VLAN Experts in Germany

• Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
• Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
• Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
• Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
• Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
• Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.

Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin

• Leading enterprise BI transformation across Power BI & Microsoft Fabric, delivering scalable data models, automated reporting, and high-performance analytics solutions for commercial and operational leadership.
• Building and optimizing Power BI Dataflows, Fabric Lakehouse datasets, semantic models, and automated reporting pipelines to improve data scalability, governance, and reporting performance.
• Driving dashboard modernization and KPI governance by translating complex business requirements into executive-level insights, interactive visualizations, and decision-ready analytics.
• Designing end-to-end Microsoft Fabric architectures integrating data ingestion, transformation, virtualization, and enterprise reporting across cross-functional business domains with SAP BW to Qlik to Power BI migration.
• Delivering AI-enabled reporting capabilities, threshold-based alerting, and automation frameworks within the Power BI ecosystem to accelerate business decision-making.
• Partnering with commercial leadership, analytics teams, and IT stakeholders to standardize KPIs, optimize BI strategy, and deliver scalable, business-critical reporting solutions.
• Recognized for combining strong stakeholder leadership, technical architecture expertise, and business-driven analytics to deliver impactful enterprise BI transformation initiatives.

Gronic Ident & Sign

Core technologies: Android, Jetpack Compose, Retrofit, Regula Document Reader, Adobe Sign

Android app on dedicated devices for identifications and electronic signatures at the PoS

Task:

• Design and build a proof of concept (PoC) for a future-proof virtualization platform, taking secure system architectures into account
• Assess the current state of existing infrastructures and develop selection and evaluation criteria for the right OS virtualization platform
• Carry out the requirements analysis and then create and prioritize tickets in the ticket system
• Complete and continuously update a tool evaluation matrix based on PoC results
• Support team knowledge building through clear documentation of the approach and results in Confluence
• Enterprise analysis of existing hardware (creating different BoMs)

Technologies: Vmware, Vmware Aria Operations, Osism, Canonical OpenStack, FishOs, Linux, Terraform, Ansible, Confluence, Alma

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

• Design and build of a fully isolated AWS offline environment with no outbound internet access for running a browser-based business application
• Design and implementation of a proxy and response service that terminates all external application calls inside the VPC and serves them from locally stored content; identification of the actual communication needs through measurement-based DNS query logging
• Creation of architecture designs and decision papers including a comparison of options (Application Load Balancer with Lambda and S3, reverse proxy on EC2, private API Gateway) assessed by operational effort, cost, and availability
• Transfer of the solution and operations documentation previously available only for Azure to an AWS target architecture, including reassignment of all services and operational processes
• Automated rollout as Infrastructure as Code (Terraform, CloudFormation) with CI deployment via GitHub Actions, plus setup of private DNS zones and an internal certificate chain for operation without internet access
• Creation of architecture, deployment, and operations documentation and handover to the customer
• Build-up of a private cloud platform on OpenStack at provider TelemaxX with Terraform, including FortiGate HA clusters, FortiManager, and Kubernetes
• Introduction of Policy as Code (Open Policy Agent, Conftest) as well as development of MCP servers (Model Context Protocol) to connect AI assistants to operations and project tools

Successes:

• Made the business application fully operable without internet access for the first time; the cause of the loading error was narrowed down systematically to missing CORS headers after the likely certificate issue was ruled out
• Fully transferred an existing Azure concept to AWS and replaced the manually created environment with a reproducible, CI-based rollout

Technology stack: AWS (VPC, Application Load Balancer, Lambda, S3, Route 53 private hosted zones and Resolver query logging, IAM, CloudWatch, EC2, CloudFormation), Infrastructure as Code (Terraform, CloudFormation, Remote State), CI/CD (GitHub Actions with OIDC, Azure DevOps Pipelines), OpenStack, FortiGate, FortiManager, Kubernetes, Policy as Code (Open Policy Agent, Conftest), offline and air-gap architectures, PKI & certificates (internal CA, TLS, CRL/OCSP), DNS, network segmentation, Linux, Windows Server, Python, Bash, PowerShell, YAML, JSON, architecture design & decision papers, documentation (Confluence, Markdown), Generative & Agentic AI (Model Context Protocol, Agentic AI Coding Tools)

