Sophos Experts in Germany

Creation of concepts for M365 implementation, especially Tenants, EntraID, EntraConnect and ExchangeOnline, taking BAS standards into account (mandatory baseline security requirements) in the project "Concept M365" with the aim of transferring the concepts to the M365 environments of Bitmarck and then handing them over to the customer.

• Creation of a current-state analysis of the existing M365 environments as well as the on-premises environments and the BAS standards.
• Creation of concepts for the topics Tenants, EntraID, EntraConnect and ExchangeOnline taking the BAS standards into account
• Design and implementation of an automated solution for creating standardized M365 tenants based on Microsoft M365 DSC (Desired State Configuration)
• Transfer of the concepts into the M365 environments
• Creation of detailed technical documentation

• Operation and further development of the network and security infrastructure.

• Monitoring, analysis and resolution of network and security incidents.

• Cross-department collaboration with other specialist teams for operations, further development and reporting.

• Firewall vulnerability analysis.

• Firewall rule approvals.

• Troubleshooting IP communication issues in the network and firewall infrastructure.

• Security-critical IT infrastructure, processing of personal data, compliance with legal regulations.

• Products: Palo Alto Networks Firewalls, Cisco ACI, Checkpoint Firewalls, F5

• Technologies: SDN, SDWAN, Cisco EPIC, Cisco ACI

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

• Analysis of requirements and the current situation
• Migration of an old domain structure and Tobit to Exchange 2019 with integration to MS365
• Evaluation of implementation paths and planning for securing sensitive data
• Planning regarding BSI basic protection, the German Federal Data Protection Act (BDSG), and GDPR
• IT governance and IT security backtests
• Support with ERP setup and securing mail transfer
• Hyper-V 2016/2022, Microsoft Terminal Services Cluster, Microsoft Exchange 2019
• Office 365, Microsoft 365, Azure AD, Teams, Salesforce
• Cisco, Zyxel, and HP switches, Sophos firewalls/UTMs, SecurePoint
• Microsoft IIS 2022, IPv4/IPv6, Veeam, Wortmann online backup, NextCloud
• Services: DNS, DHCP, TCP/IP, subnetting, firewalling, routing, VoIP, Group Policy (GPO), SIEM, remote work, home office, high availability, failover, VLAN, PRTG

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

• Set up Azure Kubernetes clusters (AKS) with network policies, security groups, and RBAC
• Developed Terraform-based infrastructure as code for secure, reproducible deployments in the BMW Azure cloud
• Hardened CI/CD pipelines using Jenkins, SonarQube, Fortify SSC, and Contrast AST
• Integrated SAP BTP/Kyma and ServiceNow GRC

• Disciplinary and professional leadership of the IT and service team
• Definition and documentation of the Current Mode of Operation (CMO) in Confluence: application landscape, infrastructure, networks, backup & storage
• Development of the Future Mode of Operation (FMO) including process analysis & stakeholder interviews with all departments using BPMN and flowcharts
• Optimization of license management: reduction of ongoing software costs by approx. 17% p.a.
• Introduction and establishment of Jira as the central tool for project and service management
• Introduction and rollout of the HR software MindKey to digitize HR processes
• Introduction of a VoIP solution with Microsoft Teams incl. PSTN connection to replace classic telephony
• Introduction of the production and planning software OptiControl to digitize operational processes
• Rollout of Intune as a Mobile Device Management solution for Windows, iOS and Android
• Build-up of Power BI dashboards for machine park monitoring and financial reporting
• Planning and execution of the IT consolidation of two locations for 170 users
• Introduction of automated penetration testing with Pentera
• Coaching and mentoring the team in agile methods & project management
• Operational support in day-to-day business: administration, incident & change management
• Management of external service providers and assurance of the quality of outsourced IT services
• Responsibility for the IT budget incl. planning and controlling
• Direct reporting line to management with regular management reports on IT KPIs, budget and project status

