Open Policy Agent Experts in Germany

• Developed a browser-based platform for Kubernetes no-code deployment and cluster management
• Developed a CLI in TypeScript to deploy resources in the cluster without leaving the browser UI.
• Implemented DevSecOps pipelines: image scanning, SBOM, policy enforcement, supply-chain security, and used Kyverno. Implemented IAM integration for the command-line utility tool.
• Designed role and permission models for Keycloak, OAuth/OIDC, and social login flows.
• Used LLMs to convert user intent into diagrams.
• Worked on integration with multiple sovereign clouds like StackIT, Hetzner, CIVO, UpCloud, plus public clouds like AWS, GCP, and Azure
• The technology stack includes Java, Spring Boot, Kubernetes, OpenAI, Kubernetes multi-tenancy using vCluster, Karpenter, RBAC for CLI, Helm, React

• Led migration to GCP using Terraform, GKE, and GitOps, improving deployment consistency and scalability
• Implemented Datadog observability stack via Terraform and datadog-operator
• Established automated end-to-end tests and on-call processes, improving incident response and service reliability
• Migrated from NGINX Ingress Controller to Kubernetes Gateway API (NGINX Gateway Fabric)
• Migrated stateful services (PostgreSQL and Redis) to GCP, improving scalability and operational reliability

• Designing the audit logging framework
• Implementing APIs for developers to integrate in their codebase
• Implementing ingestion pipeline, database query layer and UI for browsing the audit events
• Improving stability and reliability of the backend system

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

• Drive migration of enterprise authorization platform from Styra DAS to open-source OPA via Skipper (Zalando's Golang-based ingress proxy) integration
• Optimise k8s resources and integrate native Prometheus metrics with OPA
• Migrate from internal monitoring solution to Prometheus CRs + Dash0

Tech Stack: Java/Kotlin, Golang, Python, Spring Boot, AWS, Kubernetes, Docker, OpenTofu, Prometheus, Grafana

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Extended a global large-scale project to improve the multi-tenant GCP data platform using FAST framework concepts, leveraging Terraform, Terraform Enterprise, and GitLab.
• Collaborated closely with security and governance teams to architect and implement secure and compliant GCP environments, focusing on VPC Service Controls, KMS, organizational structure, and guardrails to support the isolation of corporate entities.
• Enhanced the security posture of the enterprise GCP platform by implementing robust security measures, including GCP organization policies, deny policies, and VPC Service Controls to safeguard against potential exfiltration risks.
• Implemented controls based on CSA Cloud Controls Matrix (CCM v4) to secure the GCP cloud environment.
• Automated key components of the GitLab CI/CD pipeline by integrating OpenID Connect (OIDC) for workload identity federation, necessary for a large migration from GitHub.
• Implemented a YAML-based project factory to facilitate easy, secure, and governed provisioning of tenant projects, increasing speed, scalability, and usability while minimizing operational burden.
• Developed a dynamic approach for policy attachment to tenants using a YAML-based custom IAM template approach.
• Evaluated and implemented Google PAM (Privileged Access Manager) in a proof of concept for organization-wide just-in-time access.
• Set up CyberArk SCA and CEM tooling to ensure secure cloud access and provide visibility into the cloud environment.
• Handled GCP incidents, ensuring prompt resolution and operational stability.
• Authored and maintained extensive documentation within an Agile environment, utilizing Jira and Confluence for project tracking and knowledge management.
• Utilized HashiCorp Sentinel as a policy-as-code tool to shift-left cloud security by enforcing policies before infrastructure provisioning.
• Used Prisma Cloud to continuously monitor and secure GCP resources, ensuring compliance and risk mitigation across the organization.
• Developed a custom Org Policy Factory to standardize and automate custom governance across projects, ensuring enforcement of non-trivial organizational controls.
• Architected and built a cloud-agnostic credential lifecycle management platform with Python and GitLab to automate the secure handling of static credentials, improving governance, compliance, and audit readiness.
• Delivered an executive-level presentation on VPC Service Controls to C-level stakeholders, driving strategic awareness and alignment on cloud security posture.
• Led resolution of P1 incidents with high production impact, restoring services under critical time constraints.
• Architected and deployed a central monitoring and alerting solution using Cloud Monitoring and PromQL, providing real-time visibility into system health and proactive incident detection.
• Designed and developed a Python-based broker for self-service integration with an internal developer platform, streamlining onboarding and reducing manual effort.
• Implemented a templating approach for VPC Service Controls, enabling repeatable, secure, and consistent deployment patterns across tenants and environments.

• Agile app development and product ownership in e-commerce
• Feature planning and creating user stories
• Organizing external freelancers (cross-functional teams)
• Backend and frontend development
• Story mapping
• Backlog management
• Roadmap planning
• Budget control and capacity planning

• AI-supported source code analysis
• AI image generation for a shirt shop
• AI-supported analysis of connected YouTube channels and commenting users
• AI-supported software prototyping
• Operation of a local AI environment
• 3D printing and scanning: development of a process to repair GfK parts using 3D-printed negative molds

The focus is on practical applications of new technologies, founding an open-source project for a yacht autopilot, as well as yacht refit and motorhome conversion.

• Planned and implemented new network infrastructure (VLAN, LACP, DMZ, structured cabling)
• Migrated from VMware to KVM using Oracle Linux Virtualization Manager (OLVM), including CPU pinning
• Hardened the entire environment using SELinux (KVM hosts, container hosts, database servers)
• Configured and operated the virtualization platform with OLVM and Ansible-based provisioning
• Containerized and redeployed critical services: WordPress, Jenkins, PostgreSQL, MariaDB, Subversion with Apache + AD integration
• Developed Ansible playbooks for automated deployment and configuration management
• Integrated Foreman for repository and security management in the DMZ
• Produced technical documentation in Markdown; organized in Bookstack
• Coordinated with external vendors (e.g. HPE) for hardware installation and setup
• Delivered all contributions documented and reproducible in Markdown

• Developed and extended Fiori UI5/WebApps for areas such as general ledger, asset accounting, and others.
• Implemented backend logic and OData services for a new S/4 HANA system
• Analyzed the current state of SAP GUI transactions and derived suitable standard and custom developments
• Designed technical concepts and implemented custom UI5 apps in the Fiori Launchpad
• Automated OPA tests, extended and adapted standard Fiori apps
• Documented and created developer manuals in the wiki
• Conducted code reviews, approved and delivered software units via GitLab and SAP transports