Terraform Experts in Austria

Cyber Trust Austria Silver Certification

• Led application and implementation of the Cyber Trust Austria Silver label (KSV1870 Cyber Risk A-Rating; 25 validated controls)
• Mapped and fulfilled requirements covering risk management, incident response, access control, vulnerability and penetration testing, BCM, and supply-chain security, aligned with ISO/IEC 27001/27002 control themes and NIS 2 / NISG 2026 expectations
• Coordinated stakeholders, compiled audit evidence, and completed KSV1870 validation

Refactoring and improving core APIs; implementing client change requests. Setting up metrics, traces, and logs monitoring infrastructure to support operations. Designing GitOps deployment and infrastructure as code. Applications and systems configuration in ArgoCD and Openshift. Confluence documentation of design, approach, and solution. Tech Stack: Java 8 & 21, Spring framework, JSP, JavaScript, Bash scripts, SQL, Grafana Stack, OpenTelemetry, Docker, DB2, Maven, Kubernetes Kompose.

• Designed and built a next-generation NLP platform to accelerate sales-driven customer service through intelligent request analysis and routing, reducing average customer query response time by 30%.
• Architected a hybrid NLP system combining Large Language Models (LLMs) with traditional NLP pipelines for robust, explainable results.
• Developed request classification and routing mechanisms to accelerate customer support teams in handling customer queries faster and more accurately.
• Optimized LLM based data extraction and classification with context engineering.
• Integrated the platform into customer service processes, reducing response times and enhancing workforce efficiency.

Migration preparation for the upcoming ERP system change: recording all ERP-related business processes, analyzing pain points, and consolidating them into process views. Ensuring that every process can be transferred to the target system or that an alternative exists. Result: a solid working basis for system integrators and a company ready for migration.

BPMN · Camunda

Selected projects:

Kiosk platform – Hospitality

• Led a 3-person team while taking a hands-on role in designing an edge computing infrastructure for over 15 self-service kiosks in Alpine hotels with unstable connectivity
• Designed a Nomad-based cluster with a Wireguard mesh network for fully automated OTA updates, even during local network outages and offline operation
• Integrated physical peripherals (hotel card readers, thermal printers) into a containerized deployment pipeline
• Reduced on-site maintenance visits by ∼40% with a resilient offline-first architecture and Prometheus-based hardware monitoring
• Tech: Nomad, Consul, Wireguard, NestJS, NextJS, Prometheus, Custom Hardware Provisioning

Multi-tenant SaaS platform – Insurance claims management

• Built and operated the Kubernetes infrastructure for a market-leading claims management platform (acquired by an S&P 500 company) — with strict compliance and availability requirements
• Designed a multi-tenant EKS cluster with tenant isolation, enabling cost-effective single-instance hosting for multiple customers
• Introduced dynamic spot instance node pools, reducing infrastructure costs by ∼20%
• Built fully automated deployment pipelines (Terraform + GitHub Actions) for uninterrupted releases during business hours
• Tech: EKS, Terraform, GitHub Actions, Prometheus/Grafana/Loki, PHP, GraphQL

Legacy ERP integration – Construction photo documentation

• Led a 2-person team in designing and building a real-time sync bridge between a legacy Microsoft Access ERP system (without an API) and a modern mobile photo app for construction quality control
• Developed a PostgreSQL pipeline with real-time listeners that extracts data from 1990s Access databases without disrupting existing workflows
• Built a resilient upload architecture using the circuit breaker pattern for unstable construction site connections (S3, NFS, Synology NAS)
• Saved 2–4 hours per week for each project manager through automated photo sync instead of manual USB/SD card transfers
• Tech: NestJS, PostgreSQL, React Native (Expo), S3, Synology API, Offline-First Architecture

Project Tech Stack: Python, AWS, Azure, FastAPI, openai, pandas, unittest/pymock

Achievements:

• Engineered automated data extraction pipelines to transform complex Excel datasets into structured formats via LLM-driven workflows.
• Architected a generative slide-deck engine that translates natural language prompts into formatted presentation assets.
• Integrated advanced LLM capabilities with the OpenAI Response API, implementing sophisticated tool-calling and structured output logic.
• Developed and containerized scalable backend microservice using FastAPI, Docker, and OpenShift to host and serve agentic skills.

