SOC 2 Experts in Germany

• Led discovery phase and POC for Shopware to Shopify Plus migration across EMEA markets, evaluating platform suitability, technical architecture, and multi-brand/multi-country capabilities against business requirements.
• Designed reference architecture for Shopify Plus implementation incorporating headless front-end patterns (Vue.js, Nuxt.js), CMS integration (Magnolia), and Azure middleware (APIM, Functions, Logic Apps, Service Bus) for 11 EMEA markets.
• Defined migration strategy analyzing data mapping, cutover approach, and zero-downtime deployment patterns using Varnish caching, GitOps pipelines, and CI/CD orchestration across six vendor teams.
• Architected multi-tenant Shopify Plus governance model with centralized admin, localized storefront customization, and compliance controls (GDPR, data residency).
• Prototyped AI-driven search optimization (LLM.txt, JSON-LD) for product discoverability in Google AI results, demonstrating post-launch performance opportunities.
• Defined EMEA expansion roadmap for 15+ markets through C-level strategic workshops, identifying phased rollout, market-specific configurations, and resource requirements.
• Tech Stack: React, Nuxt.js, Vue.js, Magnolia CMS, Shopware, Shopify Plus, Azure (APIM, Functions, Logic Apps, Service Bus, Front Door), Varnish, SAP, MS Dynamics, Docker, Kubernetes, GitHub Actions, PostgreSQL, Kafka

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Designed and implemented end-to-end data pipelines (batch & streaming) using Python, SQL, and Apache Spark, Databricks on AWS reducing ETL latency by 40%.
• Developed serverless event-driven ingestion pipelines using AWS Lambda and SQS, ensuring real-time data availability for downstream analytics.
• Leveraged Google Cloud Platform (GCP) services including BigQuery and Dataflow to manage cross-cloud data warehousing and analytics integration.
• Expertise in DMS (CDC, Full Load) and Airflow for scalable data pipeline automation and orchestration.
• Managed and customized data pipelines using Databricks, Airflow. Automation using Docker, Kubernetes, Terraform.
• Automated data quality checks using dbt to modularize transformations and ensure production-grade data lineage, improving reliability by 30%.
• Collaborated with compliance teams to ensure GDPR and SOC2 alignment. Mentored junior engineers and contributed to architecture refactoring for scalability.
• Created and maintained dashboards in Power BI to provide actionable insights.

• ISO 27001 implementation & audit readiness
• NIS2 & DORA compliance support
• Interim / fractional CISO services
• IT risk & controls (ITGC, SOX, COBIT, BAIT)
• M&A and IT due diligence for startups/ventures
• Business continuity management (BCM, ISO 22301)
• Cybersecurity framework development (NIST, ISO, BSI)
• GRC tool advisory (Archer, ServiceNow)

• The customer is undergoing a comprehensive transformation. All SAP ECC landscapes worldwide are being migrated to SAP S/4HANA, with the goal of introducing a standard template worldwide.

• The program also includes the “RISE with SAP” migration and modernization program, which may involve migrating the landscapes of selected country installations to the SAP Private Cloud.

• On the stakeholder side, the program reporting line extends to the company’s executive board and that of the implementation partner.

• Fiserv Germany’s ERP landscape currently includes several non-standard SAP tools and applications that extend the functionality of the ECC environment and can often be integrated into downstream systems. As part of the transition to SAP S/4HANA, it is essential to assess the core functionality, integration points and future viability of these applications in order to determine their alignment with the target architecture.

• The focus of the work is on providing expert advice and assessment to define the scope, strategy and roadmap for transitioning Fiserv Germany’s SAP ECC system to SAP S/4HANA.

• The recommended best practices from SAP are followed and a structured approach is used to ensure a smooth transition with minimal disruption while maximizing business value.

• This assessment forms the basis for a successful SAP S/4HANA transformation and ensures alignment with industry best practices, regulatory compliance and future scalability.

• Migration Strategy Definition – assessment of available transition approaches based on business objectives, technical feasibility and SAP Best Practices.

• Technical Readiness Assessment – conducting a system analysis to assess compatibility, custom code impact, data volume management, integration points and infrastructure readiness for SAP S/4HANA.

• Business Process Impact Analysis – reviewing the latest business process documentation to define the scope and effort required to implement the necessary functions in SAP S/4HANA and to identify opportunities for process optimization.

• Roadmap for Non-SAP Systems and Applications – assessment of third-party and legacy applications regarding their integration with SAP S/4HANA and recommendation of consolidation, migration or replacement strategies.

