Terraform Expert

• Developed browser based platform for kubernetes no-code deployment and cluster management
• Developed CLI in Typescript to deploy the resources in the cluster without leaving the browser UI.
• Implemented DevSecOps pipelines: image scanning, SBOM, policy enforcement, supply-chain security and used Kyverno. Implemented IAM integration for the command line utility tool.
• Designed role & permission models for Keycloak, oAuth/OIDC, social login flows.
• Used LLM to convert user intent into the diagram.
• Worked on integration with multiple Sovereign Cloud like stackIt, Hetzner, CIVO, UpCloud plus public clouds like AWS, GCP, Azure
• The technology stack includes Java, SpringBoot, Kubernetes, OpenAI, Kubernetes multi-tenancy using vCluster, Karpenter, RBAC for CLI, Helm, React

Led the end-to-end integration and migration architecture for decommissioning SAP IS-U market communication and transitioning to Salesforce Marketing Cloud (SFMC) with E.ON IT Services — covering regulated EDIFACT market messaging, a three-phase data migration (transfer of market message inventory after cutover), redesign of market communication processes, and full GDPR and German energy-market compliance.

• Designed the three-tier target architecture (SAP IS-U → NScale B2B gateway → SFMC) processing 50,000–100,000 EDIFACT messages daily within sub-5-minute SLAs.
• Architected the three-phase data migration: 36 months of historical data, zero-loss cutover of in-flight market messages, and near-real-time CDC synchronization.
• Delivered secure, BDEW/GDPR-compliant integration (AS2/OFTP2, RFC/IDoc, REST APIs, OAuth 2.0, Azure AD, AWS S3) achieving >99.5% uptime, <0.1% migration discrepancy, and RTO <4 hours.
• Applied BPMN to model and optimize the market communication processes.

Technologies: SAP IS-U, NScale, Salesforce Marketing Cloud, EDIFACT, OAuth 2.0, Azure AD, AWS S3, BPMN, Jira, Confluence, Draw.io

• Create and lead roadmap forecasting of support opportunities, including colleague training, process design and improvement, and new hire onboarding.
• Collaborate seamlessly with cross-functional teams including Professional Services, Support, Product, Sales, and Solution Engineering.
• Manage business and financial KPIs in alignment with overall business objectives.
• Industrial IT & Data Integration: Implement, configure, and integrate OT/IT systems and data flows, connecting control-layer sources (DCS, PLC, SCADA) to historians, data platforms, and enterprise systems through APIs and standard interfaces.
• AVEVA PI & Historian: Configure, maintain, and extend AVEVA PI (PI Data Archive, Asset Framework, interfaces/connectors) to capture, contextualize, and serve real-time and historical operational data.
• Alarm Management: Support and optimize alarm management systems – e.g. Honeywell Alarm Management – including alarm rationalization, classification, and the analysis of alarm performance, critical alarms, and alarm floods.
• Connectivity & Protocols: Set up and troubleshoot industrial connectivity using OPC UA and OPC A&E, including the configuration of tunnelers / wrappers to bridge OT data sources securely and reliably.
• Production Data Flow: Ensure seamless, secure, and well-structured data flow across the industrial IT landscape, transforming raw operational data into meaningful information for operations and decision-making.
• System Support & Troubleshooting: Provide ongoing support for OT/IT applications, troubleshooting issues across networks, software, and data integrations to keep systems running efficiently.
• Knowledge Management & Best Practices: Contribute to internal documentation, best practices, and troubleshooting guides, and help continuously improve how we deliver industrial IT and data solutions.

Tools & Software: Aveva PI, Salesforce, Active Directory, Microsoft Dynamics 365, Jira, Microsoft, Scrum, DevOps, Docker, CI/CD, Jenkins, GitHub.

Remote freelance role focused on Agentic AI strategy, secure application patterns, and reusable agentic workflows for a government agency.

