Zero Trust Experts

• Development of a system for capturing, storing, and using knowledge
• Assessment of the current status and requirements for capturing employees’ tacit knowledge
• Creation of the appropriate taxonomy for the individual specialist areas
• Establishment of a suitable technical architecture
• Conducting expert interviews with the help of Artificial Intelligence (AI)
• Concept for data backup
• Analysis and evaluation of the approach and results
• Incorporation of organizational changes

• Strategic planning, detailed technical preparation and operational management of an email gateway migration in a security-critical government environment.
• Preparation of the technical specification and development of technical concepts and migration approaches in line with BSI requirements.
• Technical requirements management with business units, information security and operations.
• Coordination of external service providers, integrators and implementation partners; maintenance of project plans, milestones, resources, risks and dependencies.
• Regular reporting to project management, the program environment and internal stakeholders.

• Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
• Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
• Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
• Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
• Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
• Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.

Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin

Temporary employment

• System black-box integration tests (BBIT, IVVQ): Execution of regression, release, confirmation and conformity tests for safety-critical braking control units in the railway industry
• Software Test Application & Integration: Runtime configuration of software components and libraries, validation of interfaces, configuration dependencies and component interactions
• Test Automation (FEAT Framework): Co-development and further development of an automated test framework for test execution, reporting and result analysis
• Functional Safety (SiL4, FuSi): Ensuring compliance with safety requirements, traceability and coverage as well as conformity with EN50126/28/29
• Test Automation for Communication Components: Configuration and validation of fieldbus (CAN) and Ethernet-based TCMS data communication interfaces (TRDP and CIP)
• Requirements Analysis & Shift-Left (PTC Windchill ALM): Analysis of software and system artifacts to identify gaps, ambiguities and redundancies early in the SDLC
• Test Design & Test Case Development: Derivation of test conditions and coverage strategies and implementation of data-driven test cases (DDT) including reusable test data fixtures
• CI/CD & Automation (Python, PowerShell, Jenkins, SVN): Automation of build, test and HIL deployment processes as well as integration into CI/CD pipelines
• Test Data & Configuration Management (XML): Maintenance and adjustment of XML test vectors and system configurations with automated integration into test environments
• Non-Functional Testing: Execution of performance and load tests to assess stability and system behavior
• Agile Development & Defect Management (JIRA, Confluence): Work in Scrum teams, test coordination, review of test artifacts as well as defect tracking and root-cause analysis
• Error Analysis & Debugging (CANoe, CANalyzer): Analysis of errors and message flows across multiple system levels (application to bus)
• Model-Based Analysis (UML, Enterprise Architect): Specification of SUT/SOW and support for systematic test control
• Process & Test Documentation: Creation of integration and test documentation according to internal quality and certification requirements

• Built an MCP (Model Context Protocol) layer for Mwanachama's agency service, turning domain manager methods into callable AI-agent tools. This included a composite tool that builds a full organization design (org chart, goals, workflows, RACI matrix) from one specification.
• Built the chat-driven agency builder (Wakala Studio and API), where an organization describes its structure in natural language and an AI agent uses those tools to construct and modify the live design.
• Added an insights service so an organization can review AI-agent interactions and completed work. Insights from that review feed back into solution design, gated by architect and user sign-off.
• Alongside this, designed and built the platform itself: ~20 Go microservices on PostgreSQL, Flutter and React clients, deployed on Kubernetes.
• AI agents scan the platform autonomously for security gaps and run scripted tests, covering API (Postman-style) and UI testing. The rest of the work stays supervised. No rogue agents, promise.
• Building an AI-native enterprise platform that structures organizational data, workflows and responsibilities for both people and AI agents.
• Models accountability through RACI, allowing human and AI participants to take different operational roles, including Responsible, Accountable, Consulted and Informed. AI agents can also take controlled approval roles where the organization assigns that responsibility.
• Extended the organizational and operational-risk themes from my Executive MBA thesis into software, making roles, processes and controls explicit and machine-readable.
• Structures enterprise context so LLM interactions use more relevant information instead of repeatedly processing large amounts of unstructured content.

