Penetration Testing Experts in Germany

• Operation and further development of the network and security infrastructure.

• Monitoring, analysis and resolution of network and security incidents.

• Cross-department collaboration with other specialist teams for operations, further development and reporting.

• Firewall vulnerability analysis.

• Firewall rule approvals.

• Troubleshooting IP communication issues in the network and firewall infrastructure.

• Security-critical IT infrastructure, processing of personal data, compliance with legal regulations.

• Products: Palo Alto Networks Firewalls, Cisco ACI, Checkpoint Firewalls, F5

• Technologies: SDN, SDWAN, Cisco EPIC, Cisco ACI

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
• Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
• Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
• Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability

• Responsibilities:
• Collaborate with Product Owner to define functional and technical requirements
• Quarterly Roadmap definition with Executives and Product Owner
• Fix bug and develop new features in Go and Typescript
• Manage and mentor full stack engineering team
• System Design in a micro-service environment
• Guarantee application security
• Improve engineering efficiency and deliverable quality
• Support automation with agentic-AI workflow
• Achievements:
• Improved security and data privacy awareness in the team with workshops around best practices, security measures and attacks types
• Conceptualized, designed and successfully released a new real-time chat application for our partners improving partner/company relationship and collaboration efficiency in Go and Typescript
• Reduced meeting hours for engineers by restructuring projects preparation workflow in collaboration with product team

• Consolidation
• Mergers
• Law firm chart of accounts / cost centers
• Preparation of annual financial statements
• Digital process development and optimization of the accounting/closing and reporting area
• Optimization of the DATEV software environment

• The goal of BIENE is to provide a uniform program for tax collection for all states.

• In tax collection, the aim is to collect the assessed taxes. This includes handling due dates, documenting incoming and outgoing payments, triggering reminders or refunds. Statute of limitations and payment reminders also play an important role. All payment transactions with banks and accounting are mapped in BIENE.

• Setting up the architecture and coordinating the provisioning of development and test environments at the Hanover location

• Installing and configuring environments on Linux servers (Apache Kafka, PostgreSQL)

• Interface tasks: coordinating and aligning the integration of software products from other departments and their test data

• Upgrading application server, JDK, Maven project structure

• Environment coordination and build management

• Implementing external interfaces

• Implementing business requirements

• Designing and implementing RESTful APIs and OpenAPI specifications

• Designing and implementing microservice architecture

• Setting up and maintaining CI/CD pipelines

• Deploying applications on OpenShift

• Creating technical documentation and diagrams

• Working with SQL databases (Oracle and PostgreSQL)

• Setting up authentication and authorization for the application and users

• Containerizing the application (automated deployment via CI/CD pipeline)

• Infrastructure management with Puppet and Terraform for consistent environments
• Maintenance and adaptation of Terraform scripts for Azure cloud deployment
• Migration of database systems and services to the Azure cloud
• Introduction of GitOps with ArgoCD for fully automated deployments
• Adaptation and development of GitHub pipelines for CI/CD workflows
• Creation of Helm Charts for standardized deployments
• Migration of repositories from Bitbucket to GitHub
• Operation and performance optimization of an Oracle 19c grid cluster (RAC, Dataguard)
• Setup and management of MongoDB instances (on-premise and Azure Kubernetes)
• Setup of PostgreSQL clusters in on-premise and Azure Kubernetes environments
• Migration of services, master data, and stored procedures from Oracle to PostgreSQL
• Troubleshooting and performance tuning of complex data infrastructures
• Installation, configuration, and upgrade of Tableau in the productive BI environment
• Development of sanity checks to monitor business processes and application logic
• Adaptation of the backup and recovery strategy to new requirements
• Carrying out disaster recovery and point-in-time recovery
• Technologies used: Oracle 19c RAC Grid Dataguard, PostgreSQL 16, MongoDB, MySQL Cluster, Kubernetes (Azure), Tableau, Puppet, Terraform, ArgoCD, GitHub/Bitbucket, CheckMK, Prometheus, Grafana, Icinga2, Ubuntu/RHEL

