Threat Intelligence Expert in Germany

• Creating concepts and architecture for domain integration (SEAT into the VW structure)
• Domain trusts and administration
• Operation and administration of Windows 2022/ 2025 servers and domains
• Domain restructuring
• GPO and SG editing and migration
• DNS restructuring and migration

Technologies: Windows 2022, Active Directory, ADFS, AD Azure Connect, DHCP, DNS, GPO, VMWare vSphere, Hyper-V, Powershell, Jira, MS Office 365,), SCCM, VSAN Fileservices, Approximately 800 servers, 400 users

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

Managing Director | Omnia Kassel UG

Corporate management, international business development, technology and innovation management

• Corporate management and international business development: Strategic and operational management of a technology-oriented consulting company. International B2B business development, development of new business areas, and establishment and maintenance of industrial, technology, and procurement partnerships.

• Technology and innovation management: Identification and evaluation of new technologies with regard to technical feasibility, commercial potential, and practical applications. Development of innovative business models, technology transfer, and support for demanding innovation projects.

• Development and project management: Design, planning, and management of technical development, procurement, and customer projects. Technical specifications, international supplier selection, coordination of external development partners, and evaluation and implementation of customer-specific solutions.

• AI research, systems development, and technology evaluation: Early recognition of the fundamental technological change brought about by generative AI. For around four years, self-initiated, almost daily intensive research, development, and testing work with leading language models, multimodal AI systems, and different model generations. Independent design and testing of around 200 complex AI workflows, multi-agent methods, and book, proposal, and evaluation agents.

• AI-supported customer projects and multimodal production: Practical implementation of proprietary and confidential customer assignments in technical design, project development, proposal preparation, specialist texts, and comprehensive documentation. Development and production of texts, images, animations, videos, speech, and avatar applications. A total of around 750 productive work results from various AI-supported projects.

• AI quality assurance, process development, and efficiency improvement: Development of multi-stage, cross-model testing and correction procedures with source comparison, independent review, and systematic error analysis. In own task-specific comparative measurements, reduced selected processing times from eight hours to one hour and improved measured accuracy from about 95 % to up to 99 %. Transfer of the findings into productive work processes and commercially usable customer solutions.

Project-based activity and availability: The entrepreneurial activities are organized on a project basis and are not connected with permanent full-time operational utilization. Therefore, there is substantial time available for external consulting, development, and management assignments, including projects with a high workload.

• Clarification of project objectives, scope and the target business vision for building the AI-based knowledge database.
• Derivation of the initial architecture and implementation strategy for the Zasterbot chatbot, including separation of the MVP and further development stages.
• Development of a target business vision for building a structured knowledge database and integrating a future chatbot.
• Derivation and prioritization of use cases for information retrieval and provision by the chatbot.
• Modeling of data structures and flows for the effective organization of the knowledge database on the Base44 platform.
• Design and implementation of data models for storing and linking relevant information.
• Development of processes for extracting, analyzing and preparing raw data for the knowledge database.
• Ensuring data consistency and quality as the basis for the future chatbot.
• Planning the integration of Large Language Models (LLMs) and Retrieval-Augmented Generation (RAG) for precise and context-specific answers.
• Implementation of functions for analyzing and displaying data from the knowledge database.
• Use of the Base44 platform with JSON Schema-based entities and a flexible permission concept.
• Implementation of Deno functions for backend logic, event processing and connecting external APIs.
• Integration of OpenAI services for initial data analysis.

• Advised the executive team on the strategy, architecture, and development of an AI-powered Product Security Operations Center (PSOC); a cybersecurity operating system for software-defined cyber physical connected systems.
• Provided strategic guidance on product vision, regulatory alignment, and market positioning, supporting capabilities across threat intelligence, vulnerability management, compliance automation, and autonomous product security.

Conversational AI assistant for cloud infrastructure and security queries

• Designed FastAPI backend with multi-turn conversation handler, token budgeting, and context window management.
• Integrated Amazon Bedrock (Claude 3 Sonnet/Haiku); built RAG pipeline with MongoDB chat history and semantic search.
• Implemented Factory Pattern for modular LLM provider switching; reduced model onboarding effort by 60%.
• Reduced LLM inference cost by 35% through model tiering (Haiku vs Sonnet) and prompt/entity consolidation.

