Single Sign-On Expert

Maturing their API practices on both a business and technology level. My role covers strategy, architecture, developer advocacy as well as hands-on software engineering, enabling both technical teams and business leadership to adopt and act on API-centric principles effectively. Coincidentally, we also establish GitOps, DX and platform best practices with this project.

Highlights:

• Aligning executives with the initiative by clarifying strategy, replacing misconceptions and myths with facts, clarifying the value of existing assets and enabling informed decision-making
• Formulating a way forward for API Lifecycle Management at OTTO
• Driving platform progress and fostering developer engagement by hands-on engineering work towards strategic goals

API Lifecycle Management, Team Topologies, Organizational Evolution, Regulatory, Platform Advocate, Developer Platform, Communities of Practice, Terraform, Kotlin, Kafka, Kong, WSO2, Apigee, Gravitee, Backstage, AsyncAPI, OpenAPI, API Design, AWS, React, Node.js, TypeScript, Redocly, reactive programming, CDC, Golang, Gin, GitOps, DX (developer experience), stakeholder management, roadmaps, workshops, discovery.

• Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
• Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
• Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
• Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
• Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
• Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.

Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin

• Planned and developed a CPU monitoring application for monitoring system performance and resource utilization.
• Designed and implemented a Spring Boot backend providing a REST API for processing and exposing monitoring data.
• Developed the React frontend for presenting monitoring information in a clear and user-friendly interface.
• Integrated PostgreSQL for persistent storage and management of application data.
• Containerized the application and its services using Docker Compose.
• Automated infrastructure provisioning and deployment using Terraform on AWS.
• Structured the application as a modern, maintainable system using REST-based communication between frontend and backend.
• Designed and developed a secure, scalable CPU monitoring architecture (cpu-watcher) with a dedicated collector application that streams monitoring data to the backend, reducing direct exposure of system resources.
• Designed a secure cloud infrastructure with the database isolated within a private network and OIDC-based authentication.
• Implemented Infrastructure as Code with Terraform and integrated version-controlled CI/CD pipelines to automate testing, infrastructure changes, and application deployments.
• Designed and implemented the frontend delivery architecture using AWS CloudFront.

Stack: Spring Boot · React · PostgreSQL · REST API · Docker Compose · Terraform · AWS

• Fully on-premises LLM document-examination platform for a compliance-critical banking domain: agentic LangGraph pipeline with deterministic verification, every AI judgment structured and source-anchored; ~960 automated tests, zero data egress
• GPU throughput engineering (quantized serving, speculative decoding, prefix caching): 9.5x extraction speed-up, 500+ multi-document case files per day on a single A100
• AI-native EDI/EDIFACT integration platform (~116k LOC Java 25 / Spring Boot 4, 1,900+ tests): LLM-drafted partner mappings machine-verified before go-live (DFDL conformance, field-coverage checks, dry runs), ~99.5% byte match on real customer files — replacing weeks of manual mapping per partner

To achieve savings and optimize compliance, apps were restructured in line with the mappings in identity management, restrictions were defined and, above all, costs resulting from overuse were reduced. Communication with stakeholders, validation of authorizations with users and technical implementation in the SAP FI/CO and Sourcing & Procurement modules created significant added value for the group. This also included the corresponding documentation for the auditors.

With project PRIZMA, DB will modernize its infrastructure on the one hand, and develop a fail-safe IT landscape on the other hand, which can be restored quickly and securely in case of a disaster.

• Capture current architectures of existing systems as well as methodical consulting and development of target architectures
• Deepen and maintain the building plan / target IT landscape
• Implement technical architecture concepts & architecture descriptions
• Implement migration concepts for updating and further developing the platform and information systems
• Assess submitted improvement suggestions as part of the project
• Capability management: identify capability gaps, develop target visions, and support transformation planning within the enterprise architecture.
• Create a compatibility matrix of the components in use and compare dependencies of specific versions
• Create an IT concept for extending the platform with the following topics: hardware and software requirements, security, licensing, high availability, load balancing, backup & recovery, update strategy, monitoring integration, etc.
• Coordinate with business architects as well as technical architects from the cross-functional architecture area of the PRISMA program for the topics (backup, Active Directory, monitoring, Citrix, and business applications ...)
• Status meetings and alignment of project planning with the Release Train Engineer / Project Manager
• Advise the Release Train Engineer / Project Manager in identifying project risks
• Advise the System Architect Engineers in steering the implementation of the concept
• Implement the IT concept
• Document the infrastructure

Label: MS Project, LINUX, Windows, ORACLE, Java, REST, SharePoint, Microsoft Exchange, UML, Enterprise Architect, BPMN, AZURE, AWS, V-MODEL, Micro Service, VisualStudio, SAP S/4HANA, SCRUM(SAFE), ESB (TIBCO), Python, Innovator, LeanIX (TOGAF), Ansible, Ansible Tower, Ansible Automation, ROBOT, SpringBoot

IT consulting, analysis, architecture design, new and further development, code review, test automation, continuous integration, continuous delivery in backend and frontend areas for Automotive Project Instavalo.

