Curriculum Vitae

I am fortunate to have spent more than fifteen years working in a field that I am genuinely passionate about. Information security allows me to combine a professional career, personal interest, and collaboration with amazing people – team members, fellow researchers, and project peers. Having started as a researcher and penetration tester with a strong focus on technology, the work on a broad range of projects provided me with insight into organizations and their business objectives and risks. I apply this holistic understanding of technology and organizations to develop the profiles and culture of the teams and companies I lead and the implementation of technical projects on enterprise-wide IT security programs, architecture, and organization. My work as a security leader allows me to drive technical excellence in security and give it purpose by ensuring that people, products, and companies are enabled and not hindered by it.

Interested? Book some time with me to have a chat!

---

Professional Experience

---

Principal Security Researcher

Averlon.ai, 08/2023 - Present

• Security research and product design on cloud-/container-native attack chains.

Head of Product Security & Principal Security Engineer

Astronomer.io, 08/2022 - 07/2023

• Improved protection of company assets by establishing processes and automation around SCM security posture and secret handling.
• Redesigned access into managed cloud accounts to use fully monitored least privilege accounts to reduce attack surface and support customer trust.
• Started and shipped first increments of supply chain security (incl. strong os/application patch management) improvements for both consumer and provider side.

Principal Security Engineer

Salesforce, 05/2019 - 08/2023

• Ensured a continuously high security posture of cloud/container platforms by establishing. effective threat modeling, risk scoring, and review practices.
• Led a project to understand and foster engineering relationships with security assurance; delivered key recommendations for future optimization.
• Prepared teams for full-stack assessments.
• Performed security engineering, assessments, and risk/threat modeling for a hyperscale container platform.
• Mentored technical staff members across the company on technical knowledge, processes, and career advancement.

Independent Researcher/Trainer/Consultant

Self-employed, Since 10/2018

• Provide trainings and consulting in the space of Agile, Cloud, Container & DevOps Security and Security Transformation & Strategy.
• Worked as Security Architect for different Cloud development projects aligning security posture and features across the product.

Executive Director/Principal Consultant/Head of Research

ERNW GmbH, 07/2007 - 09/2018

• Held various roles from Pentester/Researcher to CEO in a security consulting group.
• Developed the service portfolio, leadership guidelines, and company culture framework of the ERNW group.
• Grew company from 40 to 70 people.
• Led a team of select consultants for strategy consulting/assessment for Cloud-native/DevOps-/Agile security architectures.
• Founded and lead a research-oriented spin-off.

Community Activity

---

• 08/2017 - Present: Webinars on ipspace.net on Cloud, DevOps, Containers
• 03/2011 - Present: Developing real-world hacking challenges and cloud-native hosting infrastructure for Packetwars™
• 10/2009 - 09/2018: Program Committee Member of TROOPERS security conference

Education

---

• 10/2009 - 10/2011, University of Mannheim, Germany: Master of Computer Science and Business Administration
• 10/2005 - 10/2009, University of Mannheim, Germany: Bachelor of Computer Science
• 06/2018 - 06/2019, Salesforce: Accelerate Leadership Training Graduate

---

References and additional work history available upon request.