Secure Coding Experts in Germany

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Co-founded Prinkipia and led the growth of the team
• Defined and developed the company’s strategic direction
• Provided leadership to engineering teams across projects as chief software architect
• Drove technical vision and decision-making to ensure high-quality engineering outcomes
• Built the company culture and laid the foundation for engineering principles and best practices
• Led engineering leadership and software architecture of Prinkipia's flagship Agentic AI product

• Migration of the software development process of a medical technology software to C/C++ package manager Conan and development of macOS-specific system components

• Analysis of the regulatory requirements from the DORA regulation

• Structured derivation of the necessary measures for development & operations

• Setup of an organization-wide Secure Software Development Lifecycle (SSDLC)

• Creation of policies, documentation, and governance processes

• Alignment with business, IT, compliance, and governance stakeholders

• Support in tool selection (including static code analysis, vulnerability management)

• Setup of a standardized, traceable process for secure software development in line with DORA requirements. The focus was on requirements analysis, policy creation, stakeholder alignment, and structured process design for two independent financial institutions.

• Methods & tools: regulations (DORA), requirements management, process design, Confluence, Jira, SharePoint, MS Office

• Integrated LangChain middleware between AEM and SAP PIM system
• Developed a FastAPI interface for system communication
• Implemented vector embeddings for semantic product search
• Evaluated LLM models (Vertex AI/Gemini, LM Studio, Hugging Face, OpenAI) for product analysis
• Developed an AEM component to display product recommendations and integrated the recommendation API into the AEM authoring process
• Designed and implemented Pinecone vector database for product embeddings
• Optimized response times and caching strategies
• Evaluated Vertex AI Studio for LLM testing and prompt workflows
• Implemented secure API routing and access control for AI components via FastAPI and gateway validation

• Performed security assessments and penetration testing on Microsoft AI models for text, image, and video generation.
• Conducted prompt injection attacks through diverse input vectors, including crafted text, steganographic images, and manipulated visual elements (e.g., varying opacity and embedded content).

• Defined and executed a comprehensive security roadmap: integrated Shift-Left Security, CNAPP, and DevSecOps principles to streamline secure product development and reduce risk exposure.
• Established a robust threat modeling framework: embedded security into design processes, enabling early identification of vulnerabilities and reducing potential risks.
• Developed a scalable Vulnerability Management program: accelerated detection and remediation of new vulnerabilities, significantly shortening the risk response cycle.
• Enhanced cloud and container security: leveraged advanced tools such as Tetragon to achieve deeper visibility and implement a defense-in-depth strategy.
• Automated security controls within CI/CD pipelines: integrated security measures into the development lifecycle to maintain continuous delivery with robust safeguards.
• Championed cross-functional collaboration: partnered with developers and infrastructure teams to prioritize threats and align remediation efforts, fostering a unified security culture.
• Ensured regulatory compliance and audit readiness: collaborated closely with the InfoSec team to adhere to internal policies and successfully support audits for standards like PCI-DSS and SOC2.

Supervised the course Software Engineering for Bachelor students and delivered lectures.

• PRISMA project
• Ansible automation
• Windows third level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

• Developed Red Team infrastructure for real-world attack simulations using Sliver C2 and custom tools
• Executed advanced Red Team operations, integrating AI/LLM security research for prompt injection attacks
• Conducted comprehensive breach assessment attacks and vulnerability assessments across enterprise infrastructure
• Performed root cause analysis and purple team exercises, generating executive-level reports
• Lead LLM red teaming initiatives to improve AI model security for GPT-4, Mistral, and internal GenAI models

• Risk Management
• Incident Management
• Security Analysis
• Secure Coding
• Information Security Management System (ISMS)

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures

• Independently develop policies, guidelines, and frameworks for ICT risk management and information security
• Advise business units on ICT risk management and information security
• Further develop the ICT risk management framework that governs the identification, assessment, and control of ICT risks
• Evaluate the Information Security Management System (ISMS) and adjust it for new challenges
• Conduct risk analyses to identify and assess potential ICT risks and information security risks for the Metzler Group
• Advise on defining and implementing measures to reduce risks and improve the resilience of ICT systems
• Advise on ensuring compliance with relevant internal and external regulatory requirements (MaRisk, DORA, BAIT, BSI IT baseline protection, ISMS, ISO 27001, ISO 42001, ISO 27005, BCM ISO 22301)
• Advise on internal and cross-functional projects (SAP DORA compliance, Target2, Section 8a BSI Act)

• Successfully implemented vulnerability management with DefectDojo
• Advised on and implemented technical and procedural aspects of vulnerability management with DefectDojo
• Provided guidance on implementing a secure software development lifecycle
• Skills: GitLab, DefectDojo, Vulnerability Management, SCA, SAST, DAST, Python, Kubernetes, Argo CD, Docker, AWS, Azure, WhiteSource/Mend, Greenbone