Cloud Journey Kickoff on STACKIT

• Helped the client kickstart their cloud journey on sovereign EU STACKIT platform.
• Bootstrapped IAC & GitOps architecture with Opentofu and ArgoCD.
• Setup platform fundamentals for a fresh, holistic cloud experience: Kubernetes, external secrets, certificate management, gateway API, DNS & routing, observability basics.

• Optimizing and accelera­tion of our Gitlab CI pipeline

• Conceptual work for the PoC of the Zero Trust system

• Extension of the policy-engine backend in Go

• Extension of the policy-testing mechanism in Python

• Architectural design of the PEP component of Zero Trust

• Documentation of the product

• Technologies: Zero Trust, Go, Python, Gitlab CI, Docker, JWT, Domain-Driven Design

Gronic Ident & Sign

Core technologies: Android, Jetpack Compose, Retrofit, Regula Document Reader, Adobe Sign

Android app on dedicated devices for identifications and electronic signatures at the PoS

Europe-wide re-platforming & centralization

• Independently created the migration concept and implementation plan for the Europe-wide centralization and consolidation of IT services for around 20 European companies as part of a re-platforming program.
• Migration assessment: analysis of the existing IT, infrastructure, application, and service landscapes of the companies as the basis for the migration strategy.
• Development of the centralized target vision and target architecture based on a modern technology stack, taking platform and containerization approaches into account.
• Design of a highly available central infrastructure in an active-active model across two data centers; consideration of cloud, infrastructure, application, CMDB, and IAM services.
• Development of the migration and transformation roadmap, including defining migration waves, dependencies, requirements, and priorities for the move from decentralized services to the central platform.
• Analysis of technical and organizational dependencies, identification of migration risks, and development of a structured approach for step-by-step migration and centralization.
• Creation of target, solution, and implementation views for each service domain; design of the end-to-end join-move-leave process as a blueprint for the European rollout (Jira/Jira Asset Management).
• Alignment of migration strategy and roadmap with European companies, management, IT, providers, and other stakeholders; presentation of the 12-month roadmap to the Managing Director Europe.

• Built Azure Kubernetes clusters (AKS) with network policies, security groups, and RBAC
• Terraform-based infrastructure as code for secure, reproducible deployments in the BMW Azure cloud
• Hardened CI/CD pipelines with Jenkins, SonarQube, Fortify SSC, and Contrast AST
• Integrated SAP BTP/Kyma and ServiceNow GRC

• Conducting information classification, risk management and supplier assessment workshops
• Introduction of a customer-specific information security minimum standard (based on TISAX and ISO 27001) since Apr. 2026; implementing the same standard in parallel for a second customer
• Building an ISMS according to ISO 27001 for a logistics company (approx. 160–200 MA)
• Municipal utility company (KRITIS, approx. 450 MA): independently introduced the CRISAM GRC tool and am currently expanding it to include NIS-2 areas, took over parts of the ISB support mandate, and followed up on and remediated audit findings
• Supporting customers in implementing DORA and NIS-2, including documentation for a financial institution
• Conducting and supporting audits of systems for attack detection (SzA) according to § 8a BSIG (today §§ 31, 39 BSIG)
• Creating network structure plans according to IT-SiKat
• Creating technical security concepts (logging, IAM, attack detection)

