Red Teaming Experts in Germany

Conventional Paradigm Test (CPT) – AI Evaluation & LLM Research

Development of an experimental evaluation approach to examine “paradigmatic closure” in Large Language Models — that is, the question of how far LLMs can recognize the basic assumptions, values, and limits of the paradigms within which they generate answers.

Design and testing of an additional approach to classic AI benchmarks that does not primarily measure factual correctness or task performance, but instead examines a model’s ability to recognize alternative perspectives, make implicit assumptions visible, and reflect on the limits of its own answer or interpretation framework.

Focus areas: development of evaluation criteria and test questions · LLM evaluation and comparative model analysis · prompt and response analysis · qualitative classification of model answers · study of epistemic compression and value leakage · benchmark and literature research · development of structured assessment and analysis methods

As part of CPT, existing AI evaluation approaches and benchmarks were analyzed, and a minimalist test protocol was developed that classifies model answers by response patterns such as DIRECT, CLARIFY, PLURALIST, REFUSE, and META-AWARE. TruthfulQA was used as the basis for experimental application and comparison with existing reference answers.

Technologies & Methods: Large Language Models (LLMs) · Generative AI · Prompt Engineering · AI Evaluation · TruthfulQA · Benchmark Analysis · Human-in-the-Loop Evaluation · Qualitative Content Analysis · Research & Literature Review

• Perform secure code reviews and provide secure-coding guidance across the application and platform architecture.
• Engineer infrastructure security and design security-monitoring architecture, incident-response playbooks and Security-by-Design controls.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Completed 25+ hands-on labs focusing on digital forensics, incident response, and advanced threat hunting techniques.
• Earned top-tier badges in malware analysis, enterprise log analysis, and threat intelligence gathering.
• Developed specialised skills in forensic report writing and evidence collection methodologies to support incident investigations.

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action

• Development of comprehensive services in cybersecurity, IT governance, and AI
• Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
• Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
• Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
• Responsible for company growth, client relations, and strategic partnerships

• Improvement of the Information Security Management System (ISMS) based on ISO 27001, NIS2, DORA, B3S, TISAX and BSI IT Baseline Protection
• Conducting comprehensive gap analyses to identify gaps and derive action plans according to the above standards and regulations; management and KPIs
• Data Loss Prevention strategy and implementation using MS Purview
• Vulnerability and patch management, security monitoring
• Risk analysis and threat modeling using the STRIDE methodology
• Development of vendor risk assessments, implementation of risk classifications, conducting supplier assessments and implementing technical monitoring solutions (e.g. Security ScoreCard)
• Securing cloud environments (AWS and Azure); expertise in CSPM/CNAPP (Wiz), cloud migration, secure CI/CD pipelines, container security and best practices in AWS, Azure and Office 365
• Application security: penetration testing, DevSecOps, OWASP, pre-commit hooks, key and secret management, IDE plugins, static source code analysis, dependency checks, container scanning, vulnerability management, CIS benchmarks and compliance
• Security assessment and hardening according to CIS benchmarks and cloud conformity in AWS, Office 365 and Azure

• Performed security assessments and penetration testing on Microsoft AI models for text, image, and video generation.
• Conducted prompt injection attacks through diverse input vectors, including crafted text, steganographic images, and manipulated visual elements (e.g., varying opacity and embedded content).

• Developed a custom tool using the Mistral 7B LLM to scan, validate and report security vulnerabilities.
• Security tested AI agents, bots, and other LLMs with a focus on prompt injection, model inversion, data poisoning, EDR/AV bypass and evasion techniques, membership inference, model evasion, overfitting to malicious inputs and contextual manipulation.
• Onboarded repositories to SAST solutions for security scanning, implemented secrets scanning, DAST, SCA, and utilized ZAP for DAST in CI/CD pipelines.
• Engaged in security awareness trainings, developed CTF challenges and training materials to enhance developer security knowledge.
• Planned and executed bi-annual red teaming operations based on the MITRE ATT&CK framework and led internal and external pentests based on the OWASP Top 10 framework for 70+ applications worldwide, resulting in detection, reporting, and remediation of hundreds of vulnerabilities.
• Triaged HackerOne reports.

• Conceived, built and iterated an applied-AI MVP that turns in-depth audio interviews into structured, long-form narrative outputs across multiple genres (e.g. memoir, institutional knowledge, thematic essays) using agentic orchestration and multi-step reasoning.
• Designed and implemented core workflows in a Next.js-based stack, working with structured representations (JSON and other formats), retrieval-augmented generation and emerging knowledge graph structures to maintain context and consistency over long documents.
• Defined and tested agent behaviors across realistic storytelling scenarios, including ideal user journeys, edge cases and failure modes, with explicit criteria for coherence, factual alignment and user intent satisfaction.
• Currently running targeted user tests with selected partners to validate use cases and inform the next product iterations.

• Designed a compact framework to generate prompt–response sets for CRM lifecycle scenarios (onboarding, activation, retention, reactivation).
• Included adversarial variants (ambiguous requests, conflicting instructions, policy traps).
• Created a scoring rubric for factuality, tone, and coherence.
• Developed a lightweight guideline for annotator alignment and disagreement resolution.

• Developed Red Team infrastructure for real-world attack simulations using Sliver C2 and custom tools
• Executed advanced Red Team operations, integrating AI/LLM security research for prompt injection attacks
• Conducted comprehensive breach assessment attacks and vulnerability assessments across enterprise infrastructure
• Performed root cause analysis and purple team exercises, generating executive-level reports
• Lead LLM red teaming initiatives to improve AI model security for GPT-4, Mistral, and internal GenAI models

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures

• Led telecom security testing team & SOC deployments across Tier-1 carriers; reduced critical vulnerabilities by 30%.
• Conducted 5G/O-RAN fuzzing, penetration testing, and vulnerability research (basebands, RAN, core).
• Designed testbeds for protocol fuzzing (AFL++, LibAFL) on 5G stacks.
• delivered client workshops on secure telecom with AI assisted workflows.
• Researched AI-driven SOC and penetration testing (LLMs for log triage, anomaly detection, adversarial monitoring).