Web Application Firewall Experts in Germany

• Architected the Yatta Integration Layer – a config-driven integration platform on Java 25, Spring Boot 4 (WebFlux), Temporal, gRPC and Kafka, enabling new third-party integrations (e.g. AVS fulfillment) via declarative JSON configs with zero code changes.
• Designed and implemented Tink integration with 0Auth IBAN verification to enhance fraud prevention and account validation workflows with Adyen payByBank.
• Architected and implemented an OpenFGA-based authorization model for centralized management of users, groups, and fine-grained access control in the vendor portal.
• Architected and led delivery of the Yatta API Gateway platform using GraphQL Federation, providing a unified enterprise API layer across distributed microservices with centralized authentication, authorization and request orchestration.
• Replaced NGINX + NLB with Istio service mesh and AWS ALB; rolled out WAF, OAuth (Cognito), IP whitelisting and RBAC across environments.
• Migrated CDC from Confluent Cloud connectors to a self-hosted Kafka Connect + Debezium stack, reducing operational cost by ~80% across multiple environments.
• Implemented the Transactional Outbox pattern with Debezium for reliable, exactly-once event publishing to Kafka with Avro and Schema Registry.
• Migrated dunning/payment-recovery workflows from Airflow to Temporal, achieving 99.9% reliability for settlement handling.
• Optimised Apache Airflow with deferrable sensors to handle 1000+ concurrent DAG runs without scaling the worker pool.
• Refactored a monolithic Terraform codebase into 3 modular projects, cutting deployment time by ~45%.
• Stood up full observability with OpenTelemetry, Tempo, Prometheus and Loki; automated dev/staging/prod with ArgoCD, Image Updater and Helm.
• Collaborated with product, operations and engineering stakeholders to define scalable platform architecture and integration standards aligned with long-term business and operational goals.

• Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).

• Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.

• Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.

• Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.

• Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.

• Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.

• Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.

• CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.

• Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.

• Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.

• OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.

• Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).

• Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.

• Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.

• Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.

• SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.

• Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.

• Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.

• CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.

• Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.

• Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.

• Optimization of software lifecycle processes for SAP platform apps (BTP CAP)
• Development of template MCP servers for S/4 CALM systems of Porsche AI (BTP)
• Design, development, and IT product management for two MS CoPilot custom agents supporting SAP systems (incl. MCP integration)
• Lead Center of Practice: AI-assisted ABAP development
• Initiation and coordination of the proof of concept implementation of conduct.ai
• Advising application teams on software and integration architecture, clean core principles and implementation, as well as AI use on the SAP platform

Conceptual design and implementation of a modular customer portal based on Laravel.

The focus was on defining a maintainable system architecture with broad use of Domain-Driven Design principles (within the Laravel architecture), introducing automated quality assurance processes (test strategy, CI integration), and preparing an auditable operation (logging, traceability of changes) in an AWS-based infrastructure, taking IT security standards according to NIST and process requirements according to ISO 9001 into account.

Achievements:

• Analysis and structuring of business requirements in close coordination with stakeholders
• Documentation of the system architecture and infrastructure incl. change and release management
• Design and implementation of an interface for integrating SAP systems
• Planning and implementation of automated tests for quality assurance
• Implementation of security and compliance requirements, including SBOM generation, software license management, and QA processes
• Technical consulting and support for the internal IT team
• Introduction and establishment of AI-supported development processes (Spec-Driven Development), including AI-readable specifications, integration of AI instructions into the development environment, and training developers for productive use

Technologies and tools: SAP, Docker, ddev, PHP 8.4, Laravel, Filament, C4 Model, Architecture Decision Records (ADR), Mermaid, PlantUML, Spec-Driven Development, Claude, GitHub Copilot, Codex

• It is like a startup within REWE, where we have to build a new forecasting system on Google Cloud Platform from the scratch. Although, officially my role is called MLOps, my actual tasks also include development of data processing pipelines (data engineering) and data scientists tasks such as feature engineering and model trainings.
• GCP: Terraform (tofu), Vertex AI (Kubeflow), Cloud Run, IAM, Google Cloud Storage, BigQuery, Artifact Registry
• Data engineering: Snowflake as the main data warehouse, Terraform, DBT for data model implementations
• CI/CD: GitLab. We have built a CI/CD pipeline that automates deployments of new releases up to production environment

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Integration of Post-Quantum Cryptography (PQC) algorithms into high level protocols.
• Security of implementations of Post-Quantum Cryptography algorithms.
• Transition to Post-Quantum public key infrastructures.
• Security evaluations of Post-Quantum Cryptography (PQC) primitives.
• Drone Cybersecurity
• Satellite Cybersecurity
• AI Security

• Support of firewalls (Securepoint)
• Operation and maintenance of the client-server infrastructure (Windows)
• Operation and patching of IoT devices in the hazard management system (cameras, Web IOS, IP serial converters)
• Support with the integration of security technology into existing IT infrastructures
• Planning and execution of network segmentation and separation
• Transfer and implementation of solutions to other plants
• Tools used: Wireshark, Network Service Manager, PRTG, Cisco Catalyst, Nexus, HP Service Manager, FNT/Command Manager Console, ServiceNow, Confluence, Active Directory, Wingard, Securepoint FW