• Backend / Microservices Developer, DevOps, Test Automation
• ~100 Developers, ~10 Teams, per Team: 1 PO, 1 ScrumMaster, 1UX, 1 Developers, 1 Tester
• .net core 8, 9, C#
• Microservices, Clean Architecture, MediatR, CQRS
• GraphQL, REST, SDL
• Azure DevOps, CI / CD pipelines, Azure Service Bus, Rabbit-MQ, Kafka, Azure App Configuration, Azure KeyVault, Azure Kubernetes AKS
• Splunk, dashboards, custom metrics, Elastic-Search, Kibana (ELK)
• Azure SQL Databases, Azure Cosmos DB
• Architecture decisions, event governance, COP (Backend, DevOps, FrontEnd, Test Automation)
• AI, Copilot, creating Test Templates
• Scheduler, Hangfire, Quartz
• Automated Unit and Integration Tests
• Automated E2E Tests, Playwright Test Automation, BDD, Gherkin, Cucumber
• Shipment tracking
• GIS, GPS data, geofence, geo search, position tracking, asset positions
• Jira, Confluence
• Focus on high-performance message-oriented architecture (~xx e6 messages / month / service)
• Structured logging, Serilog, OTel, Splunk, Application Monitoring
• Integration of different position data sources (GPS-based data) into AzureDataLake

Focus:

• Developing and providing Cloud Native Courses
• Architecture Consulting for Platform Engineering and Cloud Native
• Supporting Teams and People on their Cloud Native Journey

Delivered Trainings:

• Kubernetes Fundamentals - From Pods to Ingresses; 2 Days
• Platform Engineering on GKE - Operators, GitOps, Gateway API, Policy Management, Storage; 2 Days
• Platform Engineering on AKS - GitOps, External Secrets, Policy Management, Ingress/Gateway API and Storage; 4 Days

Currently In Progress:

• Platform Engineering Basic / Advanced on OpenShift - OpenShift/Kubernetes Basics, GitOps, External DNS, External Secrets; Multi-Step Program with 2 Course Blocks (3 and 2 Days) and self-paced projects

• Built and maintained a full-featured React Native mobile app and companion web portal supporting multi-role access and real-time collaboration for service teams.
• Developed a robust NestJS backend using TypeScript, adhering to scalable microservices patterns to support a dynamic task management system.
• Designed and optimized PostgreSQL schemas, using advanced indexing and normalized data models to support patient tracking, tasks, and outcome reporting.
• Integrated Socket.IO to support real-time team communication, task status updates, and instant notifications across mobile and web platforms.
• Developed secure authentication workflows using AWS Cognito, including multi-role login, token refresh, and session timeout handling.
• Leveraged AWS S3 for secure document uploads (patient records, resource materials) with signed URLs and access control policies.
• Connected AWS SNS and SES to automate notifications for escalations, missed follow-ups, and appointment reminders.
• Engineered an admin analytics dashboard using React + Zustand for tracking user activity, case completion rates, and compliance metrics.
• Designed and implemented AI-driven features for task prioritization and patient risk classification using external API integrations.
• Established a robust CI/CD pipeline using GitHub Actions and Docker, achieving automated testing, linting, and environment-based deployments.
• Followed Agile ceremonies (daily standups, sprint planning, retros) while collaborating with QA, BAs, and PMs to deliver high-velocity features.
• Led data protection efforts ensuring full GDPR compliance, including encrypted storage, session control, and user-consent management.
• Delivered a fully responsive UI using DaisyUI-style components for mobile and tablet-first designs, achieving high Lighthouse scores.
• Reduced support tickets by 40% by implementing detailed audit logging and a self-service helpdesk system in the admin interface.

