Public Key Infrastructure Experts in Germany

• PMO Lead Security Clearance 2 (SÜ2) verified
• Reporting to the GMN sub-program management
• System maintenance 25+
• Functional management and coordination of the Jira setup
• Preparation of decision papers (e.g. project planning, governance model, communication plans, controlling models, roles and responsibilities matrices)
• Development of program-wide knowledge management using Confluence, creation of Jira concept
• Development of an access concept for all project tools
• Analysis of existing processes, identification of improvement potential, and design of solutions to increase efficiency and effectiveness
• Development of a concept for introducing automation approaches into existing tools
• Creation of intranet articles for project marketing
• Responsible for project governance through reporting and resource planning in the sub-program
• Agile development of the project methodology
• Gathering customer requirements (Requirements Engineering)
• Preparation and support of contract negotiations (7-year term, 500+ million budget)

• Customer Service Reorganization at DCS Digital Charging Solutions, Munich

• Management of nearshore service providers

• Implementation of scorecard, Q-management and CSAT management definition, customer loyalty

• Customer Service Reorganization Strategy at TWS Total Webhosting Solutions Group, Amsterdam

• Brand consolidation

• Webhosting mass market customer service strategy

• Q-management and CSAT management definition, upselling

• Provider Strategy Nearshore Customer Service, RFP process at Advanzia Bank, Luxembourg

• Definition of upsell campaigns for business customers from ISDN to NGN (VOIP) at 1&1 Versatel GmbH

• Customer approach, switching terms, order entry, service delivery, end-to-end processes, customer communication

• Definition of customer service processes (telecom, mass market, use cases) at E.ON Broadband, Avacon Connect GmbH, Berlin and Sarstedt

• Order entry, field sales processes, commission settlement, requirements for the CRM system (MS Dynamics), service provider management

• Definition of statement of work for phone and written contacts (skill definition, forecast process, SL measurement, quality measurement, scorecard, bonus-malus) at Lechwerke, LEW, Augsburg

• Support of tender process for service provider selection

• Functional management and further development of a team of 28 IT employees (internal & external) in the areas of HelpDesk / HelpLine, RHEL (Red Hat), MUREX (trading system & applications), SAP basic operations
• Management of external service providers (including FI-TS for SAP basic operations)
• Personnel, resource and budget planning for the IT department and projects
• Introduction and establishment of regular communication formats (regular meetings, team and cross-departmental meetings)
• Ensuring application operations in a hybrid environment (Windows / Linux with database and web/application servers)
• Support for transformation projects to modernize the application landscape (e.g. DevOps approaches)
• Building and introducing digital IT procurement for hardware & software (e.g. with DELL)
• Development and management of the „IT Operations DOS" department based on the company strategy
• Preparation of management reports & decision papers on IT projects, optimization potential and automation opportunities
• Representing the department in Rentenbank committees and ensuring regulatory compliance (BaFin §44, DSGVO, BSI, MaRisk)

Planning and updating the entire environment to Windows Server 2022 and 2025

• Hardening of DCs and servers, setup of event log forwarding
• Migration of all existing Windows 2019 servers (including Active Directory DCs, DNS and CA) to Windows Server 2022 and 2025
• Automation of security patches for the Hyper-V clusters via PowerShell (CAU)
• Network administration
• Continuous operation and support of the MS Hyper-V environments

• Expert in the company's architecture management area

• Support for standardizing the company's IT landscape

• Further development of architecture management

• Shaping the company's business architecture

• Restructuring, administration and maintenance of all IT assets

• Support in creating a unified software asset management and CMDB

• Creation of unified document management (e-file)

• Transition of documents into a central DMS structure

• Link between architecture management and the department's internal business process management

• Support in developing strategic and tactical development plans

• Organizing communication with key stakeholders

• Support in the conception, organization and coordination of the architecture office to be built up

• Accompanying and advising the entire architecture management process

• Advising the company's business units on architectural topics and their framework conditions

• MS Office, Windows 10, VBA

• ITIL, TOGAF, PowerBi, Kanban, Scrum

• Internal agency tools

• Open Touch Conversation, Webex, wire, bdbos

• MS Sharepoint, JIRA, Confluence

• ARIS, Archimate, BPMN

• Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
• Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
• Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
• Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
• Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
• Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.

Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin

• Implementation of a full-stack application with Angular as frontend framework and Java as backend language
• Use of the Swagger OpenAPI specification for REST communication between frontend and backend applications
• Control of a card printer via the Nexus Card SDK framework
• Design and implementation of card management software with web interface and JavaFX module for printer monitoring
• Use of Cucumber tests for test automation and creation of test artifacts for testing outside the development environment
• Use of Wireshark for network investigations to analyze the API of a third-party product and to check the REST API of the self-developed software

• Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
• Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
• Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
• Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
• Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
• Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
• Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
• Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
• Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
• Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.

• Worked for several M&A projects (Eire, Sunshine C, Coral) in the role of IT project manager and cross-functional technical manager / integration manager.
• Preparation and maintenance of project charters, project change requests and project plans.
• Weekly project status report.
• Preparation of decision papers and steering committee slidedecks.
• Risk & issue management.
• Tracking and managing activities, dependencies and deliverables across all functional IT domains.
• Data migration (planning and execution).

• Designed a migration strategy for WLS applications to BKA Cloud and Stack IT

• Created a hybrid cloud for internal testing and development with Kubernetes

• Transformed the IT landscape from an outdated monolithic architecture to a cloud-based architecture

• Integrated new CI/CD processes using Azure Pipelines

• Quadrupled the processing throughput for personnel security checks

• Migrated personnel security screening applications to Docker-based applications

• Implemented CI/deployment pipelines using Azure DevOps

• Environment: Java Springboot, Kubernetes, Oracle Weblogic, OpenID, Camunda, JUnit, TOGAF

Cloud Journey Kickoff on STACKIT

• Helped the client kickstart their cloud journey on sovereign EU STACKIT platform.
• Bootstrapped IAC & GitOps architecture with Opentofu and ArgoCD.
• Setup platform fundamentals for a fresh, holistic cloud experience: Kubernetes, external secrets, certificate management, gateway API, DNS & routing, observability basics.

• Built Azure Kubernetes clusters (AKS) with network policies, security groups, and RBAC
• Terraform-based infrastructure as code for secure, reproducible deployments in the BMW Azure cloud
• Hardened CI/CD pipelines with Jenkins, SonarQube, Fortify SSC, and Contrast AST
• Integrated SAP BTP/Kyma and ServiceNow GRC

Design and implementation of a compact ERP, CRM, accounting, and production-planning platform for a German food manufacturer. The system replaces Rechnung11, self-built Excel sheets, and manual processes for fewer than 10 internal users.

• Designed and implemented the full platform architecture as sole architect and developer.
• Built modules for customer management, B2B order handling, invoicing, production planning, and accounting support.
• Implemented DATEV export, ZUGFeRD/XRechnung e-invoicing, FinTS bank statement synchronization, and GoBD audit trail concepts.
• Used AI-supported workflows for prototyping, test support, and implementation acceleration while retaining full architecture, review, testing strategy, and technical ownership.

Technology: Java 23, Spring Boot 3, Spring Data JPA, Spring Security, Vue 3, TypeScript, PostgreSQL, Flyway, REST, OpenAPI, JWT, TOTP, RBAC, DATEV, FinTS, ZUGFeRD, XRechnung, GoBD, JUnit, Mockito, Testcontainers, Playwright, Docker, GitLab CI/CD

• Conceptual consulting for securing business processes
• Consulting for planning and implementing IT and IT security projects
• Security and policy checks, process optimization, contingency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept and for Digid GmbH.
• 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
• 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
• 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
• 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
• 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recording and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Analysis of the current IT architecture of all 23 companies.
• Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
• Preparation of a security zone concept.
• Preparation of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network Segmentation and Access Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of offers.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on introducing and initially operating an ISMS based on ISO27001.
• Auditing the IT environments of the GLS country companies.
• Analysis and assessment of IT security risks and derivation of required measures.
• Development of proposed solutions in coordination with the relevant stakeholders.
• Project management and transition of the ISMS to later operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Preparation of security policies based on ISO 2700x.
• Assumption of the interim role of Information Security Officer.
• 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
• Review and update of the IT contingency manual.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Preparation of detailed-level designs for cloud products.