Patch Management Experts

• Focus on optimizing and further developing the internal customer EBICS application
• Functional and technical consulting for Aareal First Financial Solutions AG on EBICS standard products and applications in the areas of operations and further development, as well as project-related communication with external development partners and the product manufacturer to implement the corresponding technical optimizations
• As the functional coordinator, providing advice on content-related and regulatory requirements as well as technical prerequisites and requirements, and bringing these together at the functional level
• Consulting on the use of EBICS formats
• Reviewing the current EBICS standard for optimization and further development potential
• Analyzing the current state to identify development potential and deriving appropriate recommendations for action while considering regulatory requirements
• Conducting EBICS tests throughout the project
• Functional responsibility for requirements management and, in this context, recording and documenting requirements for such tests
• Designing a functional and sustainable test management system
• Conducting and evaluating tests
• Consulting on sustainable quality assurance and audits
• Project language: German and English
• Tools/Methods: MS Project, MS Office, MS Visio, TestRail, Confluence, Jira, Business Logics Bankkrecher, Business Logics Test Data Generator, Business Logics Banking Tool, Business Logics Test System, DBEAVER, Squirrel, Unix Virtual Machines, WinSCP, Kitty, Putty, various Aareal Bank products, Online Banking Portal, Aareal Sign, core banking system, SAP Blue Eagle, SAP RE-FX, Aareon Wodis Sigma, Haufe Real Estate Wowinex, GAP Group Immotion, UTS Karthago, SAP IS-U/Waste, SIV kVASy, various EBICS clients

• Industry: Insurance, Trade, IT
• Customers & Projects: Consulting and selling insurance and similar services
• Main tasks: Insurance consulting (health insurance, retirement planning, wealth building); commercial services, inside and field sales; sales data analysis and forecasting; customer consulting and support; opening a new sales headquarters for private and business customers; business development & innovation management; business use case development; process optimization; stakeholder management; team leadership and training; preparation and delivery of trainings;
• Technologies used: Microsoft Office 365, Microsoft Teams, Jira, Draw.IO, Camunda 8, Java (8, 17,21,25), Git, Spring Boot, Spring Batch, Spring Data REST, Spring Web, Spring Security, J-Unit, Playwright, Lombock, Vaadin, H2, PostgreSQL (16, 17 18), pgAdmin, Docker, LLMs, JasperSoft Studio, JasperReports

• Patch management and system hardening for Linux and Windows via AWS Systems Manager, including Maintenance Windows; image pipelines (AWS Image Builder), Ansible, and PowerShell DSC
• IT security & compliance: IAM/KMS/MFA, secrets management, Policy-as-Code (Checkov, tfsec, cfn-nag), AWS Config, CloudTrail, and Security Hub; infrastructure security audits, internal audits, penetration tests, and incident response exercises
• Analysis of cloud security reports and implementation of preventive measures; automated security and compliance tests; backup strategies using snapshots and S3 Glacier
• Administration of multiple AWS accounts (VPCs) with up to 2.500 Linux and Windows servers and hybrid networks
• Automation using Terraform, OpenTofu, CloudFormation, Ansible, and PowerShell DSC; CI/CD with GitLab CI and GitHub Actions
• Planning of rollouts, upgrades, and lifecycle management for key components; coordination with DevOps, security, and development teams; preparation of concepts and decision papers

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

• Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
• Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
• Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
• Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
• Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
• Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.

Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin

Analysis and optimization of end-to-end processes in various business areas such as sales, procurement, order processing, and logistics. Redesign of the ERP system. Identification of optimization potential, especially in areas with media discontinuities and manual activities, as well as creation of a prioritized transformation roadmap with clear business cases and implementation recommendations. Management of automation initiatives. RPA at the production site in China. Evaluation and introduction of relevant AI use cases, as well as building basic AI capabilities within the organization. Training internal project team members and supporting them throughout the transformation process to develop a culture of continuous improvement. Close collaboration with IT and external implementation partners, with reporting to senior management.

Main responsibilities and achievements:

• Analysis of business processes and design of automated processes
• Training and support for employees in China and Germany
• 20% cost savings in logistics
• Regular status reports to senior management

MOVE-ZPD – Strategic Infrastructure Project | Total Program Budget 48 Mio. € | Data Center Migration Hannover → Hamburg

Responsibility for a central subproject for migrating business-critical specialist applications to a highly available data center architecture.