Frontend:

• Implementation of UI components according to specifications, especially style guides and responsive design eith React and Typescript
• Component testing
• Code documentation
• CI/CD with Gitlab Pipeline

Backend / IoT:

• Analysis and architectural design with AWS Greengrass IoT on Edge Devices
• Setting up Microservices containers with Docker Compose on Edge device with AWS Greengrass and AWS IoT IAM, Token Exchange Service, Ansible
• CI/CD with Gitlab Pipeline, Terraform, AWS ECR
• Logging with Fluentbit Lua Language for AWS Cloudwatch
• Python Lambda for AWS Greengrass Recipe deployment on Edge Devices
• Implementation of test-driven development with JUnit, Mockito, and code Coverage
• Jacoco
• Definition of REST interfaces with OpenAPI / Swagger
• Development and enhancement of software based on Java Quarkus, Typescript NestJs NodeJs and Python
• Authentication and authorization in Aws IAM
• Development of REST and gRPC interfaces for the frontend and backend
• Implementation of Maven dependencies with DevSecOps OWASP
• Spring AI, Jetbrains AI Assistant, Junie, Github Copilot, Claude Code, Agents, Skills, Command, Hooks, Subagents

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

• Led migration to GCP using Terraform, GKE, and GitOps, improving deployment consistency and scalability
• Implemented Datadog observability stack via Terraform and datadog-operator
• Established automated end-to-end tests and on-call processes, improving incident response and service reliability
• Migrated from NGINX Ingress Controller to Kubernetes Gateway API (NGINX Gateway Fabric)
• Migrated stateful services (PostgreSQL and Redis) to GCP, improving scalability and operational reliability

• Conceptual design and implementation of modular AI assistants for sales and business processes in the Microsoft ecosystem (Agentic AI, Copilot extensions)
• Frontend architecture and development with React + TypeScript for embedded chat and assistant surfaces (streaming UI, hooks, React Query, OpenAPI clients)
• Enterprise-level agent development: reusable skill/agent library, MCP server, review and compliance gates
• LLM integration into the user experience: Anthropic (Claude), OpenAI, tool use, RAG pipelines, prompt engineering, guardrails
• Architecture and code review consulting as well as mentoring in the AI development team
• Integration with Microsoft Graph, Power Platform, and Azure services
• Technologies: React, TypeScript, Anthropic Claude, OpenAI, MCP, RAG, Microsoft Graph, Power Platform, Azure

• Creation, maintenance and hardening of Kubernetes clusters employing Ansible and ArgoCD
• Keywords: Ansible, AWX, Kubernetes, NetApp, Prometheus, CI/CD ArgoCD, SSO, Fluent-bit, HAProxy, Calico, Keycloak, oauth2-proxy, SealedSecrets, kubeseal, Aqua kube-bench, CIS-Benchmarks, Aqua Trivy operator

Evaluation and selection of a new endpoint management platform for an environment with around 50,000 clients. Support for a manufacturing company in evaluating a future endpoint management platform as a possible replacement for the existing client management solution. Conducting a structured software selection process including proof of concept as well as preparing the decision basis for the Enterprise Architecture Board (EAM). Defining the technical requirements and evaluation criteria and creating a short list of possible solutions (Tanium, Baramundi, Microsoft Intune / MECM). Planning and supporting the technical proof of concept as well as evaluating the architecture and operations aspects of the different platforms. In addition, evaluating tools for migrating existing software packages from the Ivanti DSM environment. Comparing and testing IDERI Move and PACE for the automated transfer of the existing package structure to the new platform, with the goal of significantly reducing migration effort. Support in selecting the required Tanium modules as well as preparing the decision documents for the Enterprise Architecture Board.

Tools: Tanium, Baramundi, Microsoft Intune, Microsoft MECM, Ivanti DSM, IDERI Move, Pace, Windows 10, Windows 11, Windows Server. VDI

• Delivered MVP-focused full-stack architecture for a health-sector client: Vite/React frontend, backend services on Google Cloud Run, and Supabase for database plus IAM/authentication.
• Supported product requirements engineering and prioritized cost-aware workload placement, implementing browser-side/edge computation where feasible before moving logic to backend services.

• Development and maintenance of a news portal CMS with interfaces.
• PHP development with HTML, CSS, SCSS, JavaScript, MySQL, Laravel, documentation of the interfaces and the system.
• Further development of the SSO system based on Laravel with a large API and connections to AWS, SAP, ERPS.
• Reorganisation and development of the news portals on the basis of a publish platform, services and interfaces to Google, Facebook, Twitter, SSO, SAP technical based on NodeJS with TypeScript and AWS.
• Technologies: PHP, Laravel, MySQL, JavaScript, Vue.js, NodeJS, TypeScript, jQuery, CSS, SCSS, SASS, Unix, Jira, Confluence, Git, Apache, Nginx, AWS.