Security Operations Center Experts in Berlin

• Codebase Evaluation & Problem Design: Designed and stress-tested complex software engineering problems against large open-source Python codebases (including pandas), requiring deep context acquisition and architectural understanding to produce well-scoped, realistic problem statements aligned to strict correctness guidelines.
• Agent Failure Analysis: Assessed LLM coding agent solutions for correctness and completeness, identifying meaningful failures across edge case handling, dtype behaviour, and multi-column NaN propagation logic; documented findings with precision for downstream evaluation use.
• Programmatic Test Suite Development: Authored comprehensive pytest suites to programmatically verify agent-generated solutions against defined requirements, with deliberate coverage of boundary conditions and failure modes not caught by naive implementations.
• Containerised Environment Engineering: Built and debugged Docker environments for reproducible agent execution, including git-based repository provisioning, dependency pinning with npm ci, and multi-stage Dockerfile authoring across Linux-based containers.

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action

At gematik's Cyber Defense Center (CDC/CERT) (critical infrastructure): Security Monitoring, Incident Response, and Service Monitoring for the telematics infrastructure (TI)

• Vulnerability management with Nexpose for gematik and the telematics infrastructure
• Vulnerability Assessment: Assessing and tracking vulnerabilities through Jira
• Security Monitoring and triage of security events with Splunk
• First Responder and Incident Handling: Initial assessment, triage, and escalation
• Service Monitoring: Monitoring critical TI services
• Documenting runbooks, playbooks, and knowledge base articles in Confluence

• Established the Cyber Defense Unit following a major cybersecurity incident
• Recruited a team of Cybersecurity Architects, Engineers and Senior Security Analysts
• Managed the team’s resources and activities in defining and implementing a target cybersecurity architecture, monitoring the IT landscape, detecting and responding to security events and incidents, and consulting other IT stakeholders in their efforts to improve the organization’s cybersecurity posture (comparable to Technical CISO role)
• Led the separation of Information Security (governance, risk, compliance) and Cyberdefense Unit (technical cybersecurity), in close collaboration with the CISO
• Led the selection and onboarding of external Security Operations Center (MSSP)

• Analysis of the existing SOC infrastructure and assessment of security operations

• Transition to a new operating model including security monitoring, incident response and threat intelligence

• Coordination between internal teams, external partners and service providers

• Implementation of Microsoft Intune: configuration, compliance policies and BYOD management

• Implementation of Microsoft Defender: endpoint and network protection, automated threat detection and incident response

• Training of IT security teams and end users

• Deployment of Microsoft Sentinel: integration into existing systems, automation of playbooks

• Introduction of Conditional Access: policies, MFA, creation of reports and dashboards

• Project management from initiation to completion, including change, risk and acceptance management

• Project controlling regarding schedules, costs and quality

• Requirements management: collection, classification and assessment of IT security requirements

• ISMS and security concept for the Fabasoft e-file according to BSI 200-1/2, among others
• Structural analysis (A.1), modeling (A.3), and baseline protection checks (A.4)
• Preparation for OWASP penetration test, incident response plan, risk analysis
• DevOps Bitbucket, ARC42, IAM with Keycloak/AD, multi-tenant setup, DMS, SOC
• Emergency preparedness concept (BSI 200-4), operations and service concept (BSK), ITSM

• Developed Red Team infrastructure for real-world attack simulations using Sliver C2 and custom tools
• Executed advanced Red Team operations, integrating AI/LLM security research for prompt injection attacks
• Conducted comprehensive breach assessment attacks and vulnerability assessments across enterprise infrastructure
• Performed root cause analysis and purple team exercises, generating executive-level reports
• Lead LLM red teaming initiatives to improve AI model security for GPT-4, Mistral, and internal GenAI models

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures

• Development of a cloud security strategy
• Implementation of cloud security governance to comply with ISO/IEC 27017 and the CSA CCM
• Creation of a management system to control cloud security with a focus on process design as well as roles and responsibilities
• Definition of security measures to safeguard cloud solutions
• Conducting requirements analyses and defining the scope for cloud security projects
• Achievements: Established an effective NIS2-compliant cloud security governance that meets industry-specific requirements and effectively minimizes cloud security risks

• FPGA code conversion from AHDL to Verilog and SystemVerilog (Altera Cyclone)
• IDE: Intel Quartus Prime (Altera)
• Code simulation: QuestaSim
• Timing analysis

• Led telecom security testing team & SOC deployments across Tier-1 carriers; reduced critical vulnerabilities by 30%.
• Conducted 5G/O-RAN fuzzing, penetration testing, and vulnerability research (basebands, RAN, core).
• Designed testbeds for protocol fuzzing (AFL++, LibAFL) on 5G stacks.
• delivered client workshops on secure telecom with AI assisted workflows.
• Researched AI-driven SOC and penetration testing (LLMs for log triage, anomaly detection, adversarial monitoring).

• Project management for cyber security and data protection projects in the financial, public and IT sector
• Business development activities and project acquisitions
• Topics: Data Privacy, Information Security Management Systems (ISMS), Privileged Access Management (PAM), Identity and Access Management (IAM), Security Operations Center (SOC)
• Enabled client to drive IAM strategy forward by decommissioning legacy application used for managing entitlements of enterprise users over more than 15 years
• Ensured security and privacy for personal data of more than 64 million residents by leading security workstream for development of vaccination quota monitoring web-application
• Supported expansion of CDN provider's market presence in Europe by comparing data privacy offering with customer requirements and competitors' offerings, and defining 10 now implemented measures
• Awarded distinctive achievement for leading a PAM project after only 6 months at Accenture and selling a follow-on project worth more than €3 million