• Development and implementation of an open-source Agentic AI strategy for a government agency, with a focus on GDPR, security, and self-hosted solutions
• Development of reusable agentic workflows and business applications that enable non-technical employees to solve business problems independently
• Implementation of nine business applications with Single Sign-On (SSO) and Azure PostgreSQL integration on Hetzner Linux servers

Techstack: Python, Streamlit, Anthropic SDK (Claude), Azure, Linux, PostgreSQL, MS SQL, Angular

Task: Operator development and observability

Technologies and skills: Kubernetes, Valkey-Operator, Crossplane, Backstage, OpenPortal, OTEL, Grafana Cloud, Azure DevOps, Artifactory, Flux, Alloy, Prometheus, Grafana, Loki, OCF, Copilot

What I did:

• Evaluated/developed Valkey-Operator
• Set up OpenTelemetry
• Integrated it with OpenPortal/Backstage/CrossPlane

• Planned and developed a CPU monitoring application for monitoring system performance and resource utilization.
• Designed and implemented a Spring Boot backend providing a REST API for processing and exposing monitoring data.
• Developed the React frontend for presenting monitoring information in a clear and user-friendly interface.
• Integrated PostgreSQL for persistent storage and management of application data.
• Containerized the application and its services using Docker Compose.
• Automated infrastructure provisioning and deployment using Terraform on AWS.
• Structured the application as a modern, maintainable system using REST-based communication between frontend and backend.
• Designed and developed a secure, scalable CPU monitoring architecture (cpu-watcher) with a dedicated collector application that streams monitoring data to the backend, reducing direct exposure of system resources.
• Designed a secure cloud infrastructure with the database isolated within a private network and OIDC-based authentication.
• Implemented Infrastructure as Code with Terraform and integrated version-controlled CI/CD pipelines to automate testing, infrastructure changes, and application deployments.
• Designed and implemented the frontend delivery architecture using AWS CloudFront.

Stack: Spring Boot · React · PostgreSQL · REST API · Docker Compose · Terraform · AWS

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

• Industry: Insurance, Trade, IT
• Customers & Projects: Consulting and selling insurance and similar services
• Main tasks: Insurance consulting (health insurance, retirement planning, wealth building); commercial services, inside and field sales; sales data analysis and forecasting; customer consulting and support; opening a new sales headquarters for private and business customers; business development & innovation management; business use case development; process optimization; stakeholder management; team leadership and training; preparation and delivery of trainings;
• Technologies used: Microsoft Office 365, Microsoft Teams, Jira, Draw.IO, Camunda 8, Java (8, 17,21,25), Git, Spring Boot, Spring Batch, Spring Data REST, Spring Web, Spring Security, J-Unit, Playwright, Lombock, Vaadin, H2, PostgreSQL (16, 17 18), pgAdmin, Docker, LLMs, JasperSoft Studio, JasperReports

• Patch management and system hardening for Linux and Windows via AWS Systems Manager, including Maintenance Windows; image pipelines (AWS Image Builder), Ansible, and PowerShell DSC
• IT security & compliance: IAM/KMS/MFA, secrets management, Policy-as-Code (Checkov, tfsec, cfn-nag), AWS Config, CloudTrail, and Security Hub; infrastructure security audits, internal audits, penetration tests, and incident response exercises
• Analysis of cloud security reports and implementation of preventive measures; automated security and compliance tests; backup strategies using snapshots and S3 Glacier
• Administration of multiple AWS accounts (VPCs) with up to 2.500 Linux and Windows servers and hybrid networks
• Automation using Terraform, OpenTofu, CloudFormation, Ansible, and PowerShell DSC; CI/CD with GitLab CI and GitHub Actions
• Planning of rollouts, upgrades, and lifecycle management for key components; coordination with DevOps, security, and development teams; preparation of concepts and decision papers

• Development of an agent-based governance platform for the automated assurance of EU AI Act compliance and ODA-compliant orchestration of AI services in complex enterprise environments.

• Design and implementation of an agent-based "Mission Control" framework (Aletheia Conductor) for autonomous state monitoring and process control.

• Development of "Compliance-as-Code" (CaC) solutions based on OPA/Rego for system-wide enforcement of regulatory guardrails.

• Integration of TM Forum ODA standards (TMF630, TMF622, TMF642) to ensure interoperability and standardization.

• Building a highly available event-driven architecture using Redpanda and CloudEvents v1.0 for near-real-time event processing.

• Implementation of an audit-proof "Evidence Chain" through cryptographic linking of trace logs in preparation for automated audits.

