Frédéric Klein - IT Consultant, Architect, Full Stack, DevOps

Recommended expert

Walpertskirchen, Germany

Experience

Jan 2025 - Present

1 year 1 month

Project Manager (Enterprise Cloud Governance)

CompuGroup Medical SE & Co. KGaA

Brief description: Leading a company-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, as well as cost and operations management, while preserving the autonomy of decentralized business units within regulatory constraints.
Responsibilities and activities:
Overall accountability for designing, building, and implementing an enterprise cloud governance structure (Azure), including target architecture, roadmap, and operating model.
Managing internal and external stakeholders (C-level, IT, security, compliance, cloud architecture, DevOps), including decision-making and escalation management.
Planning and facilitating workshops on cloud strategy, governance principles, and design areas (identity, connectivity, platform management).
Defining, implementing, and rolling out cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (e.g., GDPR, ISO 27001, BSI C5).
Building a cloud governance framework based on the Azure Cloud Adoption Framework (CAF), including landing zone and guardrail concepts.
Introducing automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).
Implementing cloud security and compliance monitoring mechanisms and continuous improvement processes.
Establishing and operationalizing FinOps in the enterprise environment (central and decentralized FinOps teams), including cost management strategies, reporting, and guardrails.
Integrating governance policies into DevOps processes (e.g., CI/CD principles for security and compliance checks, GitLab runner concept in spokes, GitLab CI/CD for CAF landing zones).
Implementing access concepts, including RBAC design and "breaking-glass" mechanisms (emergency access), as well as certificate automation (ACME/step-ca).
Achievements:
Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping), laying the foundation for scalable cloud usage in a regulated environment.
Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risks.
Improved operational and decision-making capabilities across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and corporate guidelines).
Significantly increased workload compliance during lift-and-shift migrations.
Technologies used:
Microsoft Azure Policy, custom policies.
Terraform, OpenTofu, Terragrunt.
step-ca (ACME).
Entra ID.
Azure Firewall.
Azure Networking, hub-and-spoke architecture.
Azure vWAN (evaluation).
Azure Front Door, Azure Application Gateway.
Azure ExpressRoute.
Azure Key Vault.
NetBox.
GitLab (on-premises).
Infrastructure and concepts used:
Cloud shared responsibility model.
Hub-and-spoke connectivity / central shared services (in a hub-spoke context).
Central governance with decentralized delivery (business unit autonomy with guardrails).
Methods used:
Scrum.
Stakeholder management (C-level to engineering).
Cloud governance, Azure Cloud Adoption Framework (CAF).
DevOps, CI/CD.
Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.
RBAC, "breaking glass" concepts.
ACME / certificate automation.
GitLab runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.

Sep 2024 - Mar 2025

7 months

Project Manager / Subproject Manager (IAM & SSO), Architect

Bank-Verlag GmbH

Brief description: Subproject management for modernizing the identity and access management of an online banking application. The focus was on migrating a tenant from an existing SAML-based integration (Shibboleth) to an SSO approach based on the existing Keycloak IAM architecture, preserving existing tenant extensions (central user management, TAN flow generators), and limiting additional complexity in the core domain.
Responsibilities and activities:
Analyzing the existing SAML integration of the Spring Boot application via Shibboleth, including authentication and session flows and interfaces to the online banking solution.
Reviewing the existing Keycloak IAM architecture, including customer-specific extensions (central user management, cross-tenant TAN flow generators, session management).
Designing a new Keycloak extension as a custom authenticator (proxy pattern) that forwards authentication requests to the existing online banking solution in a controlled way, aiming to reduce coupling, limit extra complexity, and keep the core domain encapsulation intact.
Technical and functional management of the development team (prioritization, architectural decisions, quality assurance, dependencies/impediments).
Regular reporting to the steering committee, including status, risks, decision requirements, and migration progress.
Achievements:
Defined a migration-ready target architecture for SSO that protects the existing online banking core domain (proxy authenticator instead of deep application logic changes).
Supported consolidation and reuse in the IAM landscape by considering and compatibly extending existing Keycloak extensions and tenant mechanisms.
Improved program control and decision-making through structured stakeholder and steering committee reporting.
Technologies used:
Java.
Spring Boot.
Spring Security.
React.
Keycloak (incl. extensions, session management).
Shibboleth.
SAML (legacy integration / migration).
Infrastructure and concepts used:
Tomcat.
Nginx.
Methods used:
Scrum.
Identity & Access Management (IAM).
DevOps.
Standards & patterns: OAuth 2.0 / OpenID Connect (typical for SSO with Keycloak), token and session hardening, back-channel logout.
Security engineering: threat modeling, security by design, audit logging/tracing for auth flows, OWASP ASVS-relevant controls.

Sep 2024 - Dec 2024

4 months

Subject Matter Expert (SME), Consultant

CompuGroup Medical SE & Co. KGaA

Brief description: Consulting on evolving a previously private-cloud-centered cloud provider strategy to a public cloud approach. Focused on organizational and technical readiness, RFP support for mission-critical workloads, vendor evaluation (scoring), as well as cost estimates and compliance/policy mapping for hyperscalers.
Responsibilities and activities:
Developing and aligning an organizational and technical cloud readiness assessment catalog for CTOs of business segments (including architecture, operations, security, compliance, organization criteria).
Advising procurement, management, and tech leads on an RFP for hosting mission-critical applications in the public cloud (requirements, evaluation logic, decision documentation).
Conducting comprehensive scoring of vendors participating in the RFP, including a consistent evaluation methodology and result preparation for stakeholder decisions.
Estimating costs or near-TCO calculations based on workload bills for 12 products using hyperscaler pricing calculators (comparing assumptions, deriving cost drivers).
Assessing existing IT governance for public cloud readiness (control framework, roles/responsibilities model, decision and approval processes).
Analyzing existing corporate guidelines and compliance requirements and mapping them to available policy and control mechanisms of the hyperscalers (e.g., Azure Policy rulesets, identifying gaps and actions).
Achievements:
Created a decision-ready foundation for provider selection (RFP consulting, transparent scoring, comparable evaluation logic).
Systematized and harmonized cloud readiness across segments (assessment catalog for CTOs as a reusable tool).
Increased cost and governance transparency for the public cloud transition (workload-based cost estimates, mapping guidelines/compliance with hyperscaler controls).
Technologies used:
Azure Price Calculator.
AWS Price Calculator.
Infrastructure and concepts used:
Cloud shared responsibility model.
Amazon Web Services (AWS).
Microsoft Azure.
Google Cloud Platform (GCP).
Azure Policy (policy rulesets / controls).
Azure Cloud Adoption Framework (CAF).
Methods used:
Cloud readiness assessment (workload-oriented).
Software architecture analysis.
RFP sourcing: weighted scorecards, must/should criteria, risk and compliance matrix.
Architecture blueprints: reference architectures (landing zone, network/identity baselines), migration wave planning, well-architected checks (provider-specific).

Feb 2024 - Aug 2024

7 months

Consultant (Cloud Architecture / Private Cloud)

CompuGroup Medical SE & Co. KGaA

Brief description: Architecture and performance consulting for internal Group IT customers in the context of provided private cloud services based on OpenStack. Focus areas were building an IaaS service offering for running a customer-facing software in the cloud, diagnosing and resolving storage/disk I/O performance issues in virtualized OpenStack environments, and enabling operational capability of proprietary legacy appliances in OpenStack through targeted hypervisor/image configuration.
Responsibilities and activities:
Advising a business unit on building an IaaS service offering based on OpenStack to enable customers to run the Medistar software in the cloud (service/architecture design, operational and platform requirements, technical guardrails).
Identifying disk I/O jitter in virtualized guest operating systems of an OpenStack cluster; creating structured analysis and benchmark reports based on fio, diskspd, and Phoronix.
Working closely with the infrastructure/platform team on root cause analysis and remediation (hypothesis formation, measurement concept, re-tests, result validation).
Investigating the impact of I/O jitter on database workloads (e.g., Oracle, PostgreSQL), including analysis of Oracle-specific I/O mechanisms and calibration procedures.
Supporting the deployment of proprietary Linux-based legacy firewalls in OpenStack by adjusting the VM boot environment and the libvirt/SCSI layer using image properties/metadata (KVM/libvirt configuration parameters).
Using IaC approaches for repeatable provisioning/parameterization (Terraform) in the context of private cloud services.
Achievements:
Provided performance transparency and decision-making basis by reproducibly detecting, quantifying, and documenting I/O jitter in actionable benchmark reports.
Improved operational capability of mission-critical workloads in the private cloud (database workloads and legacy appliances) by analyzing technical causes and implementing targeted configuration measures.
Enabled a business unit to build a market-ready IaaS service offering on OpenStack through hands-on architecture and platform consulting.
Technologies used:
Terraform.
Ansible.
fio, diskspd, Phoronix, iostat, vmstat, sar (benchmarking/performance analysis).
PowerShell.
Infrastructure and concepts used:
OpenStack: Nova, Cinder, Neutron, Glance, Heat.
KVM hypervisor.
libvirt (SCSI/storage stack).
Cloudbase-Init (Windows Cloud-Init).
Operating systems: Linux, Windows.
Databases: Oracle, PostgreSQL.
Storage: Pure Storage.
Methods used:
Cloud shared responsibility model.
Performance/benchmark-driven troubleshooting (measurement concept, reproducibility, validation).
Storage/VM tuning: Virtio-SCSI, I/O threading, queue depth tuning, NUMA/CPU pinning.

