OWASP Experts in Germany

IT consulting, analysis, architecture design, new and further development, code review, test automation, continuous integration, continuous delivery in backend and frontend areas for Automotive Project Instavalo.

Frontend:

• Implementation of UI components according to specifications, especially style guides and responsive design eith React and Typescript
• Component testing
• Code documentation
• CI/CD with Gitlab Pipeline

Backend / IoT:

• Analysis and architectural design with AWS Greengrass IoT on Edge Devices
• Setting up Microservices containers with Docker Compose on Edge device with AWS Greengrass and AWS IoT IAM, Token Exchange Service, Ansible
• CI/CD with Gitlab Pipeline, Terraform, AWS ECR
• Logging with Fluentbit Lua Language for AWS Cloudwatch
• Python Lambda for AWS Greengrass Recipe deployment on Edge Devices
• Implementation of test-driven development with JUnit, Mockito, and code Coverage
• Jacoco
• Definition of REST interfaces with OpenAPI / Swagger
• Development and enhancement of software based on Java Quarkus, Typescript NestJs NodeJs and Python
• Authentication and authorization in Aws IAM
• Development of REST and gRPC interfaces for the frontend and backend
• Implementation of Maven dependencies with DevSecOps OWASP
• Spring AI, Jetbrains AI Assistant, Junie, Github Copilot, Claude Code, Agents, Skills, Command, Hooks, Subagents

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

Independent engineering practice focused on custom AI systems, production delivery, and fractional technical leadership.

Selected client engagement: Scalutions

• Role: Serve as fractional CTO and hands-on technical lead, responsible for the architecture and agentic infrastructure behind its managed B2B outbound operation.

• Product: Designed and built OutboundLoop, an agentic SDR operating system for research, qualification, personalized outreach, campaign management, human approvals, measurement, and continuous improvement.

• Scope: Own the full system lifecycle—from business processes and agent behavior to context design, model routing, integrations, evaluation, telemetry, reliability, cost control, and production operations.

• Platform established and running stably; deliberately reducing my involvement to refocus on an engineering mandate in the financial sector.
• Built an own SaaS learning platform from the ground up and scaled it to over 20,000 users (over 6,000 courses sold, B2C and B2B); end-to-end ownership from development through infrastructure to operations.
• Built a lab environment that provisions an isolated Linux container per user (Docker, Traefik, Go), including automatic provisioning and a dedicated subdomain per user.
• Integrated LLM features into the product and accelerated development end-to-end with AI-assisted workflows (Claude Code, Codex); CI/CD with automated tests.

• Extension of OSGi modules in a complex communication solution
• Debugging communication with Wireshark and remotely in the JENS test environment
• Migration of tests from TestNG to JUnit 5 with Mockito and AssertJ
• Updating vulnerable dependencies and improving code quality
• Changes to the Vaadin frontend
• Increasing test coverage

Conceptual design and implementation of a modular customer portal based on Laravel.

The focus was on defining a maintainable system architecture with broad use of Domain-Driven Design principles (within the Laravel architecture), introducing automated quality assurance processes (test strategy, CI integration), and preparing an auditable operation (logging, traceability of changes) in an AWS-based infrastructure, taking IT security standards according to NIST and process requirements according to ISO 9001 into account.

Achievements:

• Analysis and structuring of business requirements in close coordination with stakeholders
• Documentation of the system architecture and infrastructure incl. change and release management
• Design and implementation of an interface for integrating SAP systems
• Planning and implementation of automated tests for quality assurance
• Implementation of security and compliance requirements, including SBOM generation, software license management, and QA processes
• Technical consulting and support for the internal IT team
• Introduction and establishment of AI-supported development processes (Spec-Driven Development), including AI-readable specifications, integration of AI instructions into the development environment, and training developers for productive use

Technologies and tools: SAP, Docker, ddev, PHP 8.4, Laravel, Filament, C4 Model, Architecture Decision Records (ADR), Mermaid, PlantUML, Spec-Driven Development, Claude, GitHub Copilot, Codex

• Set up an operational contract information system. This is mainly used as an order management system - for migrating existing contracts as well as for creating and providing new contract bundles.

• Sales agents can use it to order new services, modify existing ones and migrate service types, as well as provide price information to the customer.

• This supports the marketing of new services as well as the replacement of old services for existing customers.

• In addition, existing data is imported, processed (ETL) and provided via services for further use in the portal front end.

• Analysis of the business and technical use cases (workflows, involved processes/systems, communication paths, security requirements)

• Further development / creation of the front-end components (React/JavaScript)

• Design and implementation of the business logic

• Creation of the functional and technical component documentation

• Test execution / test automation (Cypress, test coverage)

• Team size: 8 people

• Technologies: React, JavaScript, Rest (JSon), Yaml, Markdown, MariaDB (SQL), Docker, Swagger, Cypress

• Tools: Webstorm, ReactDeveloperTools, VisualStudioCode, Word, DBeaver, Git/GitLab

• Work management: GitLab

• Platform: Linux

• Build management: GitLab

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

End-to-end responsibility for all products - concept, architecture, development, and production operation as the sole developer; in addition, customer meetings, proposals, and marketing.

Underwriting Copilot - AI assistant for industrial insurance (in production at customer sites)

• Supports underwriters in analyzing industrial insurance submissions - in production use at an industrial insurer.
• Framework-independent RAG architecture with Hybrid Search (BM25 + pgvector) across large, mixed document sets.
• Two-stage evaluation and observability pipeline (code assertions + LLM-as-Judge) that makes answer quality, retrieval accuracy, and citation integrity measurable in a regression-safe way.

