IT Leadership. Architecture. Execution.

Mid-sized company on the Microsoft stack, with M365, SAP, Azure and Copilot as its AI backbone, but without structured IT documentation. Without sources to draw on, Copilot returned generic phrases and outdated SharePoint findings. OneNote, Confluence, Loop and Notion each fell short for different reasons (structure, age, granularity, competing AI silo).

Outline (BSL 1.1) as the wiki foundation for IT documentation, self-hosted as a Docker container in the company's own data center, with Entra SSO sign-in. Used by all IT teams across 6 sites and organized into 9 thematic collections. An AI documentation agent in Copilot Studio supports onboarding, quick search and overviews; an MCP server integration is planned. Compliance profile for ISO 27001 / TISAX / NIS2 through data residency, version history, audit logs and granular permissions. Scope: Outline holds IT documentation; company-wide knowledge lives in the intranet.

Hybrid work needs a reliable view of who is on site when, and which desks and rooms are available. A consistent solution integrated into Microsoft 365 was missing.

Introduction of Microsoft Places, starting as a pilot with three departments (IT Applications, SAP, IT management). Group-based access, a desk and room structure across several buildings, and separate booking rights per desk. Further rollout proceeds step by step through pilot groups.

An automotive OEM requires its suppliers to connect to the Catena-X data ecosystem. This comes with requirements for supply-chain traceability down to individual parts.

Preparing the Catena-X connection: assessing onboarding options, capturing requirements for supply-chain and part-level traceability (including via machine data), and making initial architecture decisions. The initiative is in preparation and not completed.

Export control is a compliance topic with heavy manual effort for mid-sized companies: classification, end-use checks, sanctions list screening. Existing tools on the market are enterprise-heavy and expensive.

Concept and build of a SaaS product for export control compliance. AI-supported classification of goods and end-use indicators, integrated sanctions list screening, a workflow engine for approvals. Stack: TypeScript, Node, a modern frontend, a database layer with audit. My own venture, my own pace.

An on-premises SAP landscape that grew over many years, with extensive custom code and no clean core. AI-supported SAP use cases (Joule, SAP OC) and the 2027 roadmap horizon require a modernized platform.

Developing the target architecture and modernization roadmap for an SAP landscape that grew over many years: SAP on Azure, a clean-core approach with custom-code assessment, an identity and SSO concept, a test strategy, and cutover and hypercare concepts. My role covers architecture and roadmap, not the end-to-end delivery of the program.

The central PLM platform manages product data and development processes. Unlike the EDM platform for CAD and engineering data, its focus is product data and process management. The platform and its runtime environment had to be brought up to date and prepared for the next major release.

Operating and evolving the PLM platform CONTACT CIM Database. Service-level update including migration of the operating system and runtime environment, structured test phases with the business units, and a key-user organization. In parallel, preparing the major-release switch to a web-only client.

Own web properties with clear roles instead of one monolithic personal site. