• Designed group-wide CIAM & IAM architecture ( One Identity, Entra ID, Ping identity suit (Directory, Ping-One, Ping federate))
• Defined IAM standards (SAML, OAuth,Open-ID,MFA, SSO) and GDPR-aligned data-protection controls and identity lifecycle management
• Led architecture squad; prepared DORA-compliance and network-segmentation strategy

Technology Stack:

• Provisioning of IAM Automates user onboarding/offboarding and group assignments.
• Directory Sync with Entra ID to Syncs users from on-prem AD to Entra ID.
• DLP (Data classification, Data labeling ) Microoft Pureview Architecture and implementation
• Identity Lifecycle Management at UNIQA with Entra ID governance to manages roles and permissions over time.
• CIAM (Customer Identity and Access management) PING ONE suit and Microsoft Entra ID.
• Identity provider Ping Directory, Azure AD B2C transformation
• Authentication & Authorization:
  • Ping Federate, Ping ID using OpenID, OAuth, SAML
• Security Compliance:
  • ?Multi-Factor Authentication (MFA), Conditional Access (limited in CIAM), Role Based access

• Directed AD ? Azure AD & Microsoft 365 migration, integrating SaaS workloads
• Introduced updated IAM policies for GDPR
• Managed mixed on-site/remote engineering team; aligned business & technical stakeholders

Technology Stack: Azure Cloud Migration components:

• Compute:
  • Azure Migrate: Server Migration Lift-and-shift of VMs (Hyper-V, VMware, physical)
• Storage:
  • Move files and structured data to Azure
• Network Routers:
  • Create Azure Virtual Network
• Apps&Web apps:
  • Migrate apps to Azure App Service or virtual environment
• IAM:
  • Sync users from AD to Azure, Role-based access control, MFA and Conditional Access

• Re-architected monolith trading platform into micro-services; produced risk analysis (ISO 27001)
• Piloted CyberArk rollout and network segmentation for BAIT compliance
• Oversaw DevOps pipeline and stakeholder communication across Europe

Technology Stack:

• TCP IP communication isolation, protecting sensitive systems from unauthorized access
• Filtering, firewall rules, packet filtering, intrusion detection systems (IDS), log analysis,
• DMZ creation, designing and deploying buffer zones to isolate public-facing services (web servers, gateways, load balancers, reverse proxies, and hardening OS configurations)
• Rollout management project leading for multiple technical teams (Solaris, network, Microsoft), Patch and OS lifecycle management, Infrastructure migrations or upgrades, compliance-driven deployments (ISO 27001, GDPR)