure access to Kubernetes and Argo CD.
• Improved container security by migrating services to distroless images.
• Implemented logging, monitoring, and observability to ensure system reliability and performance.
• Automated cloud cost optimisation using Python (Boto3), achieving approximately 45% cost savings.
• Led migration of AWS infrastructure to IaC, reducing configuration drift and deployment issues.
• Produced technical documentation and operational runbooks, supporting internal engineering teams.

• Project management
• Building an internal IAM team
• Okta
• Project management
• IAM processes

• Migration of 3 DE/AT payment iOS/Android apps and web portal to global solution
• Performed a fit gap analysis for 6 consumer apps vs. global solution
• Managed the migration project to global CWC solution, developed end-to-end tests for backend systems, Pi Planning, release planning