• Designed a central Azure Data Lake, connecting various national and international data sources (including Hadoop, Oracle, and MS SQL).

• Developed an overarching RBAC concept based on zero-trust principles.

• Implemented security controls such as authentication, authorization, encryption, network segmentation, and access control.

• Advised stakeholders on multi-account and multi-stage strategies for a multi-tenant strategy.

• Integrated with a ticketing system (ServiceNow) for extensive automation (self-provisioning) for power users.

• Conducted requirements analysis with national and international stakeholders.

• Defined a landing zone based on Azure WAF recommendations.

• Determined security requirements and controls based on best practices, compliance requirements, and the specific needs of the customer.

• Implemented compliance guidelines according to BSI for critical data.

• Advised on the design of self-service processes for the (semi-)automated provisioning of interfaces and user access via ServiceNow requests.

• Supported the design of a monitoring strategy.

• Assisted with the implementation and integration of blueprints.

• Advised on the configuration and integration of Azure security tools such as Azure Security Center and Azure Key Vault.

• Contributed to the creation of security documentation and policies.

• Collaborated with other teams such as IT operations, the development team, and data protection.

• Communicated with various stakeholders about security risks and measures.

• Conducted security assessments of interfaces to third-party applications.

• Created backup and disaster recovery documentation. 

• Support of KRITIS audit preparation for international virtual networks (private and public cloud).

• Establishing of Network Access Control (NAC) at national and international locations.

• Introduction of a role-based access and user-based firewall concept for on-premise workloads.

• Solution design MobileIron Mobile Thread Defense to secure mobile corporate devices.

• Solution design central remote support platform for secure endpoint access (BeyondTrust remote support solution).

• Solution design multi-tier AD domain concept in cooperation with the identity management team.

• Concept for the migration of workloads to secure zones.

• Automatic detection of application communication protocols/ports (Elastic Packetbeat) for future migration to secure zones.

• Creation of KRITIS-compliant network documentation (on-prem and Azure VPN).

• Coordination with stakeholders and national IT on KRITIS impacts.

Lead of Zero-Trust Initiative

• Definition of blueprints for secure access for cloud-based workloads (Azure and GCP).

• Design Zero Trust Network Access with FortiNet.

• Design TrendMicro End-Point Security Architecture for endpoints.

• Client hardening (Microsoft Defender, TrendMicro End-Point Security).

• Proof of Concept: Future Enterprise Web Application Firewall (AzureFW + Akamai Protector).

• Secure Access Service Edge (SASE) with zScaler and Cisco.

• Cloud Security Posture Management (CSPM) ? TrendMicro.

• Cloud workload protection and cloud-native application protection platform (CWPP & CNAPP).

• Solution design Active Directory multi-tier concept for directory tiering.

• SOC/SIEM integration (Proof of Concept Azure Sentinel).

• Integration Vulnerability Management as a Service (Qualys).

• WAN connection (Orange SPEAR integration)

• Integration of various data sources (SQL, SAP S/4, Hadoop) in compliance with encryption and zerotrust principles as well as data protection regulations.
  

• Central Tableau cluster in the private cloud, satellite in Azure.

• Design of a staging concept for Azure and private cloud operation.

• Data integration with SAP API/M and BizTalk Service Bus.

• File service integration with customer self-service RBAC.

SAP on Azure Migration Architecture

• Development of an architecture blueprint for the deployment of national SAP workloads in multiple Azure regions with failover and disaster recovery capabilities.

• Integration of SAP SCPI Service Bus and central reporting & monitoring.

• Hub-spoke network concept based on the MSFT SAP reference architecture.

• Jump host concept for secure administrative and superuser access.

• SAP on Azure migration (SAP CAR, SAP TM, SAP FnR, SAP ER.

• Migration of SAP integration and test environment to Azure.

• API/M SCPI integration hosted on SAP BTP.

• SAP Cloud Connector infrastructure for USA, EU and Australia.

• Blueprint design with Recovery Vaults, Site Replication, Network Security Groups and Application Security Groups.

• High Availability (HA) for SAP PAS/AAS in multiple Availability Zones for higher tiers (PreProd, Prod).

• Azure LB integration for application servers.

• Monitoring integration in Log Analytics for infrastructure monitoring.

• Terraform integration for automated infrastructure provisioning and scaling

Working as a freelance infrastructure and security architect, I design and implement highly available solutions for companies from various industries.

Excerpt from projects:

• Architecture and implementation of the infrastructure for a multi-level SAP environment with central applications such as S4/HANA, Transportation Management, SNP, CAR and supporting components (file server, PKI infrastructure, middleware (SAP PO)).

• Design and coordination of security concepts for the offshore operation of SAP environments (infrastructure).

• Global mobile app solution: Conception of a secure infrastructure for a globally used iOS-based mobile app with secure access and multi-user support. (SingleSignOn, Identity Provider Integration).

• Central File Exchange Platform: Led the architecture and project management for a centrally managed File Exchange Platform for internal and external customers. The environment supported multiple protocols (SMB, FTPs, https) and internal and external access via reverse proxies.

• Hardening of the platform, coordination of the required security concepts.

• Scalable Service Bus: Implemented a multi-level Service Bus (BizTalk) with failover capability for high data throughput and high availability.

As a freelance senior consultant, I advise clients from various industries on optimizing and automating their infrastructure.

Excerpt from project list:

• Central monitoring: Implementation of a comprehensive monitoring solution for the European virtualization environments of an insurance company.

• Server automation: Development and implementation of server automation based on HP Blade servers for a German bank.

• Automated provisioning and configuration of VMware hosts.

• Hadoop cluster on VMware: Co-design of a scalable Hadoop cluster for a financial services provider to analyze large amounts of data.

• VMware migration: Led a global VMware migration project for a bank customer without business interruption.

• VMware View implementation: Planning a cost-efficient VMware View environment for the international deployment of call center applications.

• Development of architecture blueprints and coordination with decision-making bodies

• Design of security measures in VMware environments

• Expert in VMware and Citrix virtualization environments.

• Advised various clients from the telecommunications and insurance industries

  on migrating their physical environments to cost-effective virtual solutions.

Excerpt from project list:

• Central deployment of heterogeneous applications: (Generali). Responsible for the implementation of a Citrix server farm at multiple locations in Germany, France, and Belgium for the central deployment of heterogeneous applications in the insurance industry.

• Secure remote access for external service providers: (AXA Cologne) Designed a secure, Europe-wide Citrix environment for external service providers to access corporate applications.

• Migration to VMware vSphere: (Mannesmann) Virtualized a server landscape of over 700 Windows servers to a VMware vSphere environment.

• Implemented automated provisioning of VMware hosts based on HP Blade-Center technology.

• Disaster Recovery Plan: (Vodafone) Developed a disaster recovery plan for all virtual environments of a telecommunications customer using Veeam backup software and NetApp storage backend.