Zscaler Experts in Germany

• Conceptual consulting for securing business processes
• Consulting for planning and implementing IT and IT security projects
• Security and policy checks, process optimization, contingency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept and for Digid GmbH.
• 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
• 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
• 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
• 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
• 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recording and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Analysis of the current IT architecture of all 23 companies.
• Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
• Preparation of a security zone concept.
• Preparation of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network Segmentation and Access Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of offers.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on introducing and initially operating an ISMS based on ISO27001.
• Auditing the IT environments of the GLS country companies.
• Analysis and assessment of IT security risks and derivation of required measures.
• Development of proposed solutions in coordination with the relevant stakeholders.
• Project management and transition of the ISMS to later operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Preparation of security policies based on ISO 2700x.
• Assumption of the interim role of Information Security Officer.
• 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
• Review and update of the IT contingency manual.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Preparation of detailed-level designs for cloud products.

"Reasoning Models: From LLM Foundations to NOC Automation."

Schaeffler: SASE Harmonization (SD-WAN/Zscaler Client Rollout)

• Overall project planning (including planning, preparation, and execution of the migrations)
• Project Management Office (PMO) – preparing status reports, monitoring progress with dashboards, preparing and conducting steering boards
• Coordination with the regions and departments to prepare the migrations
• Coordinating the execution of the migrations (cut-over)
• Coordination with the managed service provider for SD-WAN

• Preparation of a complete IT security concept (ISiKo)
• Implementation of BSI / NATO / national security requirements
• Risk analysis, documentation, audit preparation
• Consulting and management of development teams in Cybersecurity Recovery and Resilience
• Genua firewalls, VPN, VS-NfD migration from Checkpoint and PaloAlto firewalls
• Administration of log sources: firewall traffic, ALG (SIP calls), ATP, DLP
• System administration – servers, AD, clients (according to BSI)
• Stakeholder communication (C-level / government agencies)

• Operation and further development of a SASE infrastructure based on Netskope

• Consultant for system architecture, AI agents & integration, coach for data & process logic, Graph-RAG approaches, security and data protection.
• On-premise AI solutions with high compliance and performance requirements.
• Architecture decisions, operational setup, strategic prioritization & deployment.
• Technologies: LiveKit JS SDK, LiveKit Agents, Web Audio API, JS, AudioWorklet, Loki, vLLM, Zscaler, Docker, Neo4j, MySQL, Python.
• Models: GPT-OSS 20B, Whisper large v3 turbo, Qwen3-TTS.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Development of comprehensive services in cybersecurity, IT governance, and AI
• Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
• Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
• Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
• Responsible for company growth, client relations, and strategic partnerships

• All Windows clients are managed in a hybrid, central AD
• Client standardization
• Implementation of information security policy requirements
• Development of new infrastructure services delivered as a managed service by a new provider
• New IT platform is a central and secure directory service
• M365 Azure AD
• MS terminal services
• Zscaler
• M365 cloud for workplace management
• PaaS / SaaS is procured through a new provider

• Management and administration of the TOPdesk ticket system for the efficient handling of incidents and service requests as part of IT Service Management (ITSM)
• Implementation and administration of new features in the system for the continuous optimization of processes
• API integration and automation (Freemarker Java Markup Language, FIQL Queries) for flexible and efficient system adjustments
• Development and code implementation using GIT and Visual Studio Code / Secure Shell for stable, secure, versioned code
• Automated data imports with Action Sequences to reduce manual processes and increase efficiency
• Performance optimization in the TOPdesk system: introduction of an automated ticket splitting function, which reduced execution time from 5 minutes to 30 seconds
• Interface implementation between JIRA and TOPdesk for seamless integration of projects and processes
• Co-development of the TOPdesk–Salesforce–SD-Jira integration to improve the customer service experience
• Collaboration on the loyalty program (Rewe Bonus) to increase customer satisfaction and loyalty
• Support for the company-wide rollout of ServiceNow: user and role management, configuration of upgrade sets, creation and customization of transform maps including definition of coalescence fields
• Development of a temporary interface between ServiceNow and TOPdesk to ensure data consistency and transition processes

• Planning, documentation, installation, and configuration for customer projects
• Fortinet Firewall, FortiAnalyzer, FortiManager
• Cisco FMC (Firewall Management Control)
• WLAN survey and report creation with the Ekahau tool
• Cisco Meraki
• Alcatel Switches
• Cisco Switches, Cisco Nexus Switches
• Project management with customers, SLA contracts

Projects:

Project: RWE – Development of a company-wide Zero Trust cybersecurity architecture (CITADEL) Role: Senior Enterprise Cybersecurity Architect / Zero Trust Architect Company: RWE AG Description: Concept and implementation of the strategic CITADEL cybersecurity target architecture at RWE, based on the Zero Trust architecture principle and aligned with regulatory requirements such as NIS2, ISO 27001 and company-wide security governance policies. The goal was to build a measurable, auditable and scalable security architecture with a strong focus on Identity Governance, compliance transparency and operational manageability. Responsibilities & Achievements:

• Zero Trust architecture design: Developed a company-wide Zero Trust reference architecture (Identity, Device, Network, Application, Data) including trust zones, control points and enforcement mechanisms according to NIS2.
• Identity & Access Governance (IGA): Designed and introduced IGA governance structures including role models, recertification processes, segregation of duties (SoD) and lifecycle management for identities and access.
• Security governance & KPIs: Defined and implemented security KPIs and metrics to manage Zero Trust maturity, identity risks and compliance at the management level.
• Compliance & reporting: Built standardized compliance reports and dashboards to support internal audits, external assessments and regulatory evidence (e.g. NIS2).
• Architecture & stakeholder alignment: Worked closely with Enterprise Architecture, IT operations and business units to integrate the CITADEL architecture into existing IT and security landscapes.
• Strategic security consulting: Advised programs and projects on Zero Trust compliance, identity centricity and regulatory requirements in the energy and critical infrastructure (KRITIS) environment. Technologies & Methods: Zero Trust Architecture, NIS2, Identity Governance & Administration (IGA), IAM, RBAC, SoD, Entra ID, SailPoint, Zscaler, Terraform / IaC, Policy as Code, security KPIs, compliance reporting, NIST 2.0, ISO 27001, Enterprise Security Architecture, governance frameworks, risk & control management

Project: Scalable AI Workbench Platform on Microsoft Azure Role: Cloud Architect & Engineer Company: Siemens Energy Description: Design, development and operation of a secure, modular cloud infrastructure to support Data Science, Machine Learning and AI applications for various engineering teams at Siemens Energy. Responsibilities & Achievements:

• Cloud architecture: Designed and implemented an Infrastructure-as-Code solution (Terraform) for automated provisioning of Azure resources (Resource Groups, Storage Accounts, Cosmos DB, Application Insights, networking, PostgreSQL Flexible Server, Azure Container Apps, Azure Container Registry).
• Developer portal: Used Backstage with custom frontend and backend plugins (Node.js, TypeScript, React.js, PostgreSQL, Container Apps) to enable self-service and empower developers, data scientists and AI/ML engineers.
• Role-based access control: Implemented Azure RBAC to grant targeted access (e.g. Storage Blob Data Contributor, Reader) to engineering groups (e.g. AI Engineers) for relevant resources.
• Data platform engineering: Built and configured a multi-layered storage landscape (Raw, Curated, Vector data), including automated container creation and access control for advanced analytics and AI workloads.
• DevOps integration: Integrated with Azure DevOps for CI/CD pipelines to automate deployment, monitoring and compliance.
• Security & compliance: Implemented Private Endpoints, network policies and Managed Identities to ensure data protection and regulatory compliance.
• Collaboration: Worked closely with cross-functional teams to align the cloud infrastructure with business and technical requirements and drive digital transformation at Siemens Energy. Technologies: Azure, Terraform, Azure DevOps, Cosmos DB, Application Insights, Azure Storage, Private Endpoints, Azure Synapse, Azure Machine Learning, Azure Entra ID, RBAC, Backstage, Node.js, React.js, PostgreSQL, Python (automation), Git

• On-site implementation and upgrade of the life cycle infrastructure for a global partner of a Hays customer.
• On-site implementation for international locations in APAC & AMER.
• Executed on-site life cycle infrastructure upgrades for sites IN-NDA, IN-MOX, US-CAX, US-MOT, CN-YAN, and IN-MOR according to customer requirements. This included project management, administration, network design, optimization, as well as planning and deploying redundant OM4 and OS2 fiber and redundant power systems.
• Designed, upgraded, and migrated data centers for the above sites, including international on-site travel to the USA and India.
• Led and oversaw the network team, providing remote and on-site support for cabling work.
• Created network documentation, including L2 and L3 Visio drawings, IP address planning, network patch plans, power plans, bayface layouts, access point layouts, ISP carrier layouts, data center planning, downtime planning and scheduling, hardware checklists, network device configuration, implementation, test plans, and proposal evaluations.
• Extensive experience with Cisco hardware, including switches (9200, 9300, 9400, 4500, 3850, and 2960 series), WLC (9800, 5505, 3504, and 2800 series APs), ASA (55xx series), and NG Firepower (1010, 1120).
• Maintained documentation, including NetBox, PRTG monitoring, RADIUS, DNS, DHCP, and KX handover sessions, troubleshooting & trainings.
• Life Cycle Technical Guide & Control

• Technical and strategic support for the task force to build a globally available service unit focused on Microsoft Azure Cloud under the Follow the Sun principle and SAFe