• Management of a central subproject for migrating business-critical specialist applications to a highly available data center architecture.
• Independent management of around 30 of approximately 100 business-critical specialist applications, including Exchange (approx. 30'000 users), LDAP, DNS and cross-state applications.
• Management of project structure, milestones, dependencies, risks and escalations, as well as coordination of the required business and technical stakeholders.
• End-to-end coordination of the managed migrations, from planning and structuring through environment provision, testing and acceptance to production deployment and go-live.
• Stakeholder management between business units, Product Owners, data center operations, program organization and external service providers.
• Development and implementation of a standardized server request and change process to speed up VM provisioning and reduce manual coordination.
• Management reporting as well as preparation and moderation of steering and decision-making bodies and workshops.

Technologies & Tools: MS Project, MS Teams, SharePoint, Oracle APEX, CA Automation Manager, Visio, MindManager

Designed a global SD-WAN / SASE solution (Paloalto Prisma Access or Cisco Secure Connect) and integrated it with the data center infrastructure (Cisco ACI, Cisco Catalyst/Nexus Switches, Cisco WLAN Controller, Cisco ISE)

NTT Data Center Replacement – €20m

• Strategy & Requirements: Data Center migration and exit strategy for ING Germany, including definition of project scope, objectives, KPIs and comprehensive requirements across cybersecurity, physical security, regulatory and group-wide strategic standards.
• Regulatory & Risk Governance: Regulatory and supervisory requirements, risk assessments, ECB notification and audit-ready documentation, achieving formal sign-off with no material findings.
• Procurement & Vendor Selection: RFP and selection of Data Center providers, migration specialists and secure transportation partners in cooperation with Procurement and in line with ING Group requirements.
• Commercial & Contractual: Complex contract negotiations with selected providers, coordinating Legal, Procurement, Business, Security, Compliance (incl. DORA) and Senior Management across both organisations.
• Infrastructure & Data Center Delivery: Data Center fit-out and implementation of base technology, including internal networks, external connectivity, cabling and core services, aligned with required security standards.
• Migration & Transition: End-to-end planning and preparation of application and infrastructure migrations, including environment-specific runbooks and coordination with Release Management, followed by handover to the internal ING organisation for execution; migration execution achieved zero unplanned downtime and no customer impact.
• Financial & Program Control: €20m Program budget with governance of expenditure, forecasts, milestones, dependencies and critical paths, maintaining delivery within approved budget and timeline parameters.

Windows Administrator, software distribution, user support, Azure / Entra Administrator, hardware support, software packaging, defining and introducing processes

Tasks performed:

• Handling incidents, service requests and changes in the Matrix42 ticketing system
• Processing and resolving issues
• User creation / permissions
• Windows installation and patch management
• Entra permissions and license management
• Process optimization and documentation

Tools and methods used: Windows Server 2016 / 2019, Active Directory, Windows 11, Office 365, Azure / Entra, Ivanti, VMWare & ESX, Dell & Kyocera Minolta & Zeus hardware support

• Strategic consulting for securing business processes
• Consulting on the planning and implementation of IT and IT security projects
• Security and policy checks, process optimization, emergency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2026: Analysis and assessment of an IT security architecture in terms of its existing design and the components in use. Development of proposed solutions to maximize security and reduce complexity. Development of a Zero Trust strategy and IT security architecture for DG Nexolution EG.
• 2026: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2025: Consulting on a DLP concept for Digid GmbH.
• 2025: Advised a customer following a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations to improve IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Development of a DNS concept, including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Development of a DHCP concept, including consulting on DHCP design, a central DHCP management system and automation. Consulting on the operation of the relevant products, their operating processes, and updates to IT documentation and IT service descriptions for Thyssenkrupp Marine Systems.
• 2024: Assessment of the current state and evaluation of the network and security infrastructure established by the providers in terms of the overall architecture, including its design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the findings to C-level management, including their causes and possible solutions, with the required decision documents. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on addressing findings from an IT security assessment of the IT infrastructure; conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX); developing a new security architecture based on Zero Trust; redesigning a Cisco ISE implementation; and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), the Federal Institute for Geosciences and Natural Resources (until 05/2023), and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Development and review of white papers for infrastructure and security architectures; planning new network infrastructures for the German Aerospace Center.
• 2022: Development of a concept for the technical and process-based modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, implementing Network Access Control, and delivering an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for the Federal Employment Agency.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including analysis and recommendations for remediation based on risk and likelihood of occurrence for customer ifi GmbH.
• 2021: Consulting, solution design and sub-project management for the introduction of a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic endpoint assignment) for office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure, including the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks, and wireless LAN, including support for implementation for the Federal Institute for Geosciences and Natural Resources.
• 2021: Development of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level 3 policies and development of procedures for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of the outsourcing of the LAN/WLAN infrastructure to a managed service provider, and development of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for a customer's “Transition of SIEM/SOC Services” project to a shared environment, and taking on the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop on a future Mobile Device Management implementation for customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for the introduction of a firewall rule management tool and recertification of NAC endpoints based on 802.1x and MAB for customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Assessment and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture in terms of the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Recommendations to improve infrastructure stability and operations. Development of a network segmentation concept and project management for implementing the measures identified in the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Assessment of the current IT architecture across all 23 companies.
• Recommendations for optimizing the IT infrastructure and a comparison of the traditional perimeter security concept with the Zero Trust model.
• Development of a security zone concept.
• Development of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the cybersecurity program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project leads and experts.
• Project area: Network Segmentation and Access-Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT-Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of bids.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on the introduction and initial operation of an ISMS based on ISO27001.
• Auditing the IT environments of GLS subsidiaries.
• Analysis and assessment of IT security risks and identification of required measures.
• Development of proposed solutions in coordination with relevant stakeholders.
• Project management and handover of the ISMS for ongoing operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Strategic and solution consulting for major enterprise customers and financial and insurance customers across Germany on Cisco and Meraki security products and services, such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and setup of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Development of security policies based on ISO 2700x.
• Took on the interim role of Information Security Officer.
• 2017: Development of an emergency plan for VPV Lebensversicherungs-AG.
• Review and update of the IT emergency handbook.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Development of detailed-level designs for cloud products.

