Single Sign-On Experts

• Planned and developed a CPU monitoring application for monitoring system performance and resource utilization.
• Designed and implemented a Spring Boot backend providing a REST API for processing and exposing monitoring data.
• Developed the React frontend for presenting monitoring information in a clear and user-friendly interface.
• Integrated PostgreSQL for persistent storage and management of application data.
• Containerized the application and its services using Docker Compose.
• Automated infrastructure provisioning and deployment using Terraform on AWS.
• Structured the application as a modern, maintainable system using REST-based communication between frontend and backend.
• Designed and developed a secure, scalable CPU monitoring architecture (cpu-watcher) with a dedicated collector application that streams monitoring data to the backend, reducing direct exposure of system resources.
• Designed a secure cloud infrastructure with the database isolated within a private network and OIDC-based authentication.
• Implemented Infrastructure as Code with Terraform and integrated version-controlled CI/CD pipelines to automate testing, infrastructure changes, and application deployments.
• Designed and implemented the frontend delivery architecture using AWS CloudFront.

Stack: Spring Boot · React · PostgreSQL · REST API · Docker Compose · Terraform · AWS

With project PRIZMA, DB will modernize its infrastructure on the one hand, and develop a fail-safe IT landscape on the other hand, which can be restored quickly and securely in case of a disaster.

• Capture current architectures of existing systems as well as methodical consulting and development of target architectures
• Deepen and maintain the building plan / target IT landscape
• Implement technical architecture concepts & architecture descriptions
• Implement migration concepts for updating and further developing the platform and information systems
• Assess submitted improvement suggestions as part of the project
• Capability management: identify capability gaps, develop target visions, and support transformation planning within the enterprise architecture.
• Create a compatibility matrix of the components in use and compare dependencies of specific versions
• Create an IT concept for extending the platform with the following topics: hardware and software requirements, security, licensing, high availability, load balancing, backup & recovery, update strategy, monitoring integration, etc.
• Coordinate with business architects as well as technical architects from the cross-functional architecture area of the PRISMA program for the topics (backup, Active Directory, monitoring, Citrix, and business applications ...)
• Status meetings and alignment of project planning with the Release Train Engineer / Project Manager
• Advise the Release Train Engineer / Project Manager in identifying project risks
• Advise the System Architect Engineers in steering the implementation of the concept
• Implement the IT concept
• Document the infrastructure

Label: MS Project, LINUX, Windows, ORACLE, Java, REST, SharePoint, Microsoft Exchange, UML, Enterprise Architect, BPMN, AZURE, AWS, V-MODEL, Micro Service, VisualStudio, SAP S/4HANA, SCRUM(SAFE), ESB (TIBCO), Python, Innovator, LeanIX (TOGAF), Ansible, Ansible Tower, Ansible Automation, ROBOT, SpringBoot

• Architected the Yatta Integration Layer – a config-driven integration platform on Java 25, Spring Boot 4 (WebFlux), Temporal, gRPC and Kafka, enabling new third-party integrations (e.g. AVS fulfillment) via declarative JSON configs with zero code changes.
• Designed and implemented Tink integration with 0Auth IBAN verification to enhance fraud prevention and account validation workflows with Adyen payByBank.
• Architected and implemented an OpenFGA-based authorization model for centralized management of users, groups, and fine-grained access control in the vendor portal.
• Architected and led delivery of the Yatta API Gateway platform using GraphQL Federation, providing a unified enterprise API layer across distributed microservices with centralized authentication, authorization and request orchestration.
• Replaced NGINX + NLB with Istio service mesh and AWS ALB; rolled out WAF, OAuth (Cognito), IP whitelisting and RBAC across environments.
• Migrated CDC from Confluent Cloud connectors to a self-hosted Kafka Connect + Debezium stack, reducing operational cost by ~80% across multiple environments.
• Implemented the Transactional Outbox pattern with Debezium for reliable, exactly-once event publishing to Kafka with Avro and Schema Registry.
• Migrated dunning/payment-recovery workflows from Airflow to Temporal, achieving 99.9% reliability for settlement handling.
• Optimised Apache Airflow with deferrable sensors to handle 1000+ concurrent DAG runs without scaling the worker pool.
• Refactored a monolithic Terraform codebase into 3 modular projects, cutting deployment time by ~45%.
• Stood up full observability with OpenTelemetry, Tempo, Prometheus and Loki; automated dev/staging/prod with ArgoCD, Image Updater and Helm.
• Collaborated with product, operations and engineering stakeholders to define scalable platform architecture and integration standards aligned with long-term business and operational goals.

