OWASP Experts in Germany

• Extension of a Swing-based UI for recording Security Restricted Articles during baggage screening.
• Introduction of a new workflow for recording Deboarding Events.
• Extension of the reporting system for Security Restricted Articles and Deboarding Events.
• Implementation using JBoss Wildfly, PostgreSQL, spring-boot 3.x, Java 8/21, Swing, JSF, JAX-RS/Resteasy, Docker, Maven, Kiro.

• Established a cyber resilience framework for AI-accelerated threats in the Frontier AI Threat Endurance (FATE) program: capability assessments, maturity assessments and gap analyses covering cyber security, operational resilience, incident response, recovery and governance, followed by target concepts and improvement measures
• Supported action owners from specification through implementation: implementation roadmaps, decision papers, management presentations and governance reporting, as well as audit- and supervision-ready documentation; managed stakeholders from IT, Information Security, Risk Management, Operational Resilience, Business Continuity and the business units

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

IT consulting, analysis, architecture design, new and further development, code review, test automation, continuous integration, continuous delivery in backend and frontend areas for Automotive Project Instavalo.

Frontend:

• Implementation of UI components according to specifications, especially style guides and responsive design eith React and Typescript
• Component testing
• Code documentation
• CI/CD with Gitlab Pipeline

Backend / IoT:

• Analysis and architectural design with AWS Greengrass IoT on Edge Devices
• Setting up Microservices containers with Docker Compose on Edge device with AWS Greengrass and AWS IoT IAM, Token Exchange Service, Ansible
• CI/CD with Gitlab Pipeline, Terraform, AWS ECR
• Logging with Fluentbit Lua Language for AWS Cloudwatch
• Python Lambda for AWS Greengrass Recipe deployment on Edge Devices
• Implementation of test-driven development with JUnit, Mockito, and code Coverage
• Jacoco
• Definition of REST interfaces with OpenAPI / Swagger
• Development and enhancement of software based on Java Quarkus, Typescript NestJs NodeJs and Python
• Authentication and authorization in Aws IAM
• Development of REST and gRPC interfaces for the frontend and backend
• Implementation of Maven dependencies with DevSecOps OWASP
• Spring AI, Jetbrains AI Assistant, Junie, Github Copilot, Claude Code, Agents, Skills, Command, Hooks, Subagents

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

• Led the end-to-end architecture and migration of a legacy on- premise IoT monitoring system to a cloud-native Azure platform within a 17-member development team
• Designed and implemented a scalable microservices architecture (Java 21, Spring Boot, Kubernetes, Azure Services), decoupling IoT data streams and eliminating legacy system bottlenecks
• Defined technology stack, mentored developers, and orchestrated cross-functional teams in 4 countries to ensure high-quality delivery and alignment with architectural standards
• Drove requirements engineering and system redesign, removing years of technical debt and introducing event-driven processing and automated workflows
• Key Achievements
• Increased system stability and uptime by ~10x, eliminating need for 24/7 DevOps intervention
• Reduced hosting costs by ~80% (5x savings) through cloud optimization
• Improved performance and scalability, enabling stable handling of high-volume IoT data streams
• Delivered successful zero-disruption migration from on-prem to cloud, with strong user satisfaction and reliability from day one

Independent engineering practice focused on custom AI systems, production delivery, and fractional technical leadership.

Selected client engagement: Scalutions

• Role: Serve as fractional CTO and hands-on technical lead, responsible for the architecture and agentic infrastructure behind its managed B2B outbound operation.

• Product: Designed and built OutboundLoop, an agentic SDR operating system for research, qualification, personalized outreach, campaign management, human approvals, measurement, and continuous improvement.

• Scope: Own the full system lifecycle—from business processes and agent behavior to context design, model routing, integrations, evaluation, telemetry, reliability, cost control, and production operations.

• Extension of OSGi modules in a complex communication solution
• Debugging communication with Wireshark and remotely in the JENS test environment
• Migration of tests from TestNG to JUnit 5 with Mockito and AssertJ
• Updating vulnerable dependencies and improving code quality
• Changes to the Vaadin frontend
• Increasing test coverage

Conducted an independent technical assessment of an AI-enabled software platform, combining AI risk auditing, cybersecurity analysis and software architecture review. Reviewed application components, APIs, data flows, LLM integrations, retrieval-augmented generation, multi-agent orchestration, authentication, tenant isolation, dependency vulnerabilities, AI governance and model lifecycle controls. Authored a technical audit report with a structured risk register, source-code evidence, regulatory references, corrective actions, AI system inventory, risk classification, remediation roadmap and Key Risk Indicators.

Technologies: TypeScript, JavaScript, React, Next.js, Node.js, REST APIs, MongoDB, Redis, AWS serverless services, OAuth 2.0 / OpenID Connect, LLM APIs, RAG, vector search, multi-agent orchestration, Model Context Protocol, C4 architecture modelling, threat modelling, NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, OWASP guidance, MITRE ATLAS

End-to-end responsibility for all products – conception, architecture, development, and production operations as the sole developer; also customer discussions, proposals, and marketing.

