About
Currently
I am currently working as a Senior IT Security Engineer at ConnectedCare GmbH (Berlin / Telgte, Germany, formerly Bewatec GmbH), where I significantly contribute to the IT security of the ConnectedCare platform and serve as the contact person for all topics related to IT security & data protection.
My activities address two important areas: a) technical security and b) regulatory activities. Both areas interact closely (e.g. fulfilling vulnerability management for the Cyber Resilience Act or risk management for NIS-2) and must always be planned together. They fundamentally include data protection topics as well as constant communication with various stakeholders (internal teams in technology / marketing / sales, management, data protection officers, legal counsel, supervisory authorities, etc.)
Activities: Technical Security
In the area of technical security, I am responsible for the design and implementation of measures to enhance the IT security of the ConnectedCare platform. This includes general roadmap planning, technology evaluations, as well as the conduction of projects / measures and in-house software developments (Terraform, Python, GoLang). Examples of relevant activities are:
- Project AWS CloudSec Suite: Development of Infrastructure as Code (Terraform, Python) for the configuration and deployment of AWS Cloud Security services (including intrusion detection, firewall, vulnerability scanner, notifications to Slack / Teams).
- Project Vulnerability Management: Implementation of DefectDojo as a central system for vulnerability management with graphs / metrics to visualize temporal trends. Self-developed scripts (Python as Terraform / AWS Lambda) realize data import (e.g. findings ofAWS SecurityHub, SonarCloud, GitHub) and “back-sync” (e.g. marking as “false-positive” in DefectDojo updates the vulnerability as “suppressed” in AWS).
- Project Supply Chain Security: Implementation of DependencyTrack for tracking all used software libraries as a Software Bill of Materials (SBOM), including vulnerability scanning and DefectDojo integration.
- Planning and coordination of penetration tests, independent conduction of simple penetration tests (“surface scans”).
- Various individual measures, e.g.:
- Web Application Firewall: a) ModSecurity with custom rules and OWASP CRS on reverse proxy in Kubernetes pod and (as a successor) b) AWS WAFv2 with AWS managed core rule set (CRS).
- Installation of security scanners like SonarCloud, GitHub / Dependabot security alerts, AWS Inspector, Aquasec Trivy (IaC), etc.
- Grafana Dashboard as a central visualization of vulnerabilities (was replaced by DefectDojo)
Activities: Regulatory Aspects
In the area of regulatory aspects, I am responsible for analyzing regulatory requirements, planning and implementing them including technical realisations. Examples of relevant activities are:
- Ensure compliance to EU and national regulations and directives such as NIS-2, Cyber Resilience Act (CRA) or GDPR by analyzing and implementing their requirements
- Accompanying introduction of ISO27001
- The above tasks comprise a wide set of organisational measures, examples are the following:
- Development of relevant policies, e.g. incident management, risk management, secure development, access control, cryptographic algorithms and key lengths (according to BSI TR-02102)
- Conducting risk management with regular risk assessments and coordination with the management
- Threat modeling (with IriusRisk and focus on STRIDE risk model)
- Various individual measures such as technical documentation, interaction with third parties (e.g. specific customer inquiries, specialized attorneys, supervisory authorities)
Before
I was involved as IT Security Analyst at Verimi GmbH (digital identity and trust platform) in the areas of security, risk & workflow analysis as well as technology & architecture security (e.g. vulnerability scans, coordination of pentests). Before my position at Verimi GmbH, I worked as researcher at the INSA de Lyon in applied research projects with international industrial partners. My work focused on research & development activities (particularly the architectural design & development of a distributed infrastructures, data traceability, security and reputation) as well as fostering relations with international IT partners.
Previously, I was involved in an R&D project with big industrial partners where I developed a blockchain system based on a fully new “democratic consensus” approach, where a set of trusted consortium nodes vote for block storage validity. The development was conducted in the context of data traceability, data anonymization & privacy-preserving analytics and for the realization I only used modern & free technologies, some of them are Java / Maven / Gitlab (+ CI) / Spring (Boot, Data etc.) / Apache Cassandra / Apache Kafka / Swagger REST) / Angular2 / TypeScript. The R&D activity comprised the whole software development lifecycle starting from research, vision, specification and software development up to the deployment with modern technologies such as Docker / Kubernetes / AWS.
In Science
My research activities after the PhD combine efforts at WHO, applied research in industrial projects and EU projects.
The last research activity was conducted alongside my work and targeted on the creation of a secure digital voting system based on homomorphic encryption (published in Springer Nature, 2024). At the WHO, I applied my experiences as IT specialist at the Dietary Exposure Assessment (DEX) group of the International Research Agency for Research on Cancer (IARC), Lyon, France, to design a new secure and privacy-preserving data analytics infrastructure for worldwide use. Right after the PhD, I was implied in several European projects (e.g. Nathcare, Sphera) as postdoctoral researcher at the INSA de Lyon where I assessed hospital information systems in the alpine space in Europe.
The PhD thesis was conducted in a bi-national supervision (cotutelle de thèse) at the University of Passau (Prof. Kosch) and INSA de Lyon (Prof. Brunie) within the MDPS doctoral college, which evolved to the International Research and Innovation Center in Intelligent Digital Systems (IRIXYS). During the PhD, I adopted a game theoretic approach to communication systems in order to ensure a secure collaborative operation of complex distributed system. In more detail it enables the analysis of the strategic choices of rational selfish individuals. During the PhD in the French-German doctoral college I got the wonderful possibility to combine my scientific curiosity and interest in other cultures and languages.
![[screenshot]](/images/dc_inspector_1.png){kind=link}
![[screenshot]](/images/dc_inspector_2.png){kind=link}