• Overall coordination of service providers for all infrastructure topics at a production site being set up in Baden-Württemberg
• Design and finding solutions for internet connectivity, building office communication networks, setting up WLAN in production and administration buildings, IP address management, password policies, time tracking, access control systems, backup strategies, emergency power planning, operating concepts, cost planning, event management, workplace setup including laptop/mobile phones/telephony, remote support, print servers
• Selecting suitable external service providers and planning to meet needs for spare parts, repairs, on-site service, network and workplace support including on-site system replacement by providers
• Choosing suitable external service providers for facility management and building technology (fiber optic connections, data center infrastructure, cable ducts etc.)
• Coordination with clients and service providers
• Escalation management, schedule control
• On-site presence for service meetings and managing service providers

• Analysis of technical and economic feasibility
• Creation of a detailed project plan including time and resource management
• Requesting and evaluating offers, selecting components, and managing suppliers
• Coordination of all involved trades (e.g. electricians, installation companies)
• Monitoring the construction work and ensuring deadlines, budgets, and quality standards are met
• Acceptance and commissioning of the PV system including documentation
• After project completion: optimizing monitoring and supporting grid connection

Self-employed consulting, implementation, and support of IT infrastructures with a focus on IT security, network and server administration, virtualization, backup & recovery, IT documentation, asset management, and business continuity management.

• IT security consulting and implementation of technical protective measures
• Windows server and client support, patch management, user support
• M365 – Entra ID – MS Azure administration
• Planning, installation, and operation of LAN, WAN, WLAN, and VLAN infrastructures, Cisco, HP, Netgear, Sophos, Securepoint
• Support of virtual systems based on Hyper-V, VMware, and Proxmox
• Backup and recovery concepts including test recovery, documentation, and handover
• Introduction and maintenance of IT documentation, asset management, and inventory tracking
• Implementation of measures related to IT baseline protection, emergency manuals, and BCM
• On-/offboarding concepts with a focus on permissions, devices, data access, and handover processes

Security awareness and practical sensitization of users and IT staff

• Operation and further development of a SASE infrastructure based on Netskope

• Development and implementation of test concepts for complex, multi-layered systems
• Creation of regular management reports and presentations for stakeholders and clients
• Technical and disciplinary leadership of international test teams (coordination, coaching, resource planning)
• Responsibility for quality assurance across multiple test levels (unit, integration, system, and acceptance tests)
• Design of test cases and test plans in Azure DevOps; ensuring traceability and coverage
• Use of BDD approaches (Gherkin/Cucumber) to prepare test automation
• Building a test automation architecture with Playwright and integrating new tests into CI/CD pipelines
• Performing API tests (REST) and tests for mobile/PWA applications
• Setup and maintenance of test environments across multiple stages (integration, QA, UAT, pre-production)
• Test data management (synthetic and production-like data), ensuring consistency and reproducibility
• Collaboration with DevOps teams for containerization (Docker/OpenShift) and CI/CD integration
• Working under SAFe & Scrum, closely coordinating with product owners and DevOps teams
• Active participation in PI plannings, sprint reviews, and retrospectives
• Promoting an agile QA culture through coaching and knowledge sharing
• Introducing scalable test automation with Playwright → significant reduction of manual testing efforts
• Increasing test transparency through clean defect and reporting management in Azure DevOps
• Improved release quality through an end-to-end QA strategy and automated regression tests
• Strategic leadership of Trikolon Consulting GmbH and responsibility for finance, personnel, and business development

