Stream lead · Default role
Lead IT Infrastructure
Default role
Overall responsibility for infrastructure programmes from public cloud via hybrid and on-premises to isolated environments: technical leadership, quality, security and steering of team, partners and vendors.
- Designed, planned and built two complete greenfield infrastructures, largely driving the design myself – one enterprise and one air-gapped environment
- Led a team of up to around 30 people at peak
- Application owner for individual applications
- 2023 – 2025Lead IT Infrastructure in a large-scale programme: design, planning and greenfield build of an enterprise and an air-gapped infrastructure, team of up to 30
- 2015 – 2023CTO of an IoT company: overall technical responsibility
AzureMicrosoft 365VMware vSphereProxmox VEEnterprise LinuxAnsibleJira / Confluence
Target & reference architectures
Enterprise Architect
Translates requirements and protection needs into robust, auditable architecture decisions – across cloud, on-premises, hybrid and air-gapped.
Software ArchitectureArchitecture Decision Records
Security, compliance & classified information
Security Architect
Ensures that architecture and operations comply with the applicable frameworks – even when several apply in parallel – and prepares audits and approvals.
Security by DesignIAMBSI IT-GrundschutzISMS based on ISO/IEC 27001TARA (Threat Analysis & Risk Assessment)
Zscaler · Microsoft Entra · Security Service Edge
Zero Trust
Design and rollout of zero-trust architectures with Zscaler and in the Microsoft world (Entra ID, Conditional Access, Intune, Defender) – following the security-by-design principle.
Zscaler ZIAZscaler ZPAZscaler ZDXEntra IDConditional Access & PIMIntuneDefender
Azure · Entra · M365 · Active Directory
Microsoft Cloud & On-Premises
Building, hardening and operating Microsoft environments – from Azure and Entra ID and Microsoft 365 to Active Directory and Windows Server on-premises.
AzureEntra IDMicrosoft 365IntuneDefenderWindows ServerPowerShell
Enterprise Linux · Platform services
Linux & Platform
Building, hardening and operating Linux server and application platforms – from Enterprise Linux (RHEL) to Debian and Ubuntu. I run my own highly available bare-metal infrastructure based on Debian and Ubuntu, largely automated with Ansible: reverse proxy and load balancing with HAProxy and nginx, containers with Docker, hardening up to SELinux.
Debian / UbuntuRHELSELinuxAnsibleAnsible Automation PlatformSemaphorenginxHAProxyDocker
Network design · Perimeter
Network & Firewall
Designing campus, data center and site networks as well as firewall and perimeter architectures with clear zones and rule sets – vendor-agnostic (including Cisco, Palo Alto, Sophos), built and operated myself with OPNsense, UniFi and WireGuard.
Network DesignSegmentation & Zone ModelsFirewall ArchitectureOPNsenseUniFiWireGuard
AI strategy · AI architecture · AI in operations
AI Architect
From AI strategy and architecture into operations: AI-assisted software and tool development, AI agents and workflows, and AI-assisted IT operations – sovereign, secure and traceable.
AI StrategyAI ArchitectureAI Agents & WorkflowsClaude Coden8nMicrosoft Copilot StudioPower Automate
Device-to-cloud · IoT platforms
IoT Architect
Architecture of IoT solutions from the device to the cloud: connectivity, protocols, platform and data flow – drawing on eight years as CTO and chief architect of an IoT company, including an NB-IoT platform and an asset tracking solution.
IoT ArchitectureDevice-to-Cloud ConnectivityIoT PlatformsAsset TrackingCoAPLwM2MNode-RED
Wireless technologies · LPWAN · Building automation
Wireless Technology Selection
Vendor-neutral selection of the right wireless technology for the use case – by range, power consumption, data rate, cost and security; from LPWAN and cellular to short-range radio. Also a speaker at industry conferences on this topic.
Wireless Technology SelectionNB-IoTGSM / LTE / LTE-MLoRa / LoRaWANmiotySigfoxWireless M-BusZigBeeBluetooth