I keep IT running for 400 people in five countries.

• Promoted to Team Lead at Salesfive 15 months after joining. Now leading a team of three, responsible for IT operations for about 400 users in the UK, Austria, Germany, Switzerland and Croatia.

• Planned and delivered the full IT integration of ESR Labs into Accenture Industry X: about 280 users across four locations in Germany.

• Introduced just-in-time admin rights for all systems, reducing standing privileged access.

• Migrated email, calendar, Google Drive and SharePoint for acquired companies, from stocktake and migration planning through to cutover.

• Contributed to ISO 27001 and TISAX certification, and ran regular disaster recovery tests with Veeam.

• Promoted to Specialist at Accenture / ESR Labs 27 months after joining.

1. 04/2024 to today

   IT Systems Administrator & Team Lead

   Salesfive GmbH · Team Lead since 07/2025

   • Technical and disciplinary lead of an IT team of three (two employees, one working student), running IT for about 400 users in five countries.
   • Integrating the systems and IT processes of acquired companies into the existing infrastructure.
   • Rolled out and runs macOS MDM with Iru (formerly Kandji), synchronised with Microsoft Entra ID, including device compliance.
   • Administers Microsoft 365, Entra ID (SSO, MFA, Conditional Access, passkeys, guest access), Intune and Defender for Endpoint.
   • Automates internal processes and the helpdesk with n8n, integrating Slack, Microsoft, Atlassian and GitHub.
   • Co-maintains the infrastructure-as-code environment (Ansible, Terraform / OpenTofu) on Proxmox.
   • ISO 27001: built and maintains ISMS processes, coordinated audit preparation and the penetration test.
   • Owns IT procurement, licence and contract management, and, with the CTO, the IT hardware and software budgets.

2. 11/2024 to 10/2026

   IT Engineer (part-time, alongside)

   Vistafon GmbH / MVC Videra

   • IT consulting for staff and management.
   • Administered Microsoft 365 (Entra ID, Exchange, Intune, Defender), Atlassian and servers.
   • Delivered projects including a Microsoft tenant-to-tenant migration.

3. 09/2019 to 03/2024

   IT Systems Administrator

   ESR Labs GmbH (part of Accenture Industry X) · Specialist from 12/2021

   • Planned and executed the full IT integration into Accenture Industry X: about 280 users, four locations in Bavaria.
   • Responsible for the build and VM infrastructure.
   • Ran Debian, Ubuntu and Windows Server 2019/2022, VMware and Proxmox, monitored with Icinga 2 and Grafana.
   • Ran backups with Veeam and Synology Hyper Backup, including regular disaster recovery tests.
   • Administered the network (Aruba, Sophos, FortiGate) and troubleshot it with tcpdump and Wireshark.
   • Automated infrastructure with Ansible, Python and Bash.
   • Contributed to ISO 27001, TISAX and BSI Grundschutz audits; found and fixed vulnerabilities with Nessus.
   • Mentored IT and DevOps colleagues, including internal talks and training sessions.

4. 01/2015 to 10/2024

   IT Administrator (part-time)

   Physikalische Therapie Liedtke (physiotherapy practice)

   • Supported and administered the IT of two practice locations, including all workstations.
   • Designed and maintained the backup and recovery concept.
   • Set up and ran site-to-site connectivity between both locations.

1. 1

   Renovate

   Opens update pull requests every Saturday for everything that is pinned: Actions, collections, providers, container images and release versions. Nothing merges automatically.

2. 2

   Claude Code reviewer

   An agent on its own VM reviews each Renovate PR against this infrastructure and comments what changes, which breaking changes affect us, and the impact: a safe version bump or one that needs work.

3. 3

   Pull request

   Every change, mine included, goes through a pull request. Nobody pushes to main.

4. 4

   CI checks

   yamllint, ansible-lint on the production profile, tofu fmt and a check that every vault file is encrypted. All required before merging.

5. 5

   Plan and approve

   After the squash merge the pipeline verifies provenance and posts the Tofu plan, the affected hosts and a check-mode preview on the PR. Nothing is applied until I comment /apply.

6. 6

   Self-hosted runner

   A GitHub Actions runner on its own VM applies the plan, then runs Ansible only on the hosts the change affects.

7. 7

   OpenTofu

   Each VM is one YAML file: CPU, memory, disk, network and roles. OpenTofu clones it from a cloud-init template. State sits in an encrypted Postgres backend.

8. 8

   Ansible

   Finds VMs through the Proxmox inventory and installs roles from their tags. Every run is idempotent: a second run reports zero changes, in check mode too.

9. 9

   Two Proxmox nodes

   One node at home, one in the cloud, joined by a WireGuard tunnel.

10. 10

    One VM per service

    Ubuntu baseline with hardened SSH and a host firewall. Every service runs in its own VM, on separate networks for LAN, servers and DMZ.

11. 11

    Services

    Reverse proxy with Let’s Encrypt certificates, CrowdSec, a game server panel, browser-based remote access, container management and databases.

12. 12

    Family & friends

    Real users: the self-hosted services are used by family and friends.

Education, certifications and languages