Mar 2023 - Aug 2023

6 months

Interim Head of Software Development (Consulting)

Zeppelin GmbH

Brief description: Interim leadership and consulting as Head of Software Development for the Digital Factory of the Zeppelin Group. Focused on multi-team management (cloud infrastructure, telematics, data management, CMS), developing a cloud strategy including a framework proposal (governance and architectural guidelines, provider selection, disaster recovery concept by criticality levels), and building a taskforce for the health check and rightsizing of an existing telematics platform.
Responsibilities and activities:
Leading four teams in the domains of cloud infrastructure, telematics, data management, and content management systems (prioritization, dependencies, target architecture, delivery management).
Advising on cloud strategy and migration, including supporting an internal taskforce (decision and process models, stakeholder alignment).
Developing a proposal for a cloud framework as a management and architectural guideline.
Defining governance and architectural guidelines (e.g., standardization, guardrails, operating models).
Defining selection criteria for cloud providers (functional/technical/compliance-based).
Developing disaster recovery and resilience strategies along a criticality-based classification model.
Building and managing a taskforce for the health check and rightsizing of an existing telematics platform; advising and supporting the definition and prioritization of requirements (e.g., performance, stability, cost, scalability).
Achievements:
Established a unified leadership and management structure across multiple teams, strengthening the decision-making and delivery capabilities of the Digital Factory.
Delivered a ready-to-implement proposal for a cloud framework (governance, architecture, provider selection, DR based on criticality model) as a basis for standardized migration and operations.
Reduced cost and operational risks of a telematics platform by structuring the health check/rightsizing and operationalizing it through a dedicated taskforce.
Technologies used:
RabbitMQ.
Kafka.
Python.
Scala.
Terraform.
Infrastructure and concepts used:
Kubernetes.
Ansible.
Observability: Prometheus, Grafana.
Identity/IAM: Keycloak.
FinOps (cost management).
AWS Well-Architected Framework (as evaluation/guideline).
BSI-oriented disaster management for cloud applications (DR/BCM reference framework).
Methods used:
Scrum.
Operating model & governance: RACI, Cloud Center of Excellence (CCoE), architecture review board/guardrail processes.
Resilience: RTO/RPO definition, failover strategies (multi-AZ/region), runbooks, and regular DR tests.
FinOps practices: tagging standards, budgets/alerts, unit economics/showback/chargeback.