Tech: Python, FastAPI, Amazon Bedrock, MongoDB, Streamlit, Pydantic.

Technology company

• Analysis of CRA requirements
• Management workshop
• Development of recommendations

Result: Prioritized CRA readiness plan for compliance.

• Identified and resolved AUTOSAR violations in master code to ensure compliance with automotive software standards
• Verified product requirements against implementations using DOORS, ensuring full traceability and alignment with ISO 26262
• Managed and refined JIRA tickets, documented processes in Confluence, and maintained version control via GIT/Bitbucket
• Performed post-rebase code cleanup and validation across branches to maintain consistency in automotive software development
• Applied quality management principles to ensure compliance with automotive SPICE/ASPICE processes, including DSP and audio-related software validation
• Leveraged knowledge of Xtensa chips for low-level optimization in automotive C/C++ embedded systems

• Responsible for the configuration, maintenance, monitoring, troubleshooting, and optimization of the IT infrastructure, including Extreme Networks, SD-WAN, and Fortinet security solutions, at all international company locations in Europe and North America
• Development of a comprehensive strategic roadmap to optimize the network architecture, including VLANS, NAC, QoS, firewall configurations, VPNs, DPI, NGFW, threat intelligence, and SSL/TLS inspection
• Implementation of the OneIT strategy through the introduction of new technologies such as Cisco DNA Center, ExtremeCloud IQ, FortiOS, FortiManager, and FortiAnalyzer, which increased employee skills and the efficiency of the IT systems
• Integration of IT and OT systems to optimize the network and security architecture and improve operational efficiency

• Led a highly complex and extensive Change the Bank project focusing on third-party risk management

• Guided and supervised up to 15 qualified consultants

• Defined and regularly reviewed the status of required measures to address audit findings in third-party management

• Ensured and verified banking regulatory compliance (BAIT, MaRisk, DORA, BSI Standards, ISO 27001, NIST Cybersecurity Framework) of processes and artifacts

• Coordinated validation of project artifacts with internal audit

• Supported mitigation of identified deviations

• Prepared documentation for deregistration of the corresponding finding with BaFin

• Coordinated with stakeholders in the group for approval of deregistrations

• Prepared, accompanied, and regularly independently reported project status to the board and C-level executives

• Introduced agile (SCRUM) project management

• Supported a six-month RfP and POC process for a SaaS solution for third-party management

• Assisted in implementing the SaaS solution and consolidating data from various source systems into the new SaaS

• Completed 25+ hands-on labs focusing on digital forensics, incident response, and advanced threat hunting techniques.
• Earned top-tier badges in malware analysis, enterprise log analysis, and threat intelligence gathering.
• Developed specialised skills in forensic report writing and evidence collection methodologies to support incident investigations.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• As part of the project, I was responsible for operating a Citrix farm for 600 users, including optimizing the user experience and ensuring high availability.

• I managed and optimized the entire application landscape of a major customer, evaluated and implemented application updates, and ensured the compatibility and security of the software in use.

• I managed user accounts, implemented security policies, and monitored system performance.

• I administered Azure Entra ID to control identities and access rights, implemented security policies, and synchronized on-premises directories with the cloud.

• I implemented and managed Microsoft Intune for central management of client devices, including the configuration and management of BitLocker for disk encryption.

• I managed file servers and NTFS permissions to ensure secure and efficient data access management.

• I handled change requests and last-level support tickets efficiently to solve complex system issues and improve user satisfaction.

• I supported and advised the customer team on various topics and projects, identified areas for improvement, and implemented best practices.

Technologies used:

• Citrix XenApp and XenDesktop
• Microsoft Windows Server 2012R2 and 2022
• Exchange 2016 and Exchange Online
• Entra ID (Azure AD)
• Entra ID Connect
• BitLocker
• PowerShell scripting
• Microsoft Intune
• LDAP (Lightweight Directory Access Protocol)
• DNS services (Domain Name System)
• Active Directory Certificate Services (AD CS)

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action