Oracle Project Management and Automation

As part of the project, the operation of an Oracle infrastructure was automated through the development and enhancement of Puppet modules and the migration of existing Bash scripts to a standardized configuration management solution.

The project aimed to standardize and automate administrative processes, improve the maintainability of the Oracle platform, and increase the efficiency and traceability of infrastructure management through the use of Infrastructure as Code.

• Analyzed and migrated existing Bash shell scripts to a Puppet-based automation solution
• Developed and enhanced Puppet modules for Oracle environments
• Automated installation, configuration, and operational processes using Infrastructure as Code
• Standardized and optimized configuration management for Oracle systems
• Created and maintained technical and operational documentation
• Planned, coordinated, and provided technical support for project implementation
• Operated and automated Oracle systems on x86-based Linux server platforms
• Tested and ensured the quality of the developed Puppet modules
• Analyzed and resolved technical issues related to automation and migration
• Worked closely with business units and infrastructure teams to implement automation requirements

Technologies used: Puppet 7/8, SLES 15, Oracle 19, Oracle Grid, SVN, Windows Server, Confluence, VS Code, Ruby, Bash, Pass

• Coordinated with providers on the required software packages

• Reviewed lists submitted by providers and coordinated with the affected specialist departments

• Organized testing of newly scripted software packages in cooperation with the specialist departments and providers

• Selected and named the employees responsible for testing and scheduled software acceptance appointments

• Documented and filed the specialist department’s approval form

• Followed up on issues and escalated them to providers

• Planned and carried out the rollout by site and department, taking WAN capacity into account

• Ensured that no more than half of the employees at a site or in a department were migrated at the same time

• Scheduled rollout dates based on the availability of all required software packages

Migrated the PC fleet from Windows 10 to Windows 11 and upgraded core technical components: software distribution from Microsoft SCCM to Intune and sign-in via Azure AD. Approximately 2800 PCs were migrated as part of the project.

Evaluation and selection of a new endpoint management platform for an environment with around 50,000 clients. Support for a manufacturing company in evaluating a future endpoint management platform as a possible replacement for the existing client management solution. Conducting a structured software selection process including proof of concept as well as preparing the decision basis for the Enterprise Architecture Board (EAM). Defining the technical requirements and evaluation criteria and creating a short list of possible solutions (Tanium, Baramundi, Microsoft Intune / MECM). Planning and supporting the technical proof of concept as well as evaluating the architecture and operations aspects of the different platforms. In addition, evaluating tools for migrating existing software packages from the Ivanti DSM environment. Comparing and testing IDERI Move and PACE for the automated transfer of the existing package structure to the new platform, with the goal of significantly reducing migration effort. Support in selecting the required Tanium modules as well as preparing the decision documents for the Enterprise Architecture Board.

Tools: Tanium, Baramundi, Microsoft Intune, Microsoft MECM, Ivanti DSM, IDERI Move, Pace, Windows 10, Windows 11, Windows Server. VDI