Feb 2023 - Jul 2024

1 year 6 months

Lead Developer (Full-Stack) / Software Architect

Körber Pharma Inspection GmbH

Brief Description: Led full-stack development and software architecture for EjectX, an AI-powered inspection system for detecting safety-relevant product deviations in the pharmaceutical domain. Focused on modernizing and stabilizing the tech stack, interfaces to data science pipelines, introducing an API gateway and standardizing security/IAM, as well as automating AWS deployments and setting up observability in Kubernetes.
Tasks and Responsibilities:
Technical and functional leadership of a development team (4 FTE) including architecture decisions, prioritization, and quality assurance.
Analysis of existing inspection systems, considering interfaces and integration constraints (system/interface assessment).
Reducing technical debt and migrating outdated framework versions to improve maintainability, security, and delivery capability.
Developing and stabilizing interfaces to data science pipelines (integrating ML/AI components into the product platform).
Backend and frontend development based on defined user stories using Definition of Ready/Definition of Done criteria.
Introducing and enforcing coding guidelines with a focus on clean code (consistency, testability, review standards).
Implementing an API gateway based on OpenResty/OpenNginx, including integration with Keycloak via OpenID Connect for centralized authentication/authorization.
Replacing manual infrastructure provisioning in AWS with automated application deployment using GitHub Actions, Terraform, and Ansible (infrastructure/deployment automation).
Setting up a monitoring/observability stack with Prometheus/Grafana, deployed in a Kubernetes cluster, including an operational baseline for operations and troubleshooting.
Achievements:
Increased delivery and operational readiness of the system by reducing technical debt and performing framework migrations (reduced maintenance risk, modernized foundation).
Unified security and access concepts by introducing a central API gateway with OIDC integration to Keycloak (consistent AuthN/AuthZ layer).
Established repeatable deployments and improved scalability through IaC and CI/CD automation (Terraform/Ansible + GitHub Actions) and a Kubernetes-based operating platform.
Improved operational transparency by adopting Prometheus/Grafana as the monitoring standard in the cluster.
Technologies Used:
JavaScript, TypeScript.
Node.js, AdonisJS.
Vue.js.
Cypress (E2E/frontend testing).
Python, TensorFlow (data science/ML integration).
Nginx, OpenResty (API gateway).
Terraform.
Infrastructure & Concepts:
AWS.
Docker.
Kubernetes.
Ansible.
GitHub Actions (CI/CD).
IAM / Identity: Keycloak, OpenID Connect (OpenIDC).
Observability: Prometheus, Grafana.
Methods:
Scrum.
Clean Code (coding guidelines, reviews, quality standards).
Architecture and engineering practices: domain-driven interface separation (e.g., bounded contexts), API design (REST/async), ADRs (architecture decision records).
Kubernetes ops: Helm/Kustomize, ingress standards, resource limits/requests, horizontal pod autoscaling.

Jan 2021 - Jan 2023

2 years 1 month

CEO (Seed Phase, Product & Technology)

IT4Medic GmbH

Brief Description: Management and development of a startup in the seed phase to build a platform for real-time patient monitoring on general wards (non-ICU) using sensor-based body-area networks. Responsibilities included IP/patents, product and prototype development (platform + wearables), network concept (LoRaWAN), as well as preparing clinical field trials and stakeholder engagement in healthcare.
Tasks and Responsibilities:
Oversaw the seed phase with end-to-end operational responsibility for product, technology, and stakeholder management.
Initiated and supported patent filings (IP strategy, documentation, FTO analyses, coordination with patent attorneys and stakeholders).
Rapid prototyping of a monitoring platform (full stack) and development of wearable/sensor components (prototype iterations, integration, demonstrator readiness).
Product development including gathering requirements from clinical context, prioritizing features, and defining an MVP approach.
Planning and designing clinical field trials (study/pilot design, organizational coordination, technical requirements for field operations).
Designing broadcast/transmission networks based on LoRaWAN for reliable, energy-efficient communication in ward environments.
Achievements:
Secured seed funding of EUR 0.5M, laying the foundation for prototype development, patenting, and preparation for clinical trials.
Built a prototype end-to-end solution (platform + wearables + network design) used for demonstrations and pilot testing in clinical settings.
Established IP foundation through patent filings, securing protection for key solution components.
Prepared clinical validation (field trial concept), enabling a structured transition from prototype to practical proof.
Technologies Used:
Java.
Spring Boot.
Vue.js.
C (embedded/wearables).
Infrastructure & Concepts:
InfluxDB (time-series database for measurement data).
LoRaWAN (radio/network stack for low-power communication).
Methods:
Scrum.
Stakeholder management.
Seed funding management (preparing and managing early-stage financing).
Freedom-to-operate analysis.
MedTech engineering: risk management according to ISO 14971, usability engineering (IEC 62366), privacy/security-by-design (GDPR).
IoT Architecture: device provisioning, OTA updates, edge gateways, MQTT/CoAP patterns.
Data & Monitoring: alert logic, event streaming, data quality/validation, audit trails for clinical use.
Trial preparation: ethics approval processes, inclusion/exclusion criteria, data management plan (DMP).

