DevOps Engineer

Network as code

I build multi-site network and firewall infrastructure and run it with Terraform and Ansible, versioned in Git and rolled out through GitLab CI/CD pipelines.

Network Automation · Platform Provisioning · Security

Currently: SENEC GmbH
Location: Regensburg
In IT since: 2012

Selected projects

Four initiatives from running a distributed network and security infrastructure.

01 · Infrastructure as Code

FortiGate with Terraform

Starting point: Office firewalls were maintained by hand, and changes were hard to trace.
Approach: Declarative management with the FortiOS provider, import of existing devices, rollout through GitLab CI/CD.
Result: All firewalls version-controlled, reviewable and reproducibly configured.

Terraform · FortiOS · GitLab CI/CD

02 · Access

Business VPN with zero trust

Approach: OpenVPN gateway as the company's central VPN solution, configured with a dedicated Ansible role.
Security: Two-factor authentication with device certificate and Entra ID password, route-based access control per device and user.
Operations: Automated rollout of VPN configurations through an Azure Function.

OpenVPN · Ansible · Azure Functions

03 · Services

Redundant DNS resolvers

Goal: Resolve public and private zones across sites and providers.
Approach: Redundant BIND9 resolvers, configured with a dedicated Ansible role.
Coverage: Zones in Azure Private DNS, Route53 and Cloudflare, resolved through recursive resolvers.

BIND9 · Ansible · Multi-Cloud DNS

04 · Site connectivity

Hub and spoke across multiple sites

Redesigned the hub-and-spoke topology for several office sites with SD-WAN and BGP over IPsec. The offices connect to a central hub, which links to the distributed datacenters through a heterogeneous BGP over IPsec mesh.

Office 1 → Hub → Datacenter A via primary link

Primary link
Backup link
Active path

SD-WAN · BGP · IPsec · FortiGate

Skills

Automation & DevOps

Infrastructure as Code (Terraform), Configuration Management (Ansible), Network Automation, Platform Provisioning (Multi-Cloud), NetBox (Source of Truth), Git Workflows & CI/CD (GitLab), Secrets Management (HashiCorp Vault), Runbook Automation (Rundeck), Shell Scripting (Bash, Python)

Network & Security

Routing (BGP, PBR, static), Switching (VLANs, Spanning Tree Protocol), SD-WAN, VPN (IPsec, OpenVPN, WireGuard), WLAN (site survey with Ekahau, WPA2/WPA3-Enterprise, 802.1X, RADIUS/NPS), DNS (BIND9, Azure Private DNS, Route53, Cloudflare), DHCP, SNMP, Firewalling (FortiGate, OPNsense, firewalld, Azure vWAN/NSG), IPS/IDS, DoS/DDoS protection, IAM/LDAP, Qualys, Wazuh

Compliance & Hardening

NIS2, KRITIS, ISO 27001 (ISMS), GDPR, CRA; implemented across managed services: access control (MFA), vulnerability and patch management, backup and recovery, with audit-ready documentation

Cloud & Hosting

AWS, Microsoft Azure, Hetzner; design and operation of own colocation infrastructure with dedicated hardware

Infrastructure & Virtualization

Linux (Ubuntu), Virtualization (Proxmox, OpenNebula, VMware), Containers (Docker, Kubernetes), Storage (SAN/NAS, Ceph, ZFS, Object Storage/S3), Backup (Veeam, rConfig)

Monitoring & Observability

Checkmk, Icinga, OpenSearch, Prometheus, Zabbix

Experience

2024 - present
Network Automation Engineer
SENEC GmbH, Leipzig (remote)
2023 - 2024
Sabbatical
Traveling around the world
2015 - 2023
IT-Systems Engineer, focus on Wireless LAN
Pegasus IT GmbH (now ITventive AG), Regenstauf
2012 - 2015
Apprenticeship as IT Specialist for System Integration
Pegasus IT GmbH, Regenstauf

Certifications

2026Fortinet NSE 4 and NSE 5
2026HashiCorp Terraform Associate
2021MikroTik MTCRE and MTCTCE
2018Veeam Certified Engineer (VMCE)
2017MikroTik MTCNA
2016Aerohive ACWA and ACWP

Just ping me.

E-Mail LinkedIn