Trend Micro Experts in Germany

Creation of concepts for M365 implementation, especially Tenants, EntraID, EntraConnect and ExchangeOnline, taking BAS standards into account (mandatory baseline security requirements) in the project "Concept M365" with the aim of transferring the concepts to the M365 environments of Bitmarck and then handing them over to the customer.

• Creation of a current-state analysis of the existing M365 environments as well as the on-premises environments and the BAS standards.
• Creation of concepts for the topics Tenants, EntraID, EntraConnect and ExchangeOnline taking the BAS standards into account
• Design and implementation of an automated solution for creating standardized M365 tenants based on Microsoft M365 DSC (Desired State Configuration)
• Transfer of the concepts into the M365 environments
• Creation of detailed technical documentation

• Overall coordination of service providers for all infrastructure topics at a production site being set up in Baden-Württemberg
• Design and finding solutions for internet connectivity, building office communication networks, setting up WLAN in production and administration buildings, IP address management, password policies, time tracking, access control systems, backup strategies, emergency power planning, operating concepts, cost planning, event management, workplace setup including laptop/mobile phones/telephony, remote support, print servers
• Selecting suitable external service providers and planning to meet needs for spare parts, repairs, on-site service, network and workplace support including on-site system replacement by providers
• Choosing suitable external service providers for facility management and building technology (fiber optic connections, data center infrastructure, cable ducts etc.)
• Coordination with clients and service providers
• Escalation management, schedule control
• On-site presence for service meetings and managing service providers

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Redesigning cablewise infrastructure with CAT 8.1 keystones, measuring the speed and quality of the new installation with Pockethernet, documentation at a local saddlery
• CAT 8.1 installation and building a data center, site linking, VPN and VLAN configuration for a local car dealership, implementation of IT-Security standards like virus protection (G Data) and firewalling (OPNSense)
• Relocation of a tax office with redesign of the IT infrastructure, virus protection (G Data) and backup solutions (QNAP)
• Planning, conception and implementation of an inhouse data center, BSI-compliant for commercial laundry (including Proxmox-based virtualization of existing infrastructures, QNAP, G Data, OPNSense, APC)
• Implementation and conception of security solutions in the SME sector
• Collaboration on the IT-security concept for the Bremen network of authorities (in the dLAN network)
• Creation of IT-security concept VOIS (modules MESO, KFZ/iKFZ) including audit preparation for KBA
• Expansion of the IT-security concept for the online service for electronic residence registration (eWA) to include use as an eFA (one-for-all) service (nationwide)
• Expansion of the IT-security concept to include modules wos & wvp
• Concept development for the implementation of DIN SPEC 27076 at MSEs and SMEs
• Creation and evaluation of emergency concepts
• Creation and evaluation of response actions and BCM plans
• Assessment of existing business continuity management (ISO 22301)
• Development of BCM strategy options
• Conducting awareness training

• Leading technical stream in IT projects

• Designed and implemented a new user support tower organization as part of the global IT transformation initiative.
• Created an operating and control model for the central service desk, including downstream support units (field service, VIP support, service points).
• Performed a comprehensive as-is analysis of existing service desk and field service structures and developed a target architecture based on ITIL 4 and SIAM.
• Defined roles, responsibilities, and governance mechanisms for internal IT and external providers.
• Prepared the blueprint document Service Management & Governance Handbook (User Support) to standardize global service processes (incident, request, problem, change, knowledge, ITSCM, CSI).
• Developed a KPI and SLA framework to measure service quality and performance in global user support.
• Defined the reporting and review structure (operations meeting, service review meeting, management steering board).
• Prepared RFP documents for the external tendering of L1/L2 support services, including definition of scope, governance model, process requirements, tool integration (ServiceNow), and KPI/SLA sets.
• Supported procurement and legal departments in evaluating and negotiating vendor proposals and assisted in vendor selection and contract finalization.
• Oversaw the handover to operational support, including knowledge transfer, training of provider teams, and establishment of a continuous improvement process (CSI).
• Methods / framework / tools: ITIL 4 / ITSM, SIAM, IT4IT, ServiceNow, Jira, BPMN, operating model canvas, KPI & SLA design, governance & performance management

• Consulting on an ongoing IT security architecture project
• Documenting past progress and planning next steps
• Applying and implementing the BSI IT baseline protection
• Building and maintaining security management systems
• Applying the ISO 27001 standard series
• Integrating ITIL processes into security architectures
• Collaborating with public clients, regulatory authorities and internal and external service providers

• Analysis and optimization of the VMware environment for operation in a critical infrastructure environment
• Planning and execution of updates for the VMware and hardware environment in a critical infrastructure environment
• Deployment of Skyline Health Diagnostics
• Review of existing documentation
• Training and onboarding of new internal staff
• Support for migration and upgrade projects
• Preparation for moving scripts in the virtualization environment to GitLab
• Ticket handling with ServiceNow

• Evaluating and assessing the current state
• Preparing and conducting security audits
• Vulnerability characterization and risk analysis
• Assessing, coordinating and transforming identified vulnerabilities into target states
• Coordinating stakeholder interests
• Developing and implementing IT security strategy for OT and IoT (continuous risk assessment and risk management, awareness, multi-layered security solutions, regular security audits, access restrictions)
• Organizational and technical documentation, presentations and workshops
• Skills: Qualys, Splunk, Nessus, QRadar, National Vulnerability Database (NVD / NIST), Open Worldwide Application Security Project (OWASP), OT, CERT/CC, BSI IT-Grundschutz catalogs, ISO 27001, MITRE ATT&CK, Center for Internet Security (CIS), GitHub, Active Directory, PowerShell, Symantec Endpoint Protection, Microsoft Azure and Office365 App Security, ITSM

• PRISMA project
• Ansible automation
• Windows third level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

• ISMS and security concept for the Fabasoft e-file according to BSI 200-1/2, among others
• Structural analysis (A.1), modeling (A.3), and baseline protection checks (A.4)
• Preparation for OWASP penetration test, incident response plan, risk analysis
• DevOps Bitbucket, ARC42, IAM with Keycloak/AD, multi-tenant setup, DMS, SOC
• Emergency preparedness concept (BSI 200-4), operations and service concept (BSK), ITSM

• Operation and administration of Windows 2016 / 2019 servers and domains
• Infrastructure services (Active Directory, ADFS, AD Azure Connect, DHCP, DNS, Group Policies)
• Consulting, support and troubleshooting of customer systems
• Documentation and concept design in the area of MS Active Directory
• Updating operation, process and system documentation
• Ticket handling (remote analysis and resolution via incident, change and problem management)
• Technologies: Windows 2022, Active Directory, ADFS, AD Azure Connect, DHCP, DNS, GPO, VMware vSphere, CheckMK, Exchange 2019, PowerShell, Jira, Confluence, Office 365, Matrix42, NetApp, Ansible

• Auditing CIS evidence of the SOC providers T-Systems Austria and Cancom GmbH
• Mapping of VAIT, ISO:IEC 27002 and CIS 7.0 requirements for the IT realignment strategy of the German subsidiaries in threat intelligence and zero trust
• Reviewing SIEM evidence, reporting, incident management and security breaches
• Reviewing IT asset management regarding ITSCM and BCM processes
• Employee awareness and compliance training focused on CEO fraud
• Advising the chief information security officer