Tenable Experts in Germany

• Led the subproject for implementing Vulnerability Response as part of DORA
• Documented the current processes in compliance, risk & security
• Created the functional design for introducing application, infrastructure, and cloud vulnerabilities
• Agile management of the integration service provider, the technical department, and the company's cross-functional teams
• Integrated the V scanners Tenable, Qualys and Defender, as well as NVD and CISA/KEV
• Integrated GitLab Ultimate for importing and processing SBOMs
• Developed automation rules to match scan results with CIs in the CMDB, assign vulnerabilities and remediation tasks, handle approvals (false positives, exceptions) and closures
• Calculated multiple risk scores and priorities
• Defined dashboards and reports (Workspaces, Performance Analytics)
• Aligned the new processes, especially to improve the CMDB data quality (according to CSDM)

• Consulting and project management to build an AI-based automation platform for market data analysis
• Automated testing of financial data
• Market data automation with Python and N8N
• AI data integration and AI learning
• Use of Ollama and Qwen
• Data organization and database management

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

Enterprise & Cloud Security Architect supporting the modernization of the SDK application landscape as part of the KVNeo transformation program. Responsible for enterprise architecture, cloud governance, security architecture, and the definition of technical standards for strategic business applications.

Key responsibilities include architecture governance, target architecture development, cloud and integration architecture, security-by-design, and the translation of regulatory requirements into sustainable technical solutions across multiple business domains.

Responsibilities and achievements

• Designed and reviewed target architectures for strategic insurance applications and enterprise services.
• Developed architecture documentation based on Arc42 and Architecture Decision Records (ADRs).
• Defined governance models, architecture principles, and technical guidelines for cross-domain initiatives.
• Supported the modernization of archive, document management, and output management platforms.
• Designed integration architectures using REST APIs and event-driven communication patterns.
• Led architecture discussions with enterprise architects, development teams, product owners, and business stakeholders.
• Translated regulatory requirements such as DORA and ISO/IEC 27001 into practical architecture decisions.
• Designed security concepts covering Identity & Access Management, authorization, authentication, auditability, and logging.
• Supported SIEM integration, security monitoring, and enterprise logging concepts.
• Evaluated technical risks, technical debt, and architecture improvements while providing decision papers for architecture boards.
• Established architecture governance processes and contributed to enterprise-wide transformation initiatives.
• Supported cloud governance activities and the definition of secure cloud architecture standards.
• Facilitated architecture workshops and coordinated cross-functional stakeholders across business and IT.

Technologies & Methods Microsoft Azure • Arc42 • Architecture Decision Records (ADR) • REST APIs • Event-Driven Architecture • Microsoft Entra ID • Active Directory • IAM • SIEM • Cloud Governance • Enterprise Architecture • Security Architecture • Azure API Management • Jira • Confluence • Draw.io • DORA • ISO/IEC 27001 • Agile • Scrum

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action

• Security analysis of alerts
• Further development of the security operations center
• Development of processes and workflows in the security environment
• Implementation of SOC solutions
• Forensic expertise
• Conducting hunts
• Vulnerability scans and proof of concepts
• Risk assessments and risk analyses
• Maintenance and further development of the Tenable.sc ScanCenter environment

Supervised the course Software Engineering for Bachelor students and delivered lectures.

• Vulnerability management (Greenbone, Tenable SC, Rapid7)
• Automation of vulnerability scans
• OpenTofu (Terraform)/Ansible/Vault/Podman/Docker
• Compliance audit
• SOC (ElasticSearch, Graylog)
• Python/Rust/Bash/Shell/PowerShell
• Git collaboration
• Report standardization and automation
• POC for several vulnerability scanning systems
• Setup of vulnerability scanning system

• Ensured security compliance across 23,000+ endpoints, including 5,000+ business-critical servers and 18,000+ workstations, achieving a >95% compliance rate and aligning with industry standards such as ISO 27001 and CIS benchmarks.
• Led remediation efforts by deploying OS and third-party updates in phased rollouts, eliminating 80%+ of critical vulnerabilities within 6 months while ensuring zero unplanned service disruptions.
• Designed and implemented PowerShell and Python scripts with 99.5% reliability, automating patch validation, compliance tracking, and system health checks—reducing manual intervention by 70%.
• Utilized Kali Linux for proactive threat detection; monitored network traffic and background services using tools like Wireshark, Nmap, and Netstat.
• Conducted web application penetration testing using OWASP ZAP and Burp Suite, identifying and reporting vulnerabilities and reducing overall application risk exposure by 60%.
• Engaged with security teams, developers, and senior IT leadership to discuss risk posture, present vulnerability assessments, and define mitigation strategies aligned with business objectives.
• Monitored system performance during high-impact software and patch deployments, leading support and backup teams to resolve issues swiftly, achieving 98%+ deployment success rate and preventing potential downtime-related financial losses across critical infrastructure.

• Analyze and structure specific IT security requirements
• Build a structured requirements backlog as a basis for the sub-group’s IT security initiatives (including separation from group-wide programs)
• Conduct a systematic delta comparison with group-wide IT security requirements to identify open needs and dependencies
• Develop a multi-level IT security roadmap including implementation and project planning, aligned with internal and external stakeholders
• Provide professional project management at the program level, including status analysis, risk management, action tracking, and goal control
• Coordinate internal departments and external service providers, including communication planning and managing regular status meetings

• Enhanced quality assurance of documents, processes and required evidence in preparation for the upcoming KRITIS audit 2025.
• Reviewing and commenting on all relevant documents.
• Advising authors and document owners on inquiries and during the creation process.
• Supporting departments with IT security inquiries.
• Used tools/Frameworks MS Office, SharePoint, Jira, Confluence, ISO27001+, NIS-2 (EU 2022/2555), B3S (Statutory Health & Private Health Insurance), BSIG / IT-SIG 2.0, BSI-KritisV, BSI-C5, BSI Baseline Protection (200-2, 200-4), ServiceNow, RCE (EU 2022/2557), SGB, GDPR

• Deputy lead of the 10-member information security management team in a highly regulated environment (DORA, VAIT, BAIT)
• Direct reporting lines to the CIO of the Gothaer Group and the management board of Gothaer Solutions
• Regular member of the Group Risk Committee and the Compliance Committee
• Managing and coordinating information security processes within the company and with IT service providers
• Leading task forces for handling information security incidents
• Contributing to IT emergency and business continuity management

The client's goal is to migrate the entire Office client landscape from Windows 10 to Windows 11 by the end of support (Oct. 2025). Creating the project plan and drafting the project brief, the budget overview, as well as the required resources.

Setting up sub-workstreams such as: Adoption & Change, Service Process including migration process, service definition including SCCM software packaging and build task sequence, security including client hardening, application integration including requirements and demand from power users (key users) in the company.

• Project management, stakeholder management, Project Canvas workshop, design thinking workshops, vendor management, project controlling