• Strategic consulting for securing business processes
• Consulting on the planning and implementation of IT and IT security projects
• Security and policy checks, process optimization, emergency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2026: Analysis and assessment of an IT security architecture in terms of its existing design and the components in use. Development of proposed solutions to maximize security and reduce complexity. Development of a Zero Trust strategy and IT security architecture for DG Nexolution EG.
• 2026: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2025: Consulting on a DLP concept for Digid GmbH.
• 2025: Advised a customer following a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations to improve IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Development of a DNS concept, including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Development of a DHCP concept, including consulting on DHCP design, a central DHCP management system and automation. Consulting on the operation of the relevant products, their operating processes, and updates to IT documentation and IT service descriptions for Thyssenkrupp Marine Systems.
• 2024: Assessment of the current state and evaluation of the network and security infrastructure established by the providers in terms of the overall architecture, including its design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the findings to C-level management, including their causes and possible solutions, with the required decision documents. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on addressing findings from an IT security assessment of the IT infrastructure; conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX); developing a new security architecture based on Zero Trust; redesigning a Cisco ISE implementation; and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), the Federal Institute for Geosciences and Natural Resources (until 05/2023), and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Development and review of white papers for infrastructure and security architectures; planning new network infrastructures for the German Aerospace Center.
• 2022: Development of a concept for the technical and process-based modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, implementing Network Access Control, and delivering an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for the Federal Employment Agency.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including analysis and recommendations for remediation based on risk and likelihood of occurrence for customer ifi GmbH.
• 2021: Consulting, solution design and sub-project management for the introduction of a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic endpoint assignment) for office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure, including the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks, and wireless LAN, including support for implementation for the Federal Institute for Geosciences and Natural Resources.
• 2021: Development of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level 3 policies and development of procedures for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of the outsourcing of the LAN/WLAN infrastructure to a managed service provider, and development of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for a customer's “Transition of SIEM/SOC Services” project to a shared environment, and taking on the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop on a future Mobile Device Management implementation for customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for the introduction of a firewall rule management tool and recertification of NAC endpoints based on 802.1x and MAB for customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Assessment and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture in terms of the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Recommendations to improve infrastructure stability and operations. Development of a network segmentation concept and project management for implementing the measures identified in the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Assessment of the current IT architecture across all 23 companies.
• Recommendations for optimizing the IT infrastructure and a comparison of the traditional perimeter security concept with the Zero Trust model.
• Development of a security zone concept.
• Development of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the cybersecurity program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project leads and experts.
• Project area: Network Segmentation and Access-Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT-Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of bids.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on the introduction and initial operation of an ISMS based on ISO27001.
• Auditing the IT environments of GLS subsidiaries.
• Analysis and assessment of IT security risks and identification of required measures.
• Development of proposed solutions in coordination with relevant stakeholders.
• Project management and handover of the ISMS for ongoing operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Strategic and solution consulting for major enterprise customers and financial and insurance customers across Germany on Cisco and Meraki security products and services, such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and setup of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Development of security policies based on ISO 2700x.
• Took on the interim role of Information Security Officer.
• 2017: Development of an emergency plan for VPV Lebensversicherungs-AG.
• Review and update of the IT emergency handbook.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Development of detailed-level designs for cloud products.

Evaluation and selection of a new endpoint management platform for an environment with around 50,000 clients. Support for a manufacturing company in evaluating a future endpoint management platform as a possible replacement for the existing client management solution. Conducting a structured software selection process including proof of concept as well as preparing the decision basis for the Enterprise Architecture Board (EAM). Defining the technical requirements and evaluation criteria and creating a short list of possible solutions (Tanium, Baramundi, Microsoft Intune / MECM). Planning and supporting the technical proof of concept as well as evaluating the architecture and operations aspects of the different platforms. In addition, evaluating tools for migrating existing software packages from the Ivanti DSM environment. Comparing and testing IDERI Move and PACE for the automated transfer of the existing package structure to the new platform, with the goal of significantly reducing migration effort. Support in selecting the required Tanium modules as well as preparing the decision documents for the Enterprise Architecture Board.

Tools: Tanium, Baramundi, Microsoft Intune, Microsoft MECM, Ivanti DSM, IDERI Move, Pace, Windows 10, Windows 11, Windows Server. VDI

In my role as Senior Cloud DevOps Architect for BP, an oil and gas company, I had the mission to migrate the Electric Vehicle Charging platform of the EV Division from on-premises and Azure to AWS cloud, resulting in a hybrid multi-cloud, multi-tenant SaaS solution.

Deployment with Kubernetes for the application layer meant provisioning Kubernetes clusters managed by EKS and AKS, with a focus on integrating them into a multi-tenant environment. This integration was achieved by using Kubernetes namespaces and access controls to ensure data isolation and privacy enforcement.

In the database layer, we chose an RDS instance with PostgreSQL to support the backend infrastructure of our applications. Tenants shared the same RDS instance, but each had a dedicated schema.

