Lead Software Architect at Mercedes-Benz Group AG - Tech4IL & Litigation Operations
Our Center of Competence (CoC) serves as a central IT partner for
corporate functions including Legal, eDiscovery, Corporate
Compliance and Data Protection, Taxes, Customs, and Corporate
Strategy. We drive process optimization
through secure, scalable, and innovative IT solutions. Our
department owns end‑to‑end responsibility across the application
lifecycle, including demand management, requirements engineering,
solution architecture, cloud‑based implementation, CI/CD,
deployment, IT service management (ITSM), operations, and continuous
improvement, with a strong focus on enterprise architecture,
governance, DevOps, security, compliance, and agile software
development.
As technical leader, I act
as a key architectural interface between product teams, internal
stakeholders, and external partners to shape the enterprise software
and platform strategy. I use my expertise to
support my department in requirements analysis, the development of
solution concepts and the implementation of information security
requirements. My tasks are
performed in coordination with the digital strategy of the
respective department or the overarching corporate IT strategy. At
the same time, I provide active input to my team for the
digitization of departmental processes and point out improvements
and opportunities in the digital working world of
Mercedes-Benz.
I also ...
- Lead software development and manage external suppliers for the
digitization of the group-wide Records of Processing Activities
(RoPA)1 as well as the global Privacy Management
Application (PrIMA)2, and BaFin Insider
List3. My duties include:
- 1)
ownership of all aspects during the software
lifecycle, including adherence with information security and
data protection requirements, budget management,
and procurement of infrastructure,
- 2) continuous improvement of
enterprise‑scale microservice architectures and DevOps
toolchains in alignment with business and stakeholder
requirements to enable fast, reliable, and high‑quality
software
delivery,
- 3) embedding security, compliance, and governance
requirements
into software and platform architectures by applying
DevSecOps
principles across the entire software development lifecycle,
- 4)
definition of architectural best practices for monitoring,
observability, and incident management to proactively
identify
performance bottlenecks and ensure application quality,
stability, security and reliability,
- 5) outline technical
requirements, onboarding of new apoplications, API design
and
procurement of infrastructure.
- Support various investigation processes within the scope of the corporate forensics center in cooperation with the corporate security team and the investigating units (including Audit, Legal, HR). In this context, as IT Case Manager, I act as the central coordination function within the global IT and ensure that necessary data is secured and made available worldwide in a legally required manner.
- Ensure the operation of the Custodian Administration Tool (CAT)4 in the eDiscovery IT landscape. In particular, the implementation of the necessary flagging of the custodians in the directory as well as the automated communication with the custodians to ensure compliance with legal requirements on my own responsibility.
- Provide technical specifications (patching of the IT landscape, as well as access protection). If required, I also support other project managers in their project for a successor solution of the current legal and corporate data privacy software.
- Establish further development of the internal eDiscovery and data protection and compliance IT landscape including forensic hardware and software with my colleagues.
- Prepare presentations for top management and create (technical) software documentations for cooperating business units.
- Take on the role of Security Champion and support information
security related audits, penetration testing, and security
profiles. I also:
- 1) define and implement enterprise IT security strategy and architecture, ensuring compliance with A.22/RISE and digital regulations for customer‑facing digital products,
- 2) advise internal stakeholders on central IT security solutions and regulatory compliance ( NIS2, GDPR/DSGVO, CRA, EU AI Act ), translating legal requirements into security controls,
- 3) conduct and support cyber threat analysis, threat modeling, and threat intelligence, integrating cyber‑domain threats into architectural decisions,
- 4) identify vulnerabilities in existing and planned architectures, derived mitigation measures, and validated security control effectiveness,
- 5) support for externally conducted security assessments, and undergo IT security trainings, ensuring implementation of internal security requirements.
Achievements
- As PhD candidate, I've published several scientific papers in leading journals on automotive cybersecurity, artificial intelligence, and intrusion detection.
- I've successfully completed five enterprise DevSecOps training programs (~80 hours total), covering secure software architecture, DevSecOps principles, CI/CD security, cloud and application security, compliance, and security governance, with formal certification awarded for each training.
- As technical owner, I supported the 2021 company-wide Automated Data Deletion5 including more than 330 entities worldwide. I successfully pushed and managed the implementation of the central Exception Management Tool (AVT)6 for our Corporate Data Protection (CDP) team.
- Within only one month, I successfully migrated a CaaS (Containers as a Service) based application to our standardized PaaS (Platform as a Service). This migration resulted in a 70% reduction in infrastructure operating costs and allowing developers to focus mainly on business application development letting the PaaS manage the runtime and all lower layers.
- Thanks to the can-do attitude and goal-driven work with colleagues from Corporate Security, I was able to roll-out our Forensic Management System (eForensics)7 in only 2.5 months from start to production. I am glad that together with the business unit we mastered the project in such a short time with all the hurdles and were able to go live as planned in November 2021.
- In order to validate my proficiency in eDiscovery, adding more value to our organization, and distinguish myself in the industry, I successfully attended trainings in case administration, processing, active learning and analytics with Relativity8.
- I successfully pitched my projects to our CIO and the works council.
- More to come. :)
2 Privacy Incident Management Application (PrIMA): Group-wide solution to raise, track, and manage potential data protection incidents.
3 The BaFin insider list is a mandatory register required under Article 18 of the Market Abuse Regulation (MAR) for companies whose financial instruments are traded. It documents all persons who have access to price-sensitive, non-public information. Issuers must maintain these lists electronically (in accordance with DVO 2016/347) and submit them to BaFin upon request.
4 Custodian Administration Tool (CAT): End-to-end management tool of custodian related activities.
5 Experience shows that data in companies is often stored for indefinite periods and is never deleted if there is no regulation limiting the storage period. Often, much of this data is no longer needed or rapidly becomes obsolete. This leads to a continuous increase in the total volume of data stored on the servers as well as an increase in costs – not only due to the storage capacity required but also to data management. The huge amount of data also interferes with performance of the IT systems and efficient workflows. Furthermore, in the case of personal data, data protection regulations – such as the EU’s GDPR – require that such data may only be stored as long as is necessary for the respective purpose.
6 Ausnahmeverwaltungstool (AVT): Successor of the group-wide data retention to manage the retention process (identification of fileshares and SiteCollections (SharePoint) and requesting exceptions). AVT is a .NET tool, partly hosted as Application Consolidation (ApCos) Microsoft Service.
7 Forensic Management System (eForensics): Python-based (Django framework) application hosted as Software-as-a-Service (SaaS). eForensics is used for managing and documenting of IT forensic investigations, as well as collections and imaging of evidence items.
8 Relativity is a complete eDiscovery platform that helps legal teams solve complex data problems during litigation, investigation, and compliance projects. It comes with a set of tools executing on each step of the process on-premise and in the cloud.