Apr 2020 - Jan 2023

2 years 10 months

Head of Engineering & Consulting / Authorized Officer / Member of Management Board

birkle IT AG

Brief Description: Leadership role in engineering and consulting with power of attorney, responsible for building, scaling, and managing a software delivery organization. Main focus was building seven full-stack teams (about 60 developers and business analysts), executing several parallel client initiatives (public sector, healthcare, automotive), establishing DevOps/IaC, taking on security responsibility, and launching a tech-business incubator with spin-offs.
Tasks and Responsibilities:
Built and scaled seven full-stack delivery teams (about 60 staff) including recruiting, team composition, delivery structures, coaching/mentoring, and architecture and technology governance.
Acted as lead software/devops architect and developer in critical projects; enabled teams through standards, reviews, best practices, and technical coaching.
Served as security officer: built a full-stack team for a federal authority (14 staff-years) under security clearance rules (SÜG §10) and relevant regulations (BVerfSchG §3 para. 2).
Established a machine-learning team for healthcare clients (10 staff-years) focusing on object detection, pose estimation, and natural language processing; managed functionally and organizationally.
Set up a tech business incubator unit including concept, team building, delivery, and successful spin-off/capitalization of two startups in healthcare (AI-driven real-time analysis of surgical procedures, ubiquitous patient monitoring).
Built a DevOps team (10 staff-years) and evangelized/introduced Infrastructure as Code (standardization, automation, faster delivery).
Created an infrastructure team (2 staff-years) for on-prem/hybrid platform topics (VMware ESX, Proxmox, Unifi, Active Directory, Keycloak) including operations and integration aspects.
Led end-to-end implementation of an ERP system (Odoo) at an automotive client (10 staff-years) including organizational and process consulting, integration, and delivery management.
Migrated a legacy insurance policy management software (30 staff-years) including program control, modernization focus, and transition/parallel operation aspects.
Achievements:
Built a scalable delivery organization (7 teams, ~60 FTE) enabling parallel, multi-domain client programs.
Established DevOps and IaC capabilities in delivery (higher repeatability, lower operational/deployment risks).
Operationalized innovation/business building: created an incubator unit and supported two spin-offs through to capitalization.
Strengthened public sector capability by building a team under high security requirements including formal security clearances.
Technologies Used:
Java, Spring Boot.
Python.
Node.js.
ECMAScript/TypeScript, HTML5, CSS, Sass/Less.
Angular.
TensorFlow, YOLO (ML/CV).
Maven, Gradle.
Terraform, Vagrant.
OpenID (including OIDC context), OpenAPI.
Infrastructure & Concepts:
Jira, Confluence.
GitLab, Bitbucket.
CI/CD & Platform: Jenkins, OpenShift, Kubernetes, Docker, Rancher.
Cloud/Compute: AWS EC2.
IAM: Keycloak, Active Directory.
Data/Storage: InfluxDB, MongoDB, PostgreSQL.
Computer Vision: OpenCV.
Interfaces: REST.
Methods:
Scrum.
Engineering leadership: OKR/goal systems, capability/skill matrix, communities of practice, architecture governance through architecture review boards.
Delivery excellence: SDLC standards, Definition of Ready/Done, quality gates, testing strategies (E2E/contract/performance).
Security & compliance: secure SDLC, threat modeling, IAM hardening, audit/logging standards (especially public sector).
DevOps practices: GitOps, IaC module standards, platform self-service, observability standards (metrics/logs/traces).

Jan 2018 - Mar 2020

2 years 3 months

Software Architect & Lead Developer (Lead Architect Product Area "Contract Creation")