To ingest near real-time data from physical charge points (CPOs), as IoT devices, via the OCPI protocol, we ran into significant delays with batch processing. As a result, we built a real-time streaming data pipeline using Apache Kafka, while prioritizing an event-driven architecture.

Led collaboration across multiple internal teams, external vendors, cloud providers, and on-site partners to integrate over five systems into a unified solution.

Achievements:

• Successfully designed and implemented hybrid multi-cloud solutions, integrating multiple cloud platforms (AWS, Azure) with on-premises infrastructure, using Site-to-Site VPNs, Firewalls, and Load Balancing.
• Led the migration of on-premises infrastructure to multi-cloud, multi-tenant infrastructure, resulting in 30% faster processing times.
• Migrated workloads from VMware and Hyper-V environments to cloud-based VMs, leveraging cloud-native services to optimize performance, cost efficiency, and scalability.
• Designed a multi-tenant Kubernetes platform leveraging the Kubernetes ecosystem, using Karpenter for dynamic EC2 node provisioning, KEDA for event-driven pod autoscaling (e.g., Kafka message lag), and Rancher for centralized monitoring of multiple clusters (EKS, AKS, or on-prem K8s), replacing Microsoft-centric Azure Arc management service.
• Designed and implemented Python-based FastAPI microservices as part of the EV core-backend on AWS EKS application layer, powering data ingestion and customer analytics pipelines.
• Developed asynchronous, event-driven APIs (Python-FastAPI) for real-time integration with CPOs, supporting OCPI 2.3 and OICP protocols.
• Designed and implemented a secure, production-grade Azure Databricks platform using Terraform, ensuring scalability and cost efficiency.
• Migrated on-premises ERP to a hybrid Dynamics 365 architecture with ERP hosted locally and CRM running in Azure, integrated via Azure Arc.
• Automated CI/CD pipelines for Databricks notebooks and jobs using GitHub Actions & Databricks CLI, reducing deployment time. Reduced infrastructure provisioning time by 70% by automating cloud resource deployment with GitOps.
• Ensured compliance with internal audit and data governance standards (GDPR) through OAuth2/OIDC-based authentication and fine-grained role-based access controls.
• Developed a Zero Trust security model, enforcing least-privilege access and microsegmentation, enhancing security posture and compliance with GDPR and NIST.
• Built interactive analytics dashboards in Amazon QuickSight, integrating data from S3 and Redshift to deliver real-time business insights and visualizations with embedded access for multi-tenant users.
• Led cloud security assessments and full-lifecycle cybersecurity integration during M&A, covering AWS, Azure, IAM (Entra ID), and data protection, while aligning security posture with NIST, ISO 27001, and GDPR across hybrid and cloud-native environments.
• Reduced cloud costs by 64% for a client's dev environment by implementing automated start/stop schedules for EC2 and RDS instances via AWS CDK with EventBridge Scheduler or AWS Systems Manager.

Tech stack:

• Infrastructure as Code: Terraform, AWS CDK, Ansible.
• Containers: Kubernetes on EKS, AKS, Docker.
• Streaming Data Processing: Kafka to Confluent Cloud, after AWS MSK.
• Frontend: TypeScript, React, NextJS, Hooks, Styled Components.
• Backend: Python with FastAPI, also Node.js with NestJS.
• Database: Aurora on PostgreSQL with TypeORM, RDS on SQL Server, Azure Databricks full setup and administration, ETL Pipelines.
• CI/CD and GitOps: GitHub Actions, Azure DevOps, ArgoCD.
• Monitoring and Observability: Prometheus and Grafana.
• Virtualization: Hyper-V, VMware Cloud on AWS, Azure Migrate.
• ERP Systems: Odoo, Microsoft Dynamics 365 Business Central on Azure, integrated with Azure Arc.
• Networking: Site-to-Site VPNs, AWS Direct Connect, Azure ExpressRoute, Firewalls (AWS Network Firewall, Azure Firewall).
• Security: IAM, NIST Framework, Zero Trust Security, AWS WAF, AWS Shield, GuardDuty.