• Technical program ownership for the IPv6 migration at DRV RP and DRV BW, with a focus on migration planning, execution structure, and cross-functional technical coordination.
• Designed and implemented an operational control model with dashboard, action board, KPI portfolio, risk register, and decision index to translate technical topics into structured delivery artifacts.
• Coordinated technical groundwork for architecture and rollout across IPv6 addressing, segmentation, dual-stack target design, test-lab planning, and cross-team dependencies.
• Supported security and compliance-related requirements in the context of BSI, NIS2, and critical infrastructure, translating them into traceable evidence, risks, and management reporting.
• Achievement: Established a reusable intake-to-governance workflow for systematically capturing technical actions, risks, open issues, and evidence requirements.
• Achievement: Created an operational baseline for technical program execution with measurable KPIs, clear ownership, and transparent decision support.

• Perform secure code reviews and provide secure-coding guidance across the application and platform architecture.
• Engineer infrastructure security and design security-monitoring architecture, incident-response playbooks and Security-by-Design controls.

Software service provider for AI solutions, automation, and custom software.

Team: built from 2 to 10 developers, 8 direct reports, partly remote · Portfolio: 6 parallel projects (€25k–€250k), scaling > €1M

• Ensured delivery capability for 6 parallel customer projects: role model, capacity planning (510–660 productive person-days/year), hiring roadmap with €380k–€440k/year personnel budget
• Established SDLC framework from scratch in under 6 months: REQ/SPEC structure, V-model gates, GitHub Issues as specification, Definition of Done, release process; consistent, auditable development process across all customer projects
• Prepared large program (3,000–4,000 person-days over 18 months) for decision readiness: AI-native industry platform for the construction sector; scoping, team profile for 8–10 developers, phase 0 budget €390k
• Designed and introduced self-hosted AI platform: vLLM, LiteLLM, Qdrant, Supabase; agent architecture, MCP integration, OCR pipelines; prepared GPU investment with break-even model (month 15–16)
• Systematized presales end to end: lead qualification with maturity scoring, discovery workshops, own sizing model, costing with loaded hourly rates, structured handover to development
• Tangibly improved the security level of a customer platform: penetration test incl. re-verification of all findings

• Disciplinary and professional leadership of the IT and service team
• Definition and documentation of the Current Mode of Operation (CMO) in Confluence: application landscape, infrastructure, networks, backup & storage
• Development of the Future Mode of Operation (FMO) including process analysis & stakeholder interviews with all departments using BPMN and flowcharts
• Optimization of license management: reduction of ongoing software costs by approx. 17% p.a.
• Introduction and establishment of Jira as the central tool for project and service management
• Introduction and rollout of the HR software MindKey to digitize HR processes
• Introduction of a VoIP solution with Microsoft Teams incl. PSTN connection to replace classic telephony
• Introduction of the production and planning software OptiControl to digitize operational processes
• Rollout of Intune as a Mobile Device Management solution for Windows, iOS and Android
• Build-up of Power BI dashboards for machine park monitoring and financial reporting
• Planning and execution of the IT consolidation of two locations for 170 users
• Introduction of automated penetration testing with Pentera
• Coaching and mentoring the team in agile methods & project management
• Operational support in day-to-day business: administration, incident & change management
• Management of external service providers and assurance of the quality of outsourced IT services
• Responsibility for the IT budget incl. planning and controlling
• Direct reporting line to management with regular management reports on IT KPIs, budget and project status

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Supported the implementation of §8a requirements of the BSI Act for critical infrastructures.
• Systematically prepared and supported internal and external audits, resolving previous deviations (HA, NA, VP)
• Implemented the specific requirements of the IT security catalog
• Developed training, created run books, and conducted assessments to ensure operational effectiveness.

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action