Allianz Technology

Brief Description: Consulting as a software architect and lead developer in the ABSi program to further develop a multi-tenant auto insurance platform for OEM clients. Focused on agile, program-wide architecture work in the product area "Contract Creation", standardizing frontend connectivity through an API gateway, modernizing legacy components toward microservices, and migrating a proprietary CMS stack to Adobe Experience Manager including modernizing the authentication layer to OpenID/Keycloak. Also responsible for transition and knowledge-transfer activities to offshore/India.
Tasks and Responsibilities:
Lead Architect for the Product Area Contract Creation within a program-wide "Agile Architecture" (architecture guardrails, consistency across teams, decision and review processes).
Implemented an API gateway for all web frontends using Netflix Zuul (centralizing routing, cross-cutting concerns, consolidating frontend-backend interfaces).
Migrated five legacy Java portlets to a microservice architecture with a modernized Angular frontend (decoupling, modernizing delivery and deployment structure).
Migrated 17 legacy BFF/frontend applications of a proprietary CMS to Adobe Experience Manager (AEM), including replacing the auth layer with a modern OpenID-based IAM solution using Keycloak (replacing historical auth mechanisms, harmonizing identity integration).
Served as lead consultant for India transition including planning and conducting knowledge-transfer sessions (knowledge transfer, enablement, handover of responsibilities).
Achievements:
Established a standardized, scalable frontend connectivity by introducing a central API gateway (uniform technical control points for web frontends).
Accelerated legacy modernization and improved maintainability through successful migration of portlets and CMS-related applications to microservices/Angular and AEM on time, within budget, and with quality.
Provided effective transition support through structured knowledge transfer to offshore/India.
Technologies Used:
Java.
Spring Boot.
ECMAScript/TypeScript.
HTML5, CSS, Sass/Less.
AngularJS/Angular (2/5).
Netflix Zuul (API gateway).
Maven, Gradle.
OpenID, OpenAPI.
Infrastructure & Concepts:
Jira, Confluence.
Bitbucket.
Eclipse, WebStorm.
Adobe Experience Manager (AEM).
DB2.
Docker.
OpenShift, Kubernetes.
Keycloak.
REST.
SAML (legacy/integration context).
CORS (frontend/gateway context).
Methods:
Scrum.
Communities of Practice.
Scaled agile architecture: SAFe-/LeSS-alike practices, architecture runways, enabler epics, architecture reviews/boards.
API management: rate limiting, authZ policies, contract testing, API versioning.
Security: OIDC/OAuth2 hardening, token strategies, zero-trust patterns for BFF/gateway.
Delivery: CI/CD pipelines, blue/green or canary deployments in OpenShift/Kubernetes.
On-call: lead engineer for all portals during release weekends, responsible for emergency hotfixes pre-Go-Live.

Sep 2014 - Dec 2017

3 years 4 months

VP Operations (Startup) – Embedded/SDR Product Development & Operations

Modula Team GmbH

Brief Description: VP Operations at a startup developing a digital interface for a tactical COFDM modem with a very small ROM footprint (max. 50 KB). Responsible for business and financing activities (business plan, investor acquisition, funding rounds) as well as prototypical hardware and signal path design (ADC cascade, dynamic range/noise optimization), field test tooling (GPS-based measurement), and full-stack development of a web interface including bare-metal embedded backend (minimal IP/TCP stack and web server without RTOS on SmartFusion2/ARM Cortex).
Tasks and Responsibilities:
Created the business plan including defining product/market assumptions, cost/financial planning, and investor pitch.
Secured investor capital and coordinated funding rounds (pipeline, documentation, stakeholder management).
Prototyped the receiver unit and ADC cascade including optimizing dynamic range and noise thresholds (signal quality, robustness in field conditions).
Developed a GPS-based measurement tool for capturing transmit/receive values in pilot frequencies; conducted and supported field tests with pilot customers and processed measurement results.
Full-stack development of a web interface under strict resource constraints (ROM footprint) with frontend (jQuery/HTML/CSS/SASS; occasional Vue.js/Angular) and backend as a minimal TCP/IP stack plus web server.
Implemented key embedded components bare metal without RTOS on SmartFusion2 (ARM Cortex IP core) to maximize control over resource usage and deterministic runtime behavior.
Technically coordinated measurement and test setups (e.g., spectrum/network analyzer) to validate RF and reception characteristics.
Achievements:
Realized a prototype end-to-end solution (embedded backend + web UI + field test tools) enabling development, demonstration, and pilot testing with customers.
Enabled operation under extreme resource constraints (ROM footprint optimization) through minimalistic protocol/web server implementation and a strictly lean UI architecture.
Improved measurement and field test capability with a GPS-based measurement tool and structured data collection in pilot frequencies.
Professionalized funding preparation and investor interactions with a business plan and coordinated funding rounds.
Technologies Used:
C (embedded, bare metal).
JavaScript.
HTML5, CSS3, SASS.
jQuery.
Vue.js, AngularJS/Angular (2).
Infrastructure & Concepts:
SmartFusion2 (SoC/FPGA environment), ARM Cortex (IP core).
Jira.
Leaflet (maps/GPS visualization in measurement tool).
RF/test equipment: R&S spectrum analyzer, network analyzer.
Receiver circuit design & noise optimization (hardware/RF design activities).
ADC dynamic range optimization (signal path optimization).
Methods:
Scrum.
Embedded engineering practices: linker script/memory layout optimization, static analysis, unit tests on target, deterministic timing analysis.
Networking/protocols: lwIP-like minimal stacks, HTTP/1.1 minimal profiles, secure update mechanisms (bootloader/OTA).
RF/field testing: standardized measurement protocols, automated report generation, heatmaps/geo-fencing for coverage analysis.

