09/04/2026 updated
100 % available
Security Architect | Cloud & Platform Security | FinTech | Zero Trust | DevSecOps
Novi Sad, Serbia
Worldwide
Bachelor's and Master's of Engineering, Bauman Moscow State Technical UniversityZero TrustEnterprise Architecture FrameworkPCI Data Security StandardsZero Trust Network Access
Cloud Security Architecture
End-to-end security architecture for large-scale microservice platforms across AWS, Azure, and GCP, including Zero Trust IAM, Vault secrets management, and multi-cloud disaster recovery with high availability targets.
DevSecOps & Secure SDLC
Formalization of DevSecOps and secure delivery pipelines as organizational policy, including image, secrets, and SCA gates, reducing critical vulnerability exposure from months to approximately 2 hours and blocking critical findings before production.
Compliance & Governance (PCI DSS, ISO 27001, NIST, SOC 2)
Design and delivery of PCI DSS control architecture with evidence packs, security architecture governance across multiple teams, and alignment with ISO 27001, NIST, and SOC 2 frameworks.
Zero Trust IAM
Architecture and implementation of Zero Trust Identity and Access Management using Entra ID, Azure AD, and Keycloak, covering 100% of users and service accounts and eliminating standing privileged credentials.
Secrets Management
Introduction of Vault-based secrets management architecture for large numbers of services, moving from ad hoc rotation to dynamic TTLs and eliminating secret-sprawl incidents.
Threat Modeling & Risk Management
Application of threat modeling and risk management practices as part of security architecture reviews and reference architecture publications across multiple teams and services.
Infrastructure as Code & Policy as Code
Use of Terraform, Infrastructure as Code, and Policy as Code approaches to enforce security baselines and governance across cloud environments.
Kubernetes & Container Security
Security architecture for Kubernetes-based environments including image scanning, secrets scanning, and secure container delivery pipelines.
Incident Response & DDoS Resilience
Design of IR and DDoS architecture that avoided approximately 1-2 days of downtime in multi-day attacks, with MTTR improvements and major incident frequency reduction.
CSPM, CNAPP, SIEM & PAM
Utilization of cloud security posture management, cloud-native application protection platforms, security information and event management, and privileged access management tools within security programs.
End-to-end security architecture for large-scale microservice platforms across AWS, Azure, and GCP, including Zero Trust IAM, Vault secrets management, and multi-cloud disaster recovery with high availability targets.
DevSecOps & Secure SDLC
Formalization of DevSecOps and secure delivery pipelines as organizational policy, including image, secrets, and SCA gates, reducing critical vulnerability exposure from months to approximately 2 hours and blocking critical findings before production.
Compliance & Governance (PCI DSS, ISO 27001, NIST, SOC 2)
Design and delivery of PCI DSS control architecture with evidence packs, security architecture governance across multiple teams, and alignment with ISO 27001, NIST, and SOC 2 frameworks.
Zero Trust IAM
Architecture and implementation of Zero Trust Identity and Access Management using Entra ID, Azure AD, and Keycloak, covering 100% of users and service accounts and eliminating standing privileged credentials.
Secrets Management
Introduction of Vault-based secrets management architecture for large numbers of services, moving from ad hoc rotation to dynamic TTLs and eliminating secret-sprawl incidents.
Threat Modeling & Risk Management
Application of threat modeling and risk management practices as part of security architecture reviews and reference architecture publications across multiple teams and services.
Infrastructure as Code & Policy as Code
Use of Terraform, Infrastructure as Code, and Policy as Code approaches to enforce security baselines and governance across cloud environments.
Kubernetes & Container Security
Security architecture for Kubernetes-based environments including image scanning, secrets scanning, and secure container delivery pipelines.
Incident Response & DDoS Resilience
Design of IR and DDoS architecture that avoided approximately 1-2 days of downtime in multi-day attacks, with MTTR improvements and major incident frequency reduction.
CSPM, CNAPP, SIEM & PAM
Utilization of cloud security posture management, cloud-native application protection platforms, security information and event management, and privileged access management tools within security programs.
Experience
Professional experience5 - 10 years
Freelancer since2026
Languages
GermanGoodEnglishFluentRussianNative speaker
Project history
Architected Zero Trust IAM for 100% of users and service accounts; introduced Vault secrets management for approximately 150 services; published 6 reference architectures; formalized DevSecOps/secure SDLC as organizational policy; owned target-state security architecture for 71 microservices raising availability from 98% to 99.8%; built security architecture governance across 5 teams; delivered PCI DSS control architecture and IR/DDoS architecture.
Created multi-cloud DR and security reference architecture for AWS, GCP, Yandex Cloud, and Selectel for B2B SaaS with approximately 100 clients; established IAM and secrets architecture with Vault, Keycloak, and Azure AD; instituted DevSecOps secure delivery architecture blocking 15+ critical vulnerabilities before production.
Led high-availability, access-controlled AWS security architectures for dozens of tenants; introduced release-control patterns that approximately doubled deploy frequency while sustaining 99%+ availability.