Underwriting Copilot – AI assistant for industrial insurance (in production with a customer)

• Supports underwriters in analyzing industrial insurance submissions – in production at an industrial insurer.
• Framework-independent RAG architecture with Hybrid Search (BM25 + pgvector) across large, heterogeneous document collections.
• Two-stage evaluation and observability pipeline (code assertions + LLM-as-Judge) that makes answer quality, retrieval accuracy, and citation integrity measurable in a regression-safe way.

Kaiki Menu Analyzer – Data intelligence platform (in production with a customer)

• Automatically collects and analyzes food data from around 25,000 German restaurants.
• Scalable 7-container architecture (FastAPI, partitioned PostgreSQL, Redis/RQ) with LLM-supported extraction of structured data from PDF, HTML, and images.
• Complete CI/CD pipelines (GitHub Actions), production cloud deployment, interactive dashboards (Dash).

Kaiki GEO Atlas – GEO platform (in production with a customer)

• Measures brand visibility across five AI engines (ChatGPT, Gemini, Perplexity, Grok, Claude), each augmented with web search, orchestrated as a DAG workflow pipeline (Dispatcher → Sub-Workflows → Scoring → Report) with fail isolation.
• 6-container deployment (FastAPI, Celery, Redis, PostgreSQL); LLM cost estimation, PDF audit report, rule-based cross-signal insights (no additional LLM effort).

Data Pipeline & Analytics Platform – Competitive analysis in the automotive aftermarket

• Automated data pipeline with gap analysis algorithms and role-based access control; 230+ tests.
• Backend with FastAPI, PostgreSQL, SQLAlchemy.

Product development (actively in development)

BankingGPT – AI assistant for complaint management in cooperative banking

• Security architecture at its core: no AI draft reaches the customer without human approval – the approval decision is stored in auditable code, not in the language model (monotonic: the model may increase the level, but never lower it).
• Genuine agentic components, each with its own boundaries: the model selects tools itself through an MCP server (read-only, allowlisted, capped, fail-safe); sensitive cases are sent via the open A2A protocol (JSON-RPC, Agent Card, message/send/tasks/get; client implemented independently) to a standalone specialist agent (securities/law), which never lowers the review requirement (pinned by tests).
• Evaluation-driven across ten analysis rounds; an independent review and blind tests uncovered a security defect that nine automated runs had missed.
• Voice AI frontend, responding live: covered cases are answered during the conversation, while sensitive cases are escalated before generation; measured response latency < 7 s (local GPU STT/TTS).

Stack & production readiness: Python, pydantic-ai, FastAPI/Celery, PostgreSQL/pgvector, FastMCP, fasta2a, Docker; multi-tenant (physical vector isolation per tenant), encrypted PII, OWASP-LLM-reviewed, 275 tests, CI/CD; provider-portable (Ollama / EU-Cloud-Vertex).

After-Sales Assistant – agentic RAG/GraphRAG assistant based on public OEM manuals (automotive after-sales)

• Genuinely agentic with LangGraph: ReAct agent with four tools and conversation memory – the model decides itself whether to use the manual (RAG, Chroma), a knowledge graph (GraphRAG, Neo4j/Cypher – decoding warning lights), or a workshop/booking service.
• Human-in-the-loop before the irreversible action: before every appointment booking, the graph pauses (interrupt) and obtains the driver's explicit confirmation – the same approval-before-action discipline as in BankingGPT, in a different framework.
• Eval as a CI gate: three-part scorecard (RAGAS grounding + deterministic tool-routing accuracy + DeepEval safety: does the answer mention the warning first in the case of a critical warning?) blocks the pipeline; provider-agnostic (OpenAI/Azure/Anthropic), FastAPI with token streaming.

Stack: Python, LangChain/LangGraph, Chroma, Neo4j, RAGAS/DeepEval, FastAPI, Docker.

• Developed a custom tool using the Mistral 7B LLM to scan, validate, and report security vulnerabilities.
• Security tested AI agents, bots, and other LLMs, focusing on prompt injection, model inversion, data poisoning, EDR/AV bypass and evasion techniques, membership inference, model evasion, overfitting to malicious inputs, and contextual manipulation.
• Onboarded repositories to SAST solutions for security scanning, implemented secrets scanning, DAST, and SCA, and used ZAP for DAST in CI/CD pipelines.
• Delivered security awareness training and developed CTF challenges and training materials to improve developers' security knowledge.
• Planned and carried out bi-annual red teaming operations based on the MITRE ATT&CK framework and led internal and external pentests based on the OWASP Top 10 framework for 70+ applications worldwide, resulting in the detection, reporting, and remediation of hundreds of vulnerabilities.
• Triaged HackerOne reports.

• Several projects in a police context
• Model and document police procedures/projects with Archimate (as-is/to-be) in the context of P20 (BKA)
• Create software architectures with microservices
• POC development with Springboot/Docker/Kubernetes
• Project size: 10 people
• Enterprise architecture management with Togaf and Archimate
• Backend software development Springboot
• DevOps with Kubernetes
• Implemented using: Java 17/21, Springboot 3, P20 architecture, Togaf, Archimate

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Analysis
• Consulting
• Software design
• Development
• Automation
• Testing
• Deployment
• Architecture, development and deployment of various proof-of-concept applications around the integration of current AI interfaces including conversational, realtime voice, images and videos
• Developed best practices for working with agentic systems and AI in practice
• Created code templates