Project: Neura Belden BHVA (Belden HI vision Virtual Assistance)

• Translated AI agent concepts into 4 distinct user workflows (General, Redundancy, Network, VLAN agents).
• Designed 6 game-changing features with technical specifications: Predictive Issue Resolution, Cost Optimization Engine, Compliance Automation, Cross-Agent Orchestration, Knowledge Transfer Mode, Root Cause Analysis 2.0.
• Contributed reusable UX patterns and lightweight standards for experimentation-first AI environment: single-file HTML/CSS/JS prototypes, semantic accessibility, responsive grid layouts, and clear component structure enabling rapid future POC iterations.
• Translated early AI concepts into intuitive user workflows and interaction models for 4 specialized agents, focusing on clarity, trust-building, and progressive disclosure to surface complex AI capabilities.
• Documented design trade-offs in accessible language for non-designers.

• As-is assessment of the current network infrastructure and its documentation, including on-site inspections
• Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
• Planning of new copper and fiber optic cabling, including patch panels
• Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
• Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
• Additional support after the components go live (hypercare phase)
• Regular communication with project management and client stakeholders

• Optimization of the transmission media of the data links in the Ruhr area
• Configuration/expansion of switches and routers for an autonomous system AS
• Improve the network protocols used Layer 2/3 (OSI model), RSTP, broadcast, etc.
• Laying cables, crimping, antennas, routers, switches
• Maintenance, expansion, selection and prioritization of troubleshooting measures for network monitoring (PRTG, The Dude)
• Organization and new connection of another BGP peering, data center, NGN fiber optic
• VPN IPSec site connections for 6 sites with PFSense, Fritzbox
• Configuration of WLAN devices (Mikrotik, UBNT

Label: TCP/IP, VLAN, BGP, OSPF, MPLS, VPLS, routing protocols, WLAN, EoIP, PPPoE, routing, SNMP, DHCP, DNS, NAT, native IP, VLAN, Ethernet, VoIP., switches and routers from: Nortel, Cisco, MikroTik, UBNT., network management systems: The Dude, PRTG, UISP

Participation in various projects related to the development and introduction of new telecommunications products in the mobile communications and fixed-line sectors, with a focus on 5G, wholesale and IPv6 technologies.

• Planning, coordination and execution of product development projects, particularly in the 5G and fixed-line environments
• Support for the rollout of new offerings, including test management and quality assurance
• Participation in the development of wholesale products and eSIM solutions
• Close coordination with internal departments (technology, marketing, operations) and external partners
• Use of agile tools and methods for project management and collaboration

Tools: JIRA, MS Office, MS Project

Technologies: 5G, 5G Campus Networks, Fixed Network (FixNet), IPv6, eSIM, Wholesale product development

CS-APN 5G NSA – IPv6 / Dual-Stack for B2B Customers

Ensuring the use of CS-APNs in dual-stack mode (IPv4/IPv6) in combination with MPLS VPN and IPSEC VPN.

• Project management including test planning, test coordination and go-live management
• Technical coordination for activating IPv6 functionality for B2B connections

eSIM Manager – Product Development for B2B Customers

Development of a tool for the fast and scalable provision of eSIM profiles for business customers.

• Product design and process definition for activating eSIMs on different device types (smartphones, IoT, laptops)
• Collaboration with partners to integrate the solution into existing infrastructures

eSIM Handling B2B – Blanco eSIM Process Integration

Optimization of the eSIM provisioning process through the introduction of dynamic Blanco eSIM processes.

• Definition of new processes for issuing non-activated eSIMs (Blanco) via the frontend and partner community
• Design of the integration into service and IT systems

All-IP 5G NSA – Mobile Access for B2B Internet/Voice Services

Expansion of the All-IP portfolio with mobile 5G access offering higher bandwidth for business customers. (5G Indoor Coverage).

