Security Solutions Architect / Staff Security Engineer

9/2020 – 2/2022

- Security Specialist in agile Scrum with .NET Backend, AngularJS Frontend, and QA Specialists
- Create and maintain Data Flow Diagrams (DFD) and Threat Modelling (ATT&CK, STRIDE)
- Execute Vulnerability Assessments/Discovery Pentests across UI, API & AWS Cloud
- Perform gap analysis on Application and Cloud against GMP compliance (pharma)
- Support Lead Engineers across UI, API and AWS Cloud in Secure by Design approaches

Agile Methodologie, Cloud Computing, Cyber Security, Software Design, Software engineering / -technik

1/2020 – 10/2021

- Ensure Secure by Design in a Global Multi-Cloud Service Catalogue (AZU, GCP, AWS)
- Perform Threat Modelling and Risk Analysis for all Multi-Cloud Product Lines
- Develop Agile Security Assessments in Sprint at Scale with Automated Tools
- Support Scrum Teams on Security Practices by hands-on Engineering (DevSecOps)

Cloud Computing, Cyber Security, Software Design

1/2019 – 11/2019

- Design, Automate, and Operate a Cloud Native Platform in Google Cloud Platform
- Move and Improve J2EE and Python Applications to Google Kubernetes Engines
- Infrastructure-as-Code (Terraform, Python-SDK)
- Evaluate Container Security with Falco/Twistlock (SCA, SAST) and other DevSecOps controls

Cloud (allg.), Cloud Computing, Cyber Security

7/2018 – 2/2022

- Design, Automate, and Operate a Machine Learning Platform in AWS (pharma)
- Software-Composition Analysis (SCA) and Container Hardening in CI/CD (SAST, DAST, RASP)
- Infrastructure-as-Code (CloudFormation) and Event-Driven Security (AWS Lambda)
- SDK and API Development for Flask API (Python)

Cloud Computing, Cyber Security, Software engineering / -technik

6/2016 – 6/2018

- Perform security assessments and propose risk mitigation strategies
- Perform threat analysis on various technologies and business propositions
- Manage security pentests and support risk remediation
- Extend baseline security requirements with DevSecOps and AWS security controls
- Security champion in agile software development projects
- Some assessed projects and technologies:
Apigee API Gateway (Node.js, API security, OAuth2, OIDC)
Microservice B2B Integration (Kubernetes, Docker, Java Springboot, Microservice
Security, mTLS, JWT, Bearer-Tokens)
Cloud SD-WAN Viptela (API Security, SAML Security, CPE/vCPE Security)

Certified Information Systems Security Professional (CISSP), Cloud Computing, IT Sicherheit (allg.), Projektmanagement (IT), Scrum

10/2015 – 5/2016

- Current state assessments on strategic network security capabilities
- Developing balanced scorecards in cooperation with international SMEs
- IT infrastructure reporting on KPIs to senior management boards
- Data validation, KPI improvements and automation of KPI reporting

Certified Information Systems Security Professional (CISSP), Informationssicherheit, IT Sicherheit (allg.), Netzwerk-Sicherheit

7/2011 – 7/2015

- Lead implementer TÜVRheinland "Certified Cloud Service“ (ISO 27001, BSI, ITIL) - Evaluate, design and implement state-of-art IT security products
- Act as Subject Matter Expert (SME) on IT security architecture and operations
- Perform security incident handling, vulnerability/risk management and audits

Cloud Computing, DIN EN ISO 27001, Informationssicherheit, It-Beratung, IT Sicherheit (allg.), ITIL, Konzeption (IT), Netzwerk-Sicherheit, Projektleitung / Teamleitung (IT), Qualitätsmanagement / QS / QA (IT), Telekommunikation / Netzwerke (allg.)

8/2009 – 6/2011

- Design and operation of the heterogeneous LAN/WAN infrastructure
- Design and operation of the heterogeneous Firewall/VPN/IPS/APT infrastructure - Operations of network services like DNS, NTP, NAC, AAA und PKI
- Operations of network, system, and security monitoring (SIEM)
- Project management of a network redesign to meet BSI/ISO 27001 requirements - 3rd level support and troubleshooting

BSI-Standards, DIN EN ISO 27001, DNS, Firewalls, Informationssicherheit, IT-Support (allg.), IT Sicherheit (allg.), Lokale Netzwerke, Projektleitung / Teamleitung (IT), Telekommunikation / Netzwerke (allg.), VPN, WAN

11/2008 – 7/2009

- Preparation, analysis and presentation of large-scale network security reviews
- Perform penetration tests and audits on web services, OS and networks
- Evaluate best-of-breed IDS-/IPS-, NAC- and DLP Solutions jointly with customers - 3rd level support for web-application firewalls

Betriebssysteme, Firewalls, IDS (Intrusion Detection System), Informationssicherheit, IPS (Intrusion Prevention System), It-Beratung, IT-Support (allg.), IT Sicherheit (allg.), Qualitätsmanagement / QS / QA (IT), Telekommunikation / Netzwerke (allg.)