SAST Experts in Germany

• Designed and developed the architecture of an enterprise SCM/CI platform for Kubernetes-native delivery and GitOps workflows.
• Implemented infrastructure automation and Vault & IAM integration for secure, compliant pipelines.
• Coordinated cross-functional teams to improve DevOps, security, and architecture in release processes.
• Increased platform adoption and developer experience by automating onboarding and artifact pipelines.

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

• Overall responsibility for the project lifecycle from scope definition to completion
• Close collaboration with platform teams, IT leaders, and external service providers
• Application of SAFe principles and structured sprint work
• Creation of a migration roadmap with clear milestones
• Monitoring of the lifecycle: onboarding, repository migration, replication of permissions, and system tests
• Visualization of the architecture with PlantUML and Gliffy as well as documentation in Confluence
• Regular status reports and running knowledge transfer sessions

• PRISMA project
• Ansible automation
• Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

• Perform secure code reviews and provide secure-coding guidance across the application and platform architecture.
• Engineer infrastructure security and design security-monitoring architecture, incident-response playbooks and Security-by-Design controls.

• Led client projects end-to-end — from scoping and cloud strategy to sprint planning and stakeholder alignment
• Planned and implemented secure Azure Landing Zones using Infrastructure as Code
• Developed governance frameworks and cloud security controls tailored to enterprise environments
• Executed cloud readiness assessments and managed cloud migration initiatives from evaluation to handover
• Facilitated client workshops and agile ceremonies (sprint planning, backlog refinement, standups)
• Built internal Cloud Competence Centers to foster knowledge sharing and best practices across teams
• Development of a general Cloud Service Portal

Project: Digitalization of Warehouse Processes | Building a Data Analytics Platform.

• Built a web-based workforce allocation system that digitized daily shift planning by matching worker expertise to operational zones, replacing manual coordination with a structured workflow adopted across the site, saving supervisors time on daily planning.
• Developed a real-time operational visibility dashboard giving supervisors a live view of task throughput and outstanding workload across warehouse zones throughout the day, helping reduce overtime and idle labour costs.
• Developed a slotting optimization solution to improve warehouse picking efficiency and reduce picking time per order, working directly with operations teams from concept through production deployment.

Technologies used: Python, Django, PostgreSQL, Pandas, NumPy, HTML, Java, JavaScript, Docker, Kubernetes, AWS, Power BI, GitHub Actions CI/CD, GitOps, Claude, OpenAI

• Devised a new Domain-Driven Design architecture for a core system: reverse-engineered a central component, refactored the data-access layer to minimise database round-trips (improving scalability) and migrated processing to async.
• Decomposed the platform into independent .NET Core microservices (database-per-service) with RabbitMQ pub/sub using the Outbox Pattern + Saga choreography, behind an Ocelot API Gateway (JWT, rate limiting, CORS, health checks).
• Delivered on .NET Core / Angular / SQL Server / EF Core with Docker and Azure DevOps CI/CD; implemented health checks and CORS; contributes technical designs for stories in agile Scrum.
• Sole ADR owner; mentored 3 engineers and presented architecture decisions directly to the Director of Corporate IT.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Integration of Post-Quantum Cryptography (PQC) algorithms into high level protocols.
• Security of implementations of Post-Quantum Cryptography algorithms.
• Transition to Post-Quantum public key infrastructures.
• Security evaluations of Post-Quantum Cryptography (PQC) primitives.
• Drone Cybersecurity
• Satellite Cybersecurity
• AI Security

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Successful implementation of vulnerability management with DefectDojo
• Consulting and implementation of technical and process-related aspects of vulnerability management with DefectDojo
• Consulting on the implementation of a secure software development lifecycle
• Skills: Gitlab, DefectDojo, Vulnerability Management, SCA, SAST, DAST, Python, Kubernetes, ArgoCD, Docker, AWS, Azure, Whitesource/Mend, Greenbone

• Developed and implemented organization-wide discovery framework based on Ulwick’s Outcome-Driven Innovation; enabled 7 Product Owners to systematically identify and quantify unrealized value through shared outcome language and opportunity scoring methodology
• Transformed Product Owner role from backlog clerks to strategic experimenters; established dedicated time budget for autonomous hypothesis testing and discovery activities
• Rebuilt customer journey maps to start at actual user need (tool selection phase) instead of platform entry point; eliminated manual data aggregation work previously done by project teams
• Implemented OKR framework across 4 product teams; defined quarterly objectives with measurable key results (e.g., 40% reduction in manual integration effort, self-service adoption increase)
• Unified 3 separate platform roadmaps through cross-team dependency mapping and shared service agreements
• Supported enterprise sales cycle with ROI modeling and technical due diligence for automotive and defense customers

• Analysis and further development of the security architecture.
• Design and development of Splunk apps and technical add-ons (TAs).
• Development and implementation of security use cases in the Splunk SIEM.
• Creation and maintenance of incident response playbooks in Cortex XSOAR.
• Support of technical proof-of-concepts to assess new detection technologies.
• Lifecycle management and operational support for Splunk and Cribl systems.
• Deployment and scaling of Splunk indexers in hybrid data center environments.
• Maintenance, update planning, and optimization of Cribl Stream & Edge for log ingestion and data routing.
• Creation of dashboards and reports to visualize security posture and system availability.
• Technical analysis to assess network topologies and data flows.
• Integration of new data sources via Cribl Stream/Edge and heavy forwarders in cloud and on-prem environments.
• Integration of external security components such as Cortex XSOAR (SOAR) and user behavior analytics (UBA).
• Implementation of complex correlation rules in Splunk Enterprise Security (ES).
• Connection of external ticketing systems via mail gateways and REST APIs.
• Automated deployment of use cases, dashboards, and detection rules via Git and Ansible.