• Project management including test management and go-live preparation
• Interface coordination for introducing Local-SIM-based solutions

5G PN – Campus Roaming / Private Networks

Development and introduction of 5G Private Network (PN) solutions with a focus on industrial applications (IIoT).

• Design and definition of business use cases
• Development of SIM/eSIM processes for 5GPN, including roaming between private and public networks

IPv6 for B2B – Introduction in Mobile and Fixed-Line Products

Introduction of IPv6 support for All-IP products and M2M services in the B2B environment.

• Product and process development for integrating IPv6 (in accordance with RIPE-554)
• Implementation for large customers such as retail chains with several thousand branches in Germany and abroad

• Requirements analysis and replacement of local SharePoint as CMDB with open source NetBox to prepare for deploying Cisco ACI (SD-WAN) with Microsoft Azure
• Coordination with systems like Checkmk and Grasp
• Introduction and coordination of cmdbsyncer as CMDB data hub; further development of the syncer with Kuhn & Ruess GmbH
• Implementation of SNMPv3 on AIX LPAR/VIO, Linux, Windows, SAN/storage, network components (Cisco switches, F5 load balancers, Palo Alto and CheckPoint firewalls, iLO boards)
• Deployment and further development of the network scanner JDisc in cooperation with the vendor (Utimaco HSMs, Linux detection)
• Integration of NetBox, JDisc, and cmdbsyncer into the infrastructure using Docker containers
• End-user training: preparation, creation of materials, and delivery
• Creation of data flow and network diagrams
• Population and planning of IPv4/IPv6 with NetBox including VLAN import
• Dual-stack setup of servers and clients with IPv4 and IPv6
• Connection of REST interfaces for Checkmk, JDisc, vSphere, HMC, i-doit, NetBox Software: Confluence, Jira, MS Office 365, Teams, i-doit, NetBox, JDisc, cmdbsyncer, DB Visualizer, vSphere, HMC

Self-employed consulting, implementation, and support of IT infrastructures with a focus on IT security, network and server administration, virtualization, backup & recovery, IT documentation, asset management, and business continuity management.

• IT security consulting and implementation of technical protective measures
• Windows server and client support, patch management, user support
• M365 – Entra ID – MS Azure administration
• Planning, installation, and operation of LAN, WAN, WLAN, and VLAN infrastructures, Cisco, HP, Netgear, Sophos, Securepoint
• Support of virtual systems based on Hyper-V, VMware, and Proxmox
• Backup and recovery concepts including test recovery, documentation, and handover
• Introduction and maintenance of IT documentation, asset management, and inventory tracking
• Implementation of measures related to IT baseline protection, emergency manuals, and BCM
• On-/offboarding concepts with a focus on permissions, devices, data access, and handover processes

Security awareness and practical sensitization of users and IT staff

• Analysis of requirements and the current situation
• Migration of an old domain structure and Tobit to Exchange 2019 with connection to MS365
• Review of implementation options and planning for the protection of sensitive data
• Planning with regard to BSI Grundschutz, BDSG, and DSGVO
• IT governance and IT security backtests
• Support with ERP setup and securing mail transfer
• Hyper-V 2016/2022, Microsoft Terminal Services Cluster, Microsoft Exchange 2019
• Office 365, Microsoft 365, Azure AD, Teams, Salesforce
• Cisco, Zyxel, and HP switches, Sophos firewalls/UTMs, SecurePoint
• Microsoft IIS 2022, IPv4/IPv6, Veeam, Wortmann Online Backup, NextCloud
• Services: DNS, DHCP, TCP/IP, subnetting, firewalling, routing, VoIP, group policies (GPO), SIEM, remote work, home office, high availability, failover, VLAN, PRTG

• Mobile Device Management (MDM) for iOS devices (iPads, iPhones)
• Management, configuration and rollout of policies, apps and security measures
• eSIM setup & management as well as management of mobile plans and contracts
• User management (create, block, delete) in the SecurePIM security solution
• Device registration, preparation and setup of devices with Windows 10/11 and peripherals
• 1st & 2nd level support and handling of IT requests via the ticket system
• Troubleshooting, fault isolation and repair of devices
• Creating and maintaining guides, training new users and handling user questions