Shibboleth Experts in Germany

Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

Tasks and activities:

Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

Achievements:

Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

Significantly increased workload compliance for lift-and-shift migrations.

Technologies used:

Microsoft Azure Policy, custom policies.

Terraform, OpenTofu, Terragrunt.

step-ca (ACME).

Entra ID.

Azure Firewall.

Azure networking, hub-and-spoke architecture.

Azure vWAN (evaluation).

Azure Front Door, Azure Application Gateway.

Azure ExpressRoute.

Azure Key Vault.

NetBox.

GitLab (on-premises).

Infrastructure, concepts used:

Cloud shared responsibility model.

Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

Central governance with decentralized delivery (business unit autonomy with guardrails).

Methods used:

Scrum.

Stakeholder management (C-level to engineering).

Cloud governance, Azure Cloud Adoption Framework (CAF).

DevOps, CI/CD.

Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

RBAC, "break glass" concepts.

ACME / certificate automation.

GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.