• Integrated LangChain middleware between AEM and SAP PIM system
• Developed a FastAPI interface for system communication
• Implemented vector embeddings for semantic product search
• Evaluated LLM models (Vertex AI/Gemini, LM Studio, Hugging Face, OpenAI) for product analysis
• Developed an AEM component to display product recommendations and integrated the recommendation API into the AEM authoring process
• Designed and implemented Pinecone vector database for product embeddings
• Optimized response times and caching strategies
• Evaluated Vertex AI Studio for LLM testing and prompt workflows
• Implemented secure API routing and access control for AI components via FastAPI and gateway validation

• Cloud Computing Fundamentals & Architecture: Expertise in core cloud concepts, including the three main Service Models (IaaS, PaaS, SaaS) and diverse Deployment Models (Public, Private, Hybrid, Multi-cloud).
• Modern Application Deployment Strategies (GCP Focus): Instruction on the GCP Application Hosting Spectrum, covering Virtual Machines, Containers (Kubernetes and Cloud Run), Platform as a Service (App Engine), and Serverless Computing (Functions as a Service - FaaS).
• Data Management & Big Data Analytics: Comprehensive coverage of Cloud Storage options (Object, Block, File) and Database solutions, including Relational (Cloud SQL), NoSQL (Firestore, BigTable, Memorystore), and serverless enterprise data warehousing (BigQuery).
• DevOps and Infrastructure Automation: Skills in DevOps principles, including Continuous Integration (CI), Continuous Delivery (CD), Infrastructure as Code (IaC) using tools like Terraform, and implementing effective Monitoring and Logging for system observability.
• Emerging Technologies & Responsible Cloud Use: Focus on crucial topics like Cloud and IoT Security, Identity and Access Management (IAM), data privacy, and the ethical considerations of cloud and massive data collection.

• Responsible for setting up and configure AWS Organizations and Control Tower on company's master organizational account
• Administer and maintain various AWS services, including EC2, S3, RDS, Lambda, VPC, IAM, etc.
• Monitor system performance, availability, and capacity planning to ensure scalability and reliability
• Implement and maintain infrastructure as code (IaC) using tools like CloudFormation or Terraform
• Work closely with development and operations teams to automate deployment processes using CI/CD pipelines (e.g., Jenkins, GitLab CI/CD)
• Develop and maintain scripts for automating routine tasks and infrastructure provisioning
• Implement automation for monitoring, logging, and alerting to ensure timely incident response
• Implement and enforce security company guidelines and best practices for AWS environments
• Configure and manage AWS security services such as AWS Identity and Access Management (IAM), AWS WAF, AWS Shield, etc.
• Collaborate with the Security Team to improve and update security policies and posture
• Collaborate with development teams to provide agile deployments and optimize application performance and reliability on AWS
• Provide technical support and guidance to internal teams on AWS-related issues and best practices
• Participate in cross-functional projects to enhance overall infrastructure and operational efficiency

• The replacement of the existing archive system (document management system – DMS) on a host-based platform is well advanced.

• The internal audit is meant to ensure the company's quality standards.

• GDPR

• ISO 27001 ff.

• BSI

• DORA

• Patient data regulations

• Host / Cloud / S3 / Container / highly scalable / Nuxeo

• Budget: 50,000

• Team: 1

• Migrated backups and full workloads to AWS and Azure, including setup and management of AKS & EKS clusters.
• Automated infrastructure with Terraform & ArgoCD and implemented CI/CD pipelines with GitLab.
• Monitored systems on OpenShift 4 (on-premise) with Grafana & Prometheus, using CloudWatch and X-Ray for analysis and logging.
• Built and maintained secure network infrastructures (VPCs, SGs, WAFs, ACLs), integrated Azure Log Analytics.
• Collaborated closely with infrastructure and development teams, maintained technical documentation with Confluence, handled tickets via Jira, and promoted cloud knowledge within the company.