Kaiki Menu Analyzer - Data intelligence platform (in production at customer sites)

• Automatically captures and analyzes menu data from around 25,000 German restaurants.
• Scalable 7-container architecture (FastAPI, partitioned PostgreSQL, Redis/RQ) with LLM-supported extraction of structured data from PDF, HTML, and images.
• Full CI/CD pipelines (GitHub Actions), production cloud deployment, interactive dashboards (Dash).

Kaiki GEO Atlas - GEO platform (in production at customer sites)

• Measures brand visibility across five AI engines (ChatGPT, Gemini, Perplexity, Grok, Claude), each augmented with web search, orchestrated as a DAG workflow pipeline (Dispatcher → Sub-workflows → Scoring → Report) with fail isolation.
• 6-container deployment (FastAPI, Celery, Redis, PostgreSQL); LLM cost estimation, PDF audit report, rule-based cross-signal insights (no extra LLM cost).

Data Pipeline & Analytics Platform - competitive analysis in the automotive aftermarket

• Automated data pipeline with gap analysis algorithms and role-based access control; 230+ tests.
• Backend with FastAPI, PostgreSQL, SQLAlchemy.

Product development (actively in progress)

BankingGPT - AI assistant for complaint management in cooperative banking

• Security architecture at the core: no AI draft reaches the customer without human approval - the approval decision is in auditable code, not in the language model (monotonic: the model may escalate, never downgrade).
• Real agentic building blocks, each with its own boundary: the model chooses tools itself through an MCP server (read-only, allowlist, capped, fail-safe); sensitive cases are handed off via an open A2A protocol (JSON-RPC, Agent Card, message/send/tasks/get; client implemented by me) to a separate specialist agent (securities/law), which never lowers the review requirement (pinned by test).
• Evaluation-driven over ten analysis rounds; uncovered a security flaw through independent review and blind tests that nine automated runs had missed.
• Voice AI frontend, responding live: covered cases are answered in the conversation, sensitive ones escalate before generation; response latency < 7 s measured (local GPU STT/TTS).

Stack & production readiness: Python, pydantic-ai, FastAPI/Celery, PostgreSQL/pgvector, FastMCP, fasta2a, Docker; multi-tenant capable (physical vector isolation per tenant), PII encrypted, OWASP-LLM reviewed, 275 tests, CI/CD; vendor-portable (Ollama / EU Cloud Vertex).

After-Sales Assistant - agentic RAG/GraphRAG assistant on public OEM manuals (automotive after-sales)

• Genuinely agentic on LangGraph: ReAct agent with four tools and conversation memory - the model decides on its own whether to use the manual (RAG, Chroma), a knowledge graph (GraphRAG, Neo4j/Cypher - decodes warning lights), or a workshop/booking service.
• Human-in-the-Loop before the irreversible action: before every appointment booking, the graph pauses (interrupt) and gets the driver's explicit confirmation - the same approval-before-action discipline as in BankingGPT, in a different framework.
• Eval as CI gate: a three-part scorecard (RAGAS grounding + deterministic tool-routing accuracy + DeepEval safety: does the answer mention the warning first when there is a critical warning?) blocks the pipeline; provider-agnostic (OpenAI/Azure/Anthropic), FastAPI with token streaming.

Stack: Python, LangChain/LangGraph, Chroma, Neo4j, RAGAS/DeepEval, FastAPI, Docker.

• Implementation of a REST-based web service for querying contract, claims, customer, and sales data as part of the Dialogmanager project.
• Data release is done in compliance with CoC requirements and individual user permissions from IAM (Identity and Access Management).
• Implementation using JBoss EAP 8.1 (JakartaEE 10) and Java 21 as well as JAX-RS, CDI, Microprofile-Config, Microprofile-OpenAPI.

• Led the end-to-end architecture and migration of a legacy on- premise IoT monitoring system to a cloud-native Azure platform within a 17-member development team
• Designed and implemented a scalable microservices architecture (Java 21, Spring Boot, Kubernetes, Azure Services), decoupling IoT data streams and eliminating legacy system bottlenecks
• Defined technology stack, mentored developers, and orchestrated cross-functional teams in 4 countries to ensure high-quality delivery and alignment with architectural standards
• Drove requirements engineering and system redesign, removing years of technical debt and introducing event-driven processing and automated workflows
• Key Achievements
• Increased system stability and uptime by ~10x, eliminating need for 24/7 DevOps intervention
• Reduced hosting costs by ~80% (5x savings) through cloud optimization
• Improved performance and scalability, enabling stable handling of high-volume IoT data streams
• Delivered successful zero-disruption migration from on-prem to cloud, with strong user satisfaction and reliability from day one

• Several projects in a police context
• Model and document police procedures/projects with Archimate (as-is/to-be) in the context of P20 (BKA)
• Create software architectures with microservices
• POC development with Springboot/Docker/Kubernetes
• Project size: 10 people
• Enterprise architecture management with Togaf and Archimate
• Backend software development Springboot
• DevOps with Kubernetes
• Implemented using: Java 17/21, Springboot 3, P20 architecture, Togaf, Archimate

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Analysis
• Consulting
• Software design
• Development
• Automation
• Testing
• Deployment
• Architecture, development and deployment of various proof-of-concept applications around the integration of current AI interfaces including conversational, realtime voice, images and videos
• Developed best practices for working with agentic systems and AI in practice
• Created code templates