Jul 2013 - Feb 2015

1 year 8 months

COO, Co-Founder, Seed Investor

Deutscher Televisionsklub Betriebs GmbH, Satelio

Short Description: Co-founding and operational responsibility (COO) for Satelio, a pay-TV platform for German expats in southern Africa via Intelsat. Scope included rights and license management, international legal clarifications for commercial redistribution, negotiating transponder capacity in the multi-million USD range, seed financing (EUR 1.5 million), technical planning (link budgets), as well as setting up and operating a DVB uplink station. Additionally, implementation of the web presence and a shop/order system.
Tasks and Activities:
Licensing copyrights for international TV content, including coordination with rights holders and distribution partners.
Coordinating international legal opinions (e.g. Namibia, Bulgaria, Germany) on copyright and commercial redistribution of German TV channels (risk and compliance mitigation).
Negotiating and finalizing contracts for satellite transponder capacity worth several million USD (commercial terms, durations, performance parameters).
Raising investor capital and conducting seed financing (EUR 1.5 million), including investor relations and document coordination.
Planning link budgets for an Intelsat transponder (signal and coverage planning, technical parameters, operational assumptions).
Planning and installing digital video broadcasting uplink stations, including decoding, encoding, multiplexing, and transmission (end-to-end broadcast chain).
Developing the website and shop/order system (HTML5/CSS3/JavaScript/jQuery/PHP) for customer acquisition and order processing.
Achievements:
Secured EUR 1.5 million in seed financing, laying the foundation for product development and market entry.
Established the technical and commercial basis for satellite distribution (transponder contracts, link budget planning, uplink station as operational enablement structure).
Built legal capability in an international context through coordinated legal opinions and content licensing processes.
Operationalized digital distribution channels via web and shop/order system for customer acquisition and order processing.
Technologies used:
HTML5, CSS3.
JavaScript, jQuery.
PHP.
QPSK (modulation/transmission context).
DVB multiplex (broadcast/headend context).
Infrastructure and concepts used:
Elemental Encoder.
Blankom DVB Headend.
Conditional Access systems (pay-TV access control).
Methods used:
Scrum.
QPSK link budget planning.
Broadcast engineering: DVB-S/DVB-S2 planning logic, EPG and metadata handling, monitoring/signal quality KPIs (MER/BER).
Security/commerce: payment provider integration, fraud prevention, data protection and compliance processes in e-commerce.
Operations: SLA/provider management, incident and problem management for uplink and headend operations.