• Deployment & Implementation Planning – defining a phased approach for implementation, including project schedules, risk mitigation strategies and key milestones aligned with business priorities.

• This transformation takes place in phases: the Discovery phase leads to the Explore phase, which is followed by the Design phase and finally implementation.

• Program management

• Change management

• Requirements management

• Transition management

• Stakeholder management

• Risk management

• Comprehensive coordination

• Planning, directing, and implementing IT security projects focused on Palo Alto solutions (e.g., Next-Gen Firewalls, Prisma Access, Cortex, SASE, Zero Trust)
• Coordinating interdisciplinary teams and resources throughout all project phases
• Managing project scope, schedule, budget, and quality according to client goals
• Active stakeholder management and ensuring transparency and communication
• Risk management: identifying, assessing, and controlling project-related risks
• Creating and maintaining project plans, budget overviews, and reports
• Ensuring customer satisfaction through high-quality project and relationship management
• Applying established project management methods such as PMI, PRINCE2, or SCRUM for structured project execution

• Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
• Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
• Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
• Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
• Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
• Implement continuous monitoring solutions to detect and respond to threats in real time.
• Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
• Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
• Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
• Collaborate with project teams to address findings and ensure that security risks are managed effectively.
• Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
• Facilitate a culture of security awareness throughout the organization through training and regular communication.
• Lead security initiatives that align with the organization’s long-term strategic goals.
• Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
• Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

• Technical program ownership for the IPv6 migration at DRV RP and DRV BW, with a focus on migration planning, execution structure, and cross-functional technical coordination.
• Designed and implemented an operational control model with dashboard, action board, KPI portfolio, risk register, and decision index to translate technical topics into structured delivery artifacts.
• Coordinated technical groundwork for architecture and rollout across IPv6 addressing, segmentation, dual-stack target design, test-lab planning, and cross-team dependencies.
• Supported security and compliance-related requirements in the context of BSI, NIS2, and critical infrastructure, translating them into traceable evidence, risks, and management reporting.
• Achievement: Established a reusable intake-to-governance workflow for systematically capturing technical actions, risks, open issues, and evidence requirements.
• Achievement: Created an operational baseline for technical program execution with measurable KPIs, clear ownership, and transparent decision support.

• Designed, managed, and implemented the company’s operational, compliance, procurement, and financial strategy, ensuring alignment with rapid scaling and regulatory objectives.
• Built and scaled operational infrastructure across IT, HR, Finance, Procurement, and Compliance, supporting growth from 4 to 20 team members in 6 months.
• Oversaw financial management of OPEX, including budgeting, monitoring, and cost optimization to sustain high-growth operations.
• Developed and executed a procurement strategy, including vendor selection, negotiation, and performance oversight.
• Procured and managed external consultants (compliance, quality, regulatory experts) and orchestrated collaboration across internal teams and external partners to meet milestones.
• Implemented policies, SOPs, and business systems (compliance tracking, eQMS, payroll, vendor management, data governance) to support regulatory compliance and scalability.
• Managed and actively oversaw regulatory and compliance programs, embedding GDPR, HIPAA, SOC 2, ISO 27001, and ISO 27701 requirements into day-to-day operations.
• Directed the rollout of a Quality Management System (QMS) aligned with ISO 13485 to prepare for medical device and AI regulatory certifications.
• Led people and culture development, establishing onboarding, performance management, and cross-functional collaboration structures to scale the organization effectively.
• Established risk management and business continuity frameworks, including security controls, risk registers, and compliance safeguards.
• Engaged executive leadership, board, and investors to align operational strategy with corporate goals and market expansion.
• Enabled technology-driven operations, selecting and implementing digital systems (e.g., Drata, Qualio) to ensure compliance and efficiency.
• Scaled StratifAI’s operational backbone to support rapid growth and international market readiness.
• Achieved ISO 27001, ISO 27701, SOC 2, GDPR, and HIPAA compliance within 6 months, enabling enterprise and healthcare partnerships.
• Implemented a QMS system aligned with ISO 13485, paving the way for regulatory approvals and positioning for upcoming ISO 13485 certification, CE-IVDR marking, and FDA clearance within 12 months.
• Designed and executed governance, procurement, and financial controls, ensuring efficient resource allocation and sustainable compliance.
• Established a culture of structured growth, integrating people, processes, and compliance frameworks to maintain operational excellence.
• Enabled StratifAI to confidently enter regulated US and EU markets, building the foundation for long-term expansion.