• Conceptual consulting for securing business processes
• Consulting on planning and implementation of IT and IT security projects
• Security and policy checks, process optimizations, emergency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept for Digid GmbH.
• 2025: Consulting a client after a cybersecurity attack that compromised the IT infrastructure and where the attacker obtained M365 tenant admin rights. Investigated the IT infrastructure and restored it. Developed recommendations to improve IT security.
• 2025: Continued the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Created a DNS concept including advice on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones, and automation. Created a DHCP concept including advice on DHCP design, a central DHCP management system and automation. Advised on operating the mentioned products, the operational processes, and updated IT documentation and IT service descriptions for Thyssenkrupp Marine Systems.
• 2024: As-is analysis and assessment of the network and security infrastructure established by providers in terms of overall architecture including design and components. Designed solution proposals to improve current operations for performance and security maximization as well as complexity reduction. Presented the results to C-level, their causes and possible solutions including required decision templates. Developed a SASE concept based on a zero-trust architecture for Norddeutsche Landesbank.
• 2024: Continued the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proofs of concept for DDoS protection and digital experience monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on zero trust, redesigning a Cisco ISE implementation, and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continued the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Federal Institute for Geosciences and Natural Resources (until 05/2023), and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Created and reviewed whitepapers for infrastructure and security architectures, and planned new network infrastructures for the German Aerospace Center.
• 2022: Developed a concept for the technical and procedural modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Developed a concept for migrating measurement data to a cloud environment, introduced network access control, and conducted an awareness training for Digid GmbH.
• 2022: Developed a network segmentation concept for DZ Hyp AG.
• 2022: Developed a network segmentation concept for the Federal Employment Agency.
• 2021: Developed a new load balancer architecture concept for Bundeswehr Fuhrparkservices GmbH.
• 2021: Conducted a vulnerability scan and penetration test of a web frontend including analysis and recommendations for remediation considering risk and likelihood for the client ifi GmbH.
• 2021: Consulting, design, and subproject management for implementing a network access control solution (certificate authentication and MAC address bypass) and macro segmentation (area and zone concept based on dynamic device assignment) in office and production IT for Vaillant Group GmbH.
• 2021: Upgraded and optimized LAN and WLAN infrastructure for United Nations Volunteers.
• 2021: Developed a target concept for modernizing the IT security infrastructure including the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet connections, admin and management networks, and the wireless LAN, including overseeing implementation for the Federal Institute for Geosciences and Natural Resources.
• 2021: Created a micro-segmentation concept based on Cisco DNA, SGT, and zero trust for Union Investment IT-Services GmbH.
• 2021: Reviewed and updated ISMS level 3 policies and created procedure instructions for Software AG.
• 2021: Project lead for the global tech refresh project Meraki WLAN 2.0, coordinated the outsourcing of LAN/WLAN infrastructure to a managed service provider, and created a WLAN concept for automated guided vehicles for Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the 'Transition of SIEM/SOC Services' project migrating a client to a shared environment, and took on the interim role of Head of Security Operations at Datagroup SE.
• 2021: Conducted a workshop for the future implementation of mobile device management for Allgeier Experts Go GmbH.
• 2021: Subproject management for implementing a firewall rule management tool and recertifying NAC endpoints based on 802.1x and MAB for Union Investment IT-Services GmbH.
• 2020: Developed a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recorded and analyzed the current network architecture including project initiation.
• Designed a micro-segmentation concept in the data center and access network.
• 2020: Infrastructure and security architecture audit for Stuttgarter Versicherung AG.
• Analyzed the IT infrastructure and security architecture regarding network and security component configurations. Also reviewed contracts, process documents, and manuals for completeness. Developed recommendations to improve the stability and operation of the infrastructure. Created a network segmentation concept and led the project to implement the measures from the audit.
• 2020: Consulting on setting up an ISMS-light for Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for Datagroup SE.
• Developed a future IT infrastructure and IT security architecture.
• Documented the current IT architecture of all 23 entities.
• Made recommendations to optimize the IT infrastructure and drafted a comparison of a traditional perimeter security concept versus a zero trust model.
• Created a security zone concept.
• Designed an IT infrastructure architecture in coordination with all entities.
• 2018 - 2019: Stream lead in the cybersecurity program at Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network segmentation and access control.
• Project area: Security architecture.
• Project area: Privileged, identity & access management.
• Project area: Simplify user authentication (MFA).
• Project area: Mobile & endpoint security.
• Project area: OT security.
• Project area: E-enabled aircraft.
• 2018: Security architecture consulting for Deutsche Lufthansa AG.
• Project management for the development, evaluation, and management of the company-wide information security architecture.
• Developed a security strategy and a roadmap to align the security architecture with the zero trust model.
• Evaluated market security solutions, services, and tools.
• Defined requirements for RFPs and assessed proposals.
• Developed, maintained, and monitored security architecture artifacts.
• Conducted security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for GLS IT Services GmbH.
• Advised on implementing and initially operating an ISMS based on ISO27001.
• Audited the IT environments of GLS country subsidiaries.
• Analyzed and assessed IT security risks and derived necessary measures.
• Developed solution proposals in coordination with relevant stakeholders.
• Managed the project and handed over the ISMS to operations.
• 2016 - 2018: Security pre-sales consultant for Cisco Systems GmbH.
• Provided nationwide strategic and conceptual consulting to major enterprise and financial and insurance clients on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch, and ISE.
• 2017 - 2018: Designed and implemented an ISMS for Verivox GmbH.
• Conducted various BIAs and gap analyses.
• Developed security policies based on ISO 2700x.
• Served as interim information security officer.
• 2017: Developed an emergency concept for VPV Lebensversicherungs-AG.
• Reviewed and updated the IT emergency manual.
• 2016: Consulting and project management for designing cloud & hosting services for Vodafone Group Services GmbH.
• Analyzed and optimized the sell-build-run process.
• Created detailed level designs for cloud products.