May 2009 - Aug 2014

5 years 4 months

CEO, Project Manager, Founder, Seed Investor

Panaccess Systems GmbH

Short Description: Founded and built Panaccess as a conditional access platform for digital video services. Scope included strategic business development and global partnerships, building sales channels in LATAM and EMEA, seed financing (EUR 2 million), and project management in developing safety-critical hardware and embedded components (FPGA/embedded) for PCMCIA-based conditional access modules (CAM) in integrated receiver decoder (IRD) and multiplex/modulator infrastructure (QAM/QPSK) environments.
Tasks and Activities:
Strategic business development with building global partnerships with established industry providers (partner strategy, go-to-market, contract and cooperation initiation).
Building and scaling sales channels in LATAM and EMEA (channel strategy, pipeline development, partner enablement).
Raising investor capital and conducting EUR 2 million seed financing (investor relations, fundraising process, capitalization coordination).
Project management in the development of security hardware based on FPGA and embedded systems for PCMCIA-based conditional access modules (CAM).
Managing development and integration in the context of IRDs (integrated receiver decoders) and multiplex/modulator systems for QAM and QPSK (interfaces, system testing, integration in headend environments).
Implementing/coordinating technical components around DVB-specific signal and metadata processing (e.g., multiplexing/remultiplexing) and scrambling and decryption chains.
Achievements:
Secured EUR 2 million in seed financing, enabling startup growth and product development.
Supported international market entry by building sales channels in LATAM and EMEA and forging strategic industry partnerships.
Established technical product readiness in safety-critical broadcast environments through developing and integrating FPGA/embedded security hardware for CAM, IRD, and headend ecosystems.
Technologies used:
C / C++ (embedded/systems).
Perl (scripting/tooling).
HTML5, CSS3.
JavaScript, jQuery.
PHP5.
DVB multiplex, NIT remultiplex.
Common Scrambling Algorithm (CSA2, CSA3).
FPGA.
Infrastructure and concepts used:
Jenkins (build/automation).
PostgreSQL.
Methods used:
Scrum.
Secure engineering: key management and KMS concepts, secure boot and hardware root of trust, penetration testing in embedded contexts.
Broadcast/headend: DVB-C, S, and S2 environments, CAS/DRM processes, monitoring entitlement, ECM, and EMM flows.
Product and go-to-market: channel partner programs, pricing and packaging for B2B platforms, partner certification and enablement.

Summary

Frederic has 25 years of experience as an incubator and IT consultant, handling complex transformation and modernization initiatives in regulated environments (HealthTech, banking, industry) from cloud strategy to identity & access management. His focus areas included enterprise cloud governance for Microsoft Azure (CAF, policies, security/compliance, FinOps) as well as advising on public cloud provider transition, including RFPs, readiness, and TCO analyses. Additionally, he has implemented IAM/SSO migrations (SAML/Shibboleth to Keycloak) architecturally and as a subproject lead. In product projects, he served as lead developer/architect responsible for modernizing platforms (AWS/Kubernetes, CI/CD, observability) and integrating ML/AI components – always with a strong stakeholder and delivery focus.

Skills

Cloud & Governance: Aws (Architecture/platform) – 4.7 Years
Cloud & Governance: Finops / Cloud Cost Management – 1.5 Years
Cloud & Governance: Azure Caf / Landing Zones – 1.3 Years
Cloud & Governance: Azure Policy / Enterprise Guardrails – 1.3 Years
Cloud & Governance: Microsoft Azure (Architecture & Operations) – 1.3 Years
Cloud & Governance: Openstack (Private Cloud Iaas) – 0.6 Years
Cloud & Governance: Cloud Provider Strategy / Rfp / Scoring – 0.3 Years
Leadership & Methodologies: Scrum / Agile Delivery – 16.5 Years
Leadership & Methodologies: Project Management / Program Governance – 10.5 Years
Leadership & Methodologies: Stakeholder Management (C-level To Engineering) – 10.5 Years
Platform & Devops: Terraform / Opentofu / Terragrunt (Iac) – 7.6 Years
Platform & Devops: Ci/cd (Gitlab Ci, Github Actions, Jenkins) – 7.5 Years
Platform & Devops: Kubernetes / Openshift – 6.6 Years
Platform & Devops: Observability (Prometheus/grafana) – 4.0 Years
Security & Iam: Keycloak (Incl. Extensions) – 7.2 Years
Security & Iam: Oauth2 / Openid Connect – 7.2 Years
Security & Iam: Saml / Shibboleth – 2.8 Years
Security & Iam: Security Engineering (Threat Modeling, Secure Sdlc, Owasp) – 11.0 Years
Security & Iam: Compliance (Gdpr, Iso 27001, Bsi C5) – 4.1 Years
Software Engineering: Java / Spring Boot – 7.2 Years
Software Engineering: Javascript/typescript (Node.js, Web) – 15.3 Years
Software Engineering: Frontend (Vue.js / React / Angular) – 10.5 Years
Software Engineering: Python (Incl. Ml/automation) – 4.5 Years
Software Engineering: Machine Learning / Computer Vision – 2.9 Years
Software Engineering: Databases (Postgresql, Oracle, Influxdb, Mongodb, Db2) – 11.0 Years