• Tech Stack: Java 21 (Quarkus Native), TypeScript (Next.js), Redpanda (Kafka API), CloudEvents v1.0, OPA (Open Policy Agent) & Rego, TimescaleDB, ZincSearch, Redis, TM Forum ODA, Git, GitHub, Clean Code Development, Like-C4.

Maturing their API practices on both a business and technology level. My role covers strategy, architecture, developer advocacy as well as hands-on software engineering, enabling both technical teams and business leadership to adopt and act on API-centric principles effectively. Coincidentally, we also establish GitOps, DX and platform best practices with this project.

Highlights:

• Aligning executives with the initiative by clarifying strategy, replacing misconceptions and myths with facts, clarifying the value of existing assets and enabling informed decision-making
• Formulating a way forward for API Lifecycle Management at OTTO
• Driving platform progress and fostering developer engagement by hands-on engineering work towards strategic goals

API Lifecycle Management, Team Topologies, Organizational Evolution, Regulatory, Platform Advocate, Developer Platform, Communities of Practice, Terraform, Kotlin, Kafka, Kong, WSO2, Apigee, Gravitee, Backstage, AsyncAPI, OpenAPI, API Design, AWS, React, Node.js, TypeScript, Redocly, reactive programming, CDC, Golang, Gin, GitOps, DX (developer experience), stakeholder management, roadmaps, workshops, discovery.

Stabilization of an Azure/.NET landscape in live operation.

• Architecture, DevOps, and operational readiness; technical decisions under time pressure
• Azure DevOps, monitoring, ETL/ELT, cloud security, FinOps, and data-mesh-related topics

Technologies: Azure DevOps, .NET, CI/CD, monitoring, FinOps

Built an international e-commerce platform for a multi-vendor marketplace for digital assets from scratch. Designed and operated cloud native architectures at enterprise scale.

• Designed and operated a highly scalable microservice and serverless architecture
• Built the complete cloud infrastructure with Terraform + AWS CDK in AWS
• Provisioned ECS/EKS clusters (Fargate), Application Load Balancers (reverse proxy), and Lambda functions
• Observability & tracing with CloudWatch, DataDog, Prometheus, and Grafana
• End-to-end setup with DataDog (formerly AWS CloudWatch), Prometheus, and custom Grafana dashboards
• Integration of advanced metrics (including ORM mapper) and distributed tracing with Jaeger
• Robust backup and disaster recovery strategies
• RDS Postgres backups and hourly snapshots
• Read-only, asynchronously synchronized replicas with automated master failover in emergencies
• Minute-level rollback capability through versioned Docker images on ECS and Git-based CI/CD pipelines
• Created CI/CD pipelines with GitHub Actions for automated multi-stage deployments (Dev, Testing, Prod)
• Integrated Stripe for international payment processing
• Built a marketplace payment system with multiple parties and payout routines
• Used Algolia for high-performance real-time search of digital assets on the platform
• Federation of services with GraphQL and Hasura
• Later migration to GraphQL Mesh
• Test Driven Development (TDD) - unit, integration, and E2E testing with Jest, Vitest, and Playwright
• Used Next.js / React for modern frontend applications in the nx monorepo
• Enterprise security architecture & access control
• Integration of JWT tokens with Auth0, OAuth, OIDC, IP guards, BOLA protection, and secret vaults
• Authorization concepts with RBAC, ABAC, and native Postgres Row-Level Security (RLS)
• Built internal microfrontends with Retool for fast prototyping and operational business processes

Technologies: ABAC, AWS CDK, AWS CloudWatch, AWS ECS, AWS EKS, AWS Fargate, AWS RDS, AWS S3, Algolia, Auth0, DataDog, Docker, GitHub Actions, Grafana, GraphQL, GraphQL Mesh, Hasura, JWT, Jaeger, Java, JavaScript, Jest, Kotlin, Kubernetes, Monorepo, Next.js, OIDC, Playwright, Postgres, Postgres RLS, Prometheus, RBAC, Redis, Retool, Serverless, Stripe, Terraform, TypeScript, Vitest

• Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
• Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
• Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
• Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
• Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
• Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
• Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
• Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
• Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
• Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.