• Redesigning cablewise infrastructure with CAT 8.1 keystones, measuring the speed and quality of the new installation with Pockethernet, documentation at a local saddlery
• CAT 8.1 installation and building a data center, site linking, VPN and VLAN configuration for a local car dealership, implementation of IT-Security standards like virus protection (G Data) and firewalling (OPNSense)
• Relocation of a tax office with redesign of the IT infrastructure, virus protection (G Data) and backup solutions (QNAP)
• Planning, conception and implementation of an inhouse data center, BSI-compliant for commercial laundry (including Proxmox-based virtualization of existing infrastructures, QNAP, G Data, OPNSense, APC)
• Implementation and conception of security solutions in the SME sector
• Collaboration on the IT-security concept for the Bremen network of authorities (in the dLAN network)
• Creation of IT-security concept VOIS (modules MESO, KFZ/iKFZ) including audit preparation for KBA
• Expansion of the IT-security concept for the online service for electronic residence registration (eWA) to include use as an eFA (one-for-all) service (nationwide)
• Expansion of the IT-security concept to include modules wos & wvp
• Concept development for the implementation of DIN SPEC 27076 at MSEs and SMEs
• Creation and evaluation of emergency concepts
• Creation and evaluation of response actions and BCM plans
• Assessment of existing business continuity management (ISO 22301)
• Development of BCM strategy options
• Conducting awareness training

• Plan & Prepare (Site Design & Readiness): Inventory & Design: Dell PowerEdge R-Series, Aruba switches (L2/L3), notebooks/peripherals; serials/asset tags, IPv4/IPv6 addressing, VLAN-/DHCP-/DNS plan

• Runbooks/MOPs: site rollout runbook, backout strategy (<15–30 min), risk register, communication matrix; approvals via CAB/change

• Images/Packages: Golden Image (Win10/11), driver packs, BIOS/UEFI baseline; O365/Teams/OneDrive KFM; BitLocker policies; MECM/SCCM, Intune/Autopilot, MDT/WinPE

• Logistics: shipping/customs clearance, RMA/DOA, on-site spares; tools (barcode scanner, label printer), "Go-Bag" (cables, SFPs, console cables)

• Deliver (on-site implementation): End devices: swap & migration (USMT/OneDrive KFM), peripherals (ATB/BT printers, scanners, boarding gate hardware); domain join, compliance checks, O365 activation, printers/queues, network drives

• Acceptance: functional tests for DCS/CUTE/CUPPS/CUSS stations, ticketing/check-in workflows, boarding gates

• Server (R-Series): rack & stack, cabling (PDU redundancy, fiber/copper), labeling/naming; firmware/RAID (PERC), Lifecycle Controller, iDRAC network; Windows Server 2022/2025 + CIS/BSI hardening; agents (backup/AV/EDR/monitoring), time service/NTP auth, Syslog/SNMPv3

• Network (Aruba): VLANs, LACP trunks, MSTP root; PortFast + BPDU Guard at the edge; QoS (EF/AF); dual stack (v4/v6), DHCP relay. NAC/802.1X with ClearPass/Radius/TACACS+, roles + MAB fallback; guest isolation, ACLs (Guest→Mgmt deny). Telemetry: sFlow, SNMPv3, Syslog→SIEM; LLDP→inventory/CMDB

• Airport specifics: CUTE/CUPPS/CUSS terminals; DCS/Amadeus/SITA connectivity; FIDS (read-only); bag tag/boarding pass printing; changes in off-peak/night windows

• Stabilize (hypercare): first-day support, KPI tracking (login times, ticket volume, error classes), QoS fine-tuning

• Troubleshooting: Wireshark/iperf, event logs, switch counters, sFlow flows; fast incident handling as SPOC

• Knowledge transfer: short training sessions for station teams, mini-runbooks (fault/recovery)

• Close (documentation & handover): docs & CMDB: final configs (switch/server), topology/patch plans, IP tables, serial/asset lists, before/after photos

• Acceptance & sign-off: UAT protocols, functional evidence (use cases), return/reuse of old hardware

• Lessons learned: risks, standard packages, driver freeze, "known issues"

• Interfaces/communication: station IT, airport IT, SOC/NOC, ground ops/ramp/check-in, provider (SITA/Amadeus). ITSM: ServiceNow (Inc/Req/Change/KB), handover to BAU