Selected projects

Problem: AI tools and models are required but must not leave the segregated environment.

Approach: Planned the AI workload hardware (HP ProLiant Gen10), built and integrated on-premise LLM servers under VS-NfD operating rules, assessed and rolled out an adoption strategy for AI tools against BSI and data protection requirements, prompt engineering and Python-based tool integration.

Result: Model operations inside the own network without cloud dependency, documented adoption strategy, Python-based tool integration in production. Additionally an ELK stack SIEM with AI-assisted anomaly detection and automatic ticket creation in Jira.

Problem: Incoming IT tickets were classified, prioritised and routed by hand – slow, inconsistent and without a reliable data basis.

Approach: Introduced ITIL-aligned processes, designed the CMDB with CI classes and inheritance rules, built an AI-assisted dispatcher with REST integration into the KIX CMDB and automatic routing, alongside a hub-and-spoke infrastructure concept.

Result: Processes, metrics and transparency in operations; automatic classification and routing based on CMDB data and historical patterns; operations aligned with KRITIS, NIS2 and BSI requirements.

Problem: Several grown Active Directory domains with inconsistent permissions and unclear responsibilities.

Approach: Consolidation into a single forest using Quest On Demand Migration, migration of user accounts, group policies, resources and permissions under compliance rules – without interruption –, hardening measures, alignment with IT security and network teams, documentation and administrator training.

Result: consolidated directory, hardened configuration, trained administrators, documented migration path.

Problem: A cloud architecture that gives business units their own room while keeping central compliance intact.

Approach: Hub-and-spoke concept with defined interfaces, Kubernetes clusters in a multi-cloud setup, Terraform and Ansible, CI/CD pipelines, ITSM build with CMDB, security and load testing, steering of external service providers.

Result: delivered cluster and automation platform, defined landing zone interfaces, compliance with BaFin, BSI and C5, documented handover.