IT consulting, analysis, architecture design, new and further development, code review, test automation, continuous integration, continuous delivery in backend and frontend areas for Automotive Project Instavalo.

Frontend:

• Implementation of UI components according to specifications, especially style guides and responsive design eith React and Typescript
• Component testing
• Code documentation
• CI/CD with Gitlab Pipeline

Backend / IoT:

• Analysis and architectural design with AWS Greengrass IoT on Edge Devices
• Setting up Microservices containers with Docker Compose on Edge device with AWS Greengrass and AWS IoT IAM, Token Exchange Service, Ansible
• CI/CD with Gitlab Pipeline, Terraform, AWS ECR
• Logging with Fluentbit Lua Language for AWS Cloudwatch
• Python Lambda for AWS Greengrass Recipe deployment on Edge Devices
• Implementation of test-driven development with JUnit, Mockito, and code Coverage
• Jacoco
• Definition of REST interfaces with OpenAPI / Swagger
• Development and enhancement of software based on Java Quarkus, Typescript NestJs NodeJs and Python
• Authentication and authorization in Aws IAM
• Development of REST and gRPC interfaces for the frontend and backend
• Implementation of Maven dependencies with DevSecOps OWASP
• Spring AI, Jetbrains AI Assistant, Junie, Github Copilot, Claude Code, Agents, Skills, Command, Hooks, Subagents

• Short description: Lead a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations control while preserving the autonomy of decentralized business units within regulatory boundaries.

• Tasks and activities:

• Overall responsibility for the design, setup, and implementation of an enterprise-wide cloud governance structure (Azure), incl. target picture, roadmap, and operating model.

• Management of internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps) incl. decision-making and escalation management.

• Planning and facilitation of workshops on cloud strategy, governance principles, and the design of areas such as Identity, Connectivity, and Platform Management.

• Definition, implementation, and rollout of cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).

• Building a cloud governance framework aligned with the Azure Cloud Adoption Framework (CAF), incl. landing zone and guardrail concepts.

• Introduction of automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).

• Implementation of cloud security and compliance monitoring mechanisms as well as continuous improvement processes.

• Establishment and operationalization of FinOps in an enterprise environment (central and decentralized FinOps teams), incl. cost management strategies, reporting, and guardrails.

• Integration of governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).

• Implementation of access concepts incl. RBAC design and "break glass" mechanisms (emergency access) as well as certificate automation (ACME / step-ca).

• Achievements:

• Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud usage in a regulated environment.

• Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.

• Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).

• Significantly increased workload compliance for lift-and-shift migrations.

• Technologies used:

• Microsoft Azure Policy, custom policies.

• Terraform, OpenTofu, Terragrunt.

• step-ca (ACME).

• Entra ID.

• Azure Firewall.

• Azure networking, hub-and-spoke architecture.

• Azure vWAN (evaluation).

• Azure Front Door, Azure Application Gateway.

• Azure ExpressRoute.

• Azure Key Vault.

• NetBox.

• GitLab (on-premises).

• Infrastructure, concepts used:

• Cloud shared responsibility model.

• Hub-and-spoke connectivity / central shared services (from a hub-spoke context).

• Central governance with decentralized delivery (business unit autonomy with guardrails).

• Methods used:

• Scrum.

• Stakeholder management (C-level to engineering).

• Cloud governance, Azure Cloud Adoption Framework (CAF).

• DevOps, CI/CD.

• Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.

• RBAC, "break glass" concepts.

• ACME / certificate automation.

• GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

• Led migration to GCP using Terraform, GKE, and GitOps, improving deployment consistency and scalability
• Implemented Datadog observability stack via Terraform and datadog-operator
• Established automated end-to-end tests and on-call processes, improving incident response and service reliability
• Migrated from NGINX Ingress Controller to Kubernetes Gateway API (NGINX Gateway Fabric)
• Migrated stateful services (PostgreSQL and Redis) to GCP, improving scalability and operational reliability

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Conceptual design and implementation of modular AI assistants for sales and business processes in the Microsoft ecosystem (Agentic AI, Copilot extensions)
• Frontend architecture and development with React + TypeScript for embedded chat and assistant surfaces (streaming UI, hooks, React Query, OpenAPI clients)
• Enterprise-level agent development: reusable skill/agent library, MCP server, review and compliance gates
• LLM integration into the user experience: Anthropic (Claude), OpenAI, tool use, RAG pipelines, prompt engineering, guardrails
• Architecture and code review consulting as well as mentoring in the AI development team
• Integration with Microsoft Graph, Power Platform, and Azure services
• Technologies: React, TypeScript, Anthropic Claude, OpenAI, MCP, RAG, Microsoft Graph, Power Platform, Azure

• Creation, maintenance and hardening of Kubernetes clusters employing Ansible and ArgoCD
• Keywords: Ansible, AWX, Kubernetes, NetApp, Prometheus, CI/CD ArgoCD, SSO, Fluent-bit, HAProxy, Calico, Keycloak, oauth2-proxy, SealedSecrets, kubeseal, Aqua kube-bench, CIS-Benchmarks, Aqua Trivy operator

Evaluation and selection of a new endpoint management platform for an environment with around 50,000 clients. Support for a manufacturing company in evaluating a future endpoint management platform as a possible replacement for the existing client management solution. Conducting a structured software selection process including proof of concept as well as preparing the decision basis for the Enterprise Architecture Board (EAM). Defining the technical requirements and evaluation criteria and creating a short list of possible solutions (Tanium, Baramundi, Microsoft Intune / MECM). Planning and supporting the technical proof of concept as well as evaluating the architecture and operations aspects of the different platforms. In addition, evaluating tools for migrating existing software packages from the Ivanti DSM environment. Comparing and testing IDERI Move and PACE for the automated transfer of the existing package structure to the new platform, with the goal of significantly reducing migration effort. Support in selecting the required Tanium modules as well as preparing the decision documents for the Enterprise Architecture Board.

Tools: Tanium, Baramundi, Microsoft Intune, Microsoft MECM, Ivanti DSM, IDERI Move, Pace, Windows 10, Windows 11, Windows Server. VDI

• Delivered MVP-focused full-stack architecture for a health-sector client: Vite/React frontend, backend services on Google Cloud Run, and Supabase for database plus IAM/authentication.
• Supported product requirements engineering and prioritized cost-aware workload placement, implementing browser-side/edge computation where feasible before moving logic to backend services.

• Development and maintenance of a news portal CMS with interfaces.
• PHP development with HTML, CSS, SCSS, JavaScript, MySQL, Laravel, documentation of the interfaces and the system.
• Further development of the SSO system based on Laravel with a large API and connections to AWS, SAP, ERPS.
• Reorganisation and development of the news portals on the basis of a publish platform, services and interfaces to Google, Facebook, Twitter, SSO, SAP technical based on NodeJS with TypeScript and AWS.
• Technologies: PHP, Laravel, MySQL, JavaScript, Vue.js, NodeJS, TypeScript, jQuery, CSS, SCSS, SASS, Unix, Jira, Confluence, Git, Apache, Nginx, AWS.

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

I designed and developed an AI-powered multi-tenant platform on Azure that transforms SAP process recordings into technical documentation, presentations and automated tests, processing over 15,000 process recordings for enterprise customers like Würth. I owned the architecture, the production releases and the DevOps setup. I also designed a multi-tenant system with SSO and role-based access on Azure. Implemented an MCP Server with Dynamic OAuth Authentication.

Main Tasks:

• Sprint planning and feature preparation
• Design the multi-tenant platform architecture (FastAPI, SQLAlchemy, PostgreSQL row-level security for tenant isolation)
• Develop AI pipelines with Prefect for transcription (Azure Speech API), document generation and SAP screen-recording analysis (Claude, gpt-4-mini)
• Design and implement an MCP server to expose tenant knowledge to LLM clients (Claude), with async retrieval and reranking
• Implement LLM cost tracking, rate limiting and client pooling for Anthropic/OpenAI/Azure OpenAI endpoints
• Set up CI/CD: Docker images to Azure Container Registry, GitHub Actions, Azure Static Web Apps, Alembic migrations in containers
• Manage production releases and execute live data migrations for enterprise customers
• Define engineering standards and architecture patterns for the team

Environment: Azure / Azure Foundry / Python / FastAPI / Prefect / React / PostgreSQL