• Supports CANCOM customers in migrating legacy on-prem systems to Microsoft Fabric and Microsoft Foundry
• Takes over and stabilizes existing solutions after a short handover
• Business analysis and requirements engineering for migration to a new cloud environment
• Optimization of machine learning models for feature extraction and customer profiling
• Ensures data protection and compliance
• Leads the migration of on-prem systems to Microsoft Fabric
• Designs new AI platforms for clients
• Tests the integration of chatbots for document intelligence with Microsoft Foundry, including requirements analysis, implementation, validation, and client communication

• Architected and deployed a highly available, multi-tenant Kubernetes platform on Google Kubernetes Engine (GKE) for business-critical microservices.
• Designed and implemented a comprehensive Infrastructure-as-Code strategy using Terraform for managing GKE clusters, networking (VPCs, Subnets), and IAM policies.
• Engineered optimized storage solutions for stateful workloads (MongoDB) using GKE PersistentVolumes, enhancing performance and data resiliency.
• Established a full-stack observability framework using Google Cloud Monitoring, Logging, Prometheus, and Grafana.

• Owned day-to-day IT operations for Service Desk, Field Service, and on-call support, ensuring business continuity for a multi-site environment
• Led the transition from Lotus Notes incident tracking to ServiceNow, defining process design, workflows, roles, and reporting
• Implemented a modern telephony system with integrated reporting, enabling real-time visibility of volumes, wait times, and SLA adherence
• Launched a customer self-service portal and on-site walk-in support model to improve first-contact resolution and user experience
• Designed, documented, and rolled out SLAs, delivering targeted training for engineers and stakeholders to drive adoption and compliance
• Acted as process owner for service operations, establishing operating procedures, request/change/incident interfaces, and quality controls
• Partnered with business and IS/OT stakeholders to prioritize demand, reduce operational risk, and improve service reliability

• Developed Taranis AI, an advanced open-source intelligence (OSINT) tool, leveraging artificial intelligence to revolutionize information gathering and situational analysis.
• Created cybersecurity trainings and a cyber range to provide hands-on learning experiences for SOC teams and IT management.
• Designed and implemented a hybrid cloud infrastructure using OpenStack, Terraform, and Ansible, improving the scalability and performance of the infrastructure and led the migration from an on-site only infrastructure to the hybrid cloud environment.
• Some of my current work can be found on GitHub.

• Development of a Custom Jenkins Shared Library (Groovy)

• Integration of security checks in CI/CD pipeline (Shift-Left Approach)

• Automated vulnerability scanning and remediation workflows

• GitOps-based deployments with ArgoCD

• Semantic versioning automation with Git integration

• Container lifecycle management (Build/Scan/Tag/Push)

• ArgoCD webhook integration for event-driven deployments

• Complete cluster automation with Ansible

• Bare-metal Kubernetes installation from scratch

• High-availability control plane setup

• Unified deployment system for multi-application orchestration

• Configuration management according to NIST SP 800-128

• Host security: Linux hardening, SELinux/AppArmor

• Network security: NetworkPolicies, micro-segmentation

• Application security: RBAC, Pod Security Standards

• Data security: Encryption at rest and in transit

• Defense-in-depth principles

• Certificate management with cert-manager

• Secrets management with External Secrets Operator connected to Vault

• Infrastructure monitoring with Checkmk

• Prometheus/Grafana monitoring stack

• Security event detection and logging

• Automated health checks and incident response procedures

• MetalLB load balancing for bare-metal

• Nginx ingress controller with SSL passthrough

• NetworkPolicies for security zones

• Rook-Ceph distributed storage, CNI configuration (Weave Net)

• Container & orchestration: Kubernetes (bare-metal), Docker, Helm

• CI/CD & GitOps: Jenkins (Custom Shared Library), ArgoCD, Groovy

• Automation: Ansible, Bash, Python

• Security: nftables, RBAC, NetworkPolicies, cert-manager, Vault, Sealed Secrets

• Monitoring: Checkmk, Prometheus, Grafana

• Storage & networking: Rook-Ceph, MetalLB, Nginx Ingress, Calico

• Collaboration: Jira, Confluence

• OS: Debian, Ubuntu