About

Work runs through mixed teams of engineering, ops, product, and domain experts. The self-host streak in the projects below is taste, not solitude.

Digital sovereignty over convenience. Self-hosts what others would outsource, picks tools that aren't designed to lock you in, and runs on infrastructure that isn't hostage to a vendor's quarterly priorities. Bias toward boring, well-understood software that's still working long after the hype cycle has moved on.

Open to relocation to the Netherlands / Randstad area.

Experience

Senior Software / DevOps Engineer · viesure innovation center

Vienna · part of Wiener Städtische (Vienna Insurance Group) · March 2020 – present

  • Started on the backend of Losleben's predecessor, a private-health-insurance-claims PoC released to test the product direction. Worked across every backend domain. The first Losleben release was effectively a rebrand of that PoC, and parts of the original backend still ship in Losleben today, which has held the #1 spot among Austrian insurance apps for 4–5 years since release.
  • Started a claims-automation project for the group's claims service centre (SCPV), which had a backlog of weeks to months on health-insurance claims. Spent two months on requirements engineering with the product owner and an insurance-domain expert (job shadowing, SCPV-employee interviews), then took an IBM mainframe training to be able to build against it. With the mainframe off-limits due to an ongoing migration to SAP, built UiPath terminal-scraping bots on Windows VMs (UiPath Orchestrator) for read/write access. Business logic ran in a Java microservice with rules modelled as BPMN in Camunda, behind a Hexagonal Architecture seam so the eventual SAP cutover would be a clean adapter swap.
  • The PoC went live in production in about 6 months. Pharmacy bills started at 50% automated, climbing to 70% with rule tweaks. Health-insurance bills followed within two months, reaching 60% automation. Most claims were paid out within 1–2 days, which was not standard in Austria at the time and remains rare.
  • When SAP came online, the adapter swap was clean: sharp drops in error rate and runtime versus the screen-scraping era. After extending the automation to dentist bills and other niche categories, dismantled the UiPath layer and handed the service over to twinformatics, the sister IT company that runs production. This was the first viesure project to fully graduate, and it remains the base for their claims automation, now extended beyond health insurance.
  • Back on the Losleben backend team, built the support-chat and document-inbox feature, integrated into Mediatrix (first-level support) so agents see Losleben messages alongside email and social channels, with on-the-fly enrichment attaching internal user data to each message. The feature landed with customers more strongly than anyone expected. A follow-on iteration added digital legal-document delivery into Losleben via SAP DMS polling, replacing snail mail. A parallel Rasa chatbot experiment was dropped as LLMs began to mature. Built it in Kotlin on Spring Boot, switching from the team's Java on Spring Boot default. The first Kotlin service at viesure, and the default for new backend work since.
  • Co-formed an AI task force and spent a year working on it, evaluating AI possibilities and concrete use cases for the company. Worked with Google and Nagarro on technical evaluations and stakeholder presentations, and stood up the company's internal AI sandboxes on GCP (including Gemini Enterprise).
  • Stepped in for a year to cover the SRE/DevOps team while it was short-handed. Responsible for the K8s cluster, the surrounding GCP estate, and the IaC. Major projects that period: company-wide Okta rollout (integration with all services, onboarding everyone, ongoing access requests, user lifecycle, dual internal/external identities), moving off JFrog Artifactory (registries and security scans), migrating IaC from kpt to Helmfile (full rewrite plus easy-to-use Helmfiles for devs), and steady GitLab CI pipeline work and bug-hunting in K8s and GCP.
  • Currently back on AI strategy as the task force has matured. Now in the early phase of a major project to revamp automated claims processing end-to-end, including reshaping long-standing operating models at the partner insurance companies.

Software Engineer · Splendit IT Consulting

Vienna · 2017 – 2020

  • Built and maintained an automated Java source-code refactoring toolchain for migrating codebases across Java versions (Java 7 to 8 plus any-to-any cross-version upgrades). Eclipse JDT plugin for the IDE side, with diff view across touched files and granular rule selection via pre- and user-defined profiles. Paired Maven plugin for CI, configured via YAML.
  • Hundreds of AST-level transformation rules in total, researched and added per Java release. Eclipse's OSGi runtime and the JDT's thin documentation meant most rules required reading JDT source directly to implement them safely.
  • Used by ITSV (Austria's public health insurers' IT arm) and parts of the German Land Mecklenburg-Vorpommern, among others, for production Java version migrations.
  • Alongside product work, ran the company's IT end to end: office networking (including laying physical cables during an office move), a bare-metal Ubuntu server hosting on-prem Jira, Confluence, Bitbucket, and Jenkins, and a company NAS with an offsite replica at the boss's home. Personally responsible for the office security system: cameras, alarms, and the digital key plus fingerprint entry.
  • Represented the product at industry events including Devoxx Paris and smaller Austrian trade fairs. Also delivered a 30-minute conference talk on automated Java refactoring at a Microsoft event in Vienna.

Tutor · TU Wien (Vienna University of Technology)

Vienna · 2014 – 2016

  • Tutor for two courses: Software Engineering and Project Management (SEPM, 4th-semester Bachelor) and Advanced Software Engineering (ASE, 2nd-semester Master). Recruited directly by the professor while still studying for the Bachelor.
  • Graded the individual qualifying project (a fitness filter that opened each course) independently per student via a one-hour oral grading session. Professor only consulted before failing someone.
  • Mentored 2–4 student groups of 4–6 each through a semester-long group project, a real-world simulation running full Redmine (tickets, Gantt, milestones, time tracking) and git.
  • Held one to two hour-long meetings per group each week for guidance. Bi-weekly internal reviews evaluated code, documentation, and project-management data, feeding the professor's management review. Joint grading at the final presentation closed the semester.
  • Also supervised the written exams for the theoretical part of both courses.

Summer Software Engineer · EBS Smart Solutions Software

Lienz, Austria · 1–2 months each summer · 2007 – 2016

  • Ten consecutive summers at the same company across HTL and university years. The first two fulfilled the 8-week mandatory internship required for HTL Matura, the rest were voluntary paid work across multiple IT disciplines.
  • Reverse-engineered AutoCAD's mostly undocumented C# plugin layer (in a debugger, one API call at a time) to build a bidirectional sync between AutoCAD drawings and the in-house ERP via local MSMQ. Shipped as beta.
  • Built the EDIFACT import/export module. The initial C# fat-client implementation proved too slow, so moved the full pipeline (accumulation, filtering, EDIFACT generation) into T-SQL stored procedures with the client reduced to invoking them. Export time dropped from minutes to seconds.
  • Wrote T-SQL stored procedures for the Mentor / Neccton gambling-monitoring product, used by Österreichische Lotterien on win2day.at and now deployed widely across Europe. Same summer also covered smaller BI/DWH stored procedures for other customers.
  • Tasked with picking the company's cross-platform mobile tooling when there was no mobile team and no hires available. Evaluated C# and JavaScript-based cross-compilers that targeted iOS and Android while exposing device-specific APIs. The recommendation was adopted and remained in production until displaced by newer frameworks.

Personal projects

Bare-metal homelab

Two-node Proxmox VE cluster running a three-node Talos Linux Kubernetes cluster (1 control plane, 2 workers), a TrueNAS Scale VM with NVMe passthrough for storage, and GPU-passthrough gaming VMs alongside. End-to-end bootstrap is OpenTofu: it creates the Proxmox VMs, generates and applies Talos configs, bootstraps etcd, then installs FluxCD pointed at the cluster GitOps repo. From that point on, day-2 changes happen above the GitOps line. UEFI and secure boot with TPM-backed disk encryption, dual-stack IPv4/IPv6, Longhorn for distributed block storage. Restic to a Hetzner Storage Box for offsite backups, with backup health alerts piped through Telegram. Helm charts I maintain are published to a private Scaleway OCI registry and consumed by Flux from the cluster side. Source: codeberg.org/webmatix/homelab.

Cluster GitOps tree

The other half of the homelab. Everything that runs inside the Talos cluster, reconciled by FluxCD. Layered Kustomize bootstrap, from networking and storage operators up through identity, observability, and applications, with explicit dependsOn chains so cert-manager, Traefik, and CloudNativePG come online before anything that needs them. Ingress is two Traefik instances (internal on a MetalLB IP, external) with cert-manager and Let's Encrypt via deSEC DNS-01. Identity is Authentik (OIDC, SAML, LDAP) in front of every UI. Secrets resolve from 1Password via External Secrets Operator and 1Password Connect, so nothing real lives in the repo. Apps include Immich, Paperless-NGX, Collabora Online, Umami, plus Traefik ingress proxies for off-cluster services (Jellyfin, the arr-stack, Garage S3). Source: codeberg.org/webmatix/flux.

dotrig

Single-binary Go CLI that brings Kubernetes-style GitOps to workstation setup. Replaces a 162-role Ansible setup with a DAG-driven, concurrent, drift-aware engine. Reads a declarative config repo (apps, profiles, machines), builds a topo-sorted DAG, walks it concurrently. Provider-batched installs aggregate every formula from contributing apps into one brew install call. Configs render through Go templates with hierarchical var merge. Drift detection runs on sha256 hashes kept in state.json, concurrent applies serialise on a file lock, and runs cancel cleanly on SIGINT via context. Providers declare what they need themselves (the mas brew formula, the 1password-cli apt package), and the engine preflight-installs those before any user DAG node runs. Stdlib first: cobra for CLI, yaml.v3 for decode, go-git/v5 for in-process clone so a fresh box does not need system git. One audited shell-out seam, one filesystem-write seam, one state-write seam, and no goroutines outside the DAG runner. Not ready, untested outside my own machines. Names, flags, and on-disk state format will change without notice. Source: codeberg.org/dotrig/dotrig.

dotrig-config

The data half of the dotrig GitOps loop. Declarative YAML plus template and verbatim sources describing every app dotrig installs on my workstations, with per-host machine selectors and composable profiles (extends: and excludes:, diamond-safe). Mirrors the same engine-versus-state split as the homelab and flux pair. Secrets are referenced as op://... paths and resolved at apply time through the engine's {{ resolve }} template function, so templates stay provider-agnostic and flipping a literal to a 1Password-backed value is a YAML edit, not a template change. Source: codeberg.org/dotrig/dotrig-config.

Core technologies

  • Kubernetes
  • Talos Linux
  • FluxCD
  • Helm
  • Kustomize
  • GitOps
  • Traefik
  • cert-manager
  • MetalLB
  • Linkerd
  • Authentik
  • Proxmox
  • OpenTofu
  • TrueNAS
  • Docker
  • Go
  • Java
  • Kotlin
  • Spring Boot
  • Bash
  • GitLab CI
  • Hexagonal Architecture
  • BPMN
  • Camunda
  • CloudNativePG
  • Restic
  • Prometheus
  • Grafana
  • GCP

Education

Austrian HTL Matura (EQF Level 5): Reifeprüfung-Certificate and VET-Diploma in Electronic Data Processing and Organisation, specialising in Commercial Data Processing. HTL Villach (Technical College), 2007–2012.

TU Wien (Vienna University of Technology): Software and Information Engineering, BSc, 2012–2017. Did not complete. Full-time work and a curriculum transition made finishing impractical.