• Maintained 95% compliance for 300+ vendors through vendor risk assessment.
• Handled GRC of Ireland, Greece and Egypt markets.
• Conducted DPIA for suppliers.
• Collaborate with various stakeholders, including suppliers, internal teams, and external partners, to ensure compliance with cybersecurity standards and policies.
• Provided support in case of cybersecurity incidents, ensuring appropriate measures are taken to mitigate risks and protect the company’s data.
• Contribute to the continuous improvement of cybersecurity processes and practices within Vodafone, ensuring the company stays ahead of emerging threats and vulnerabilities.

Conception, planning, and production deployment of two AI platforms for industrial research and engineering workflows, from use-case identification and requirements analysis through architecture decisions and build-vs-buy trade-offs to go-live.

• awRAG.io: Identification of the use case (fragmented knowledge base across distributed AI tools), definition of data requirements, architecture decision for a multi-tenant RAG-as-a-service platform with GDPR-compliant EU infrastructure and production-grade retrieval pipeline

• LAIERS.ai: Use-case definition (context loss in linear AI workflows), strategic product decisions on UX, cost structure, and multi-LLM orchestration, rollout of a spatial AI conversation platform with proprietary context management system LAICS

• LLMOps ownership: Quality assurance, pipeline optimization, security architecture (OAuth 2.0, SOC 2), and performance monitoring of both platforms in live production

• Core topics: LLM, RAG, vector databases, LLMOps, AI architecture strategy, cloud infrastructure, data sovereignty

• Designed and implemented the agent-based AI architecture for a company-wide platform to securely deploy LLM-based agents
• Designed and implemented end-to-end RAG pipelines from multiple sources: document preprocessing, chunking strategies for different document types, embeddings, retrieval with re-ranking, and robust prompt orchestration
• Developed a modular context engineering framework with skill architecture, context isolation, and dynamic resource management; human-in-the-loop control for enterprise tool integrations
• Built the CI/CD pipeline, testing strategy, tracing on the software side as well as automated LLM and agent evaluations, red team testing and tracing, and handed over to a reproducible production environment (ISO27001 and SOC2 compliant)

• Setup and operation of a multi-cluster AWS EKS platform for banking workloads with a unified network and security architecture across 45 AWS accounts.
• Developed and standardized a unified AWS network and security architecture for 45 AWS accounts, enabling consistent governance, connectivity, and compliance for enterprise customer environments.
• Developed and operated a multi-cluster AWS EKS platform to support production workloads, significantly improving scalability, availability, and operational reliability.
• Implemented a GitOps deployment model using ArgoCD and Helm, enabling fully automated, auditable deployments and reducing manual release errors.
• Automated infrastructure provisioning using Terraform and Terragrunt at scale, reducing environment setup time by up to 70% and eliminating configuration drift.
• Established enterprise-grade backup and disaster recovery strategies using Velero and AWS Backup, ensuring reliable multi-cluster recovery and business continuity.
• Introduced Rancher as a self-service Kubernetes platform, accelerating developer onboarding while maintaining centralized security and governance.
• Designed and implemented detailed AWS IAM concepts (roles, policies, trust relationships) to enforce the principle of least privilege for access to accounts, workloads, and CI/CD pipelines.
• Developed AWS Lambda-based pre-provisioning workflows for databases, automating initialization, configuration, and access setup to support secure and consistent application integration.
• Delivered consistent, high-quality results as part of a 5-person AWS Solutions Architecture team, resulting in three consecutive contract renewals.

• Advanced to directly report to C-level and lead the €1.5M budget with AWS, utilizing S3, EC2, and RDS services to run 21 accounts, 5 OUs, and 3 PB of data by architecting the AWS environment and monitoring KPIs.
• Led a strategic cloud migration from legacy systems to AWS, reducing data center costs by 42% annually. Designed and executed the transition plan, including refactoring and rehosting operations, ensuring system compatibility, and optimizing infrastructure connectivity.
• Reduced external firewall costs by €204k per month by eliminating the external service provider and bringing the function in-house, advertising on LinkedIn, screening candidates and leading the interviews.
• Lowered mobile phone costs from €276k to €60k for 300 users on 2-year contracts by negotiating better tariffs with Vodafone, removing unnecessary services for each user and standardizing across all countries.
• Saved €45k per annum by eliminating infrastructure and external IT consultancy costs in Zug, Belgrade, Berlin and Boston by reviewing the services, conducting a risk assessment and building an in-house team.
• Increased payment terms from 30 to 180 days with the four main suppliers which generated an additional €280k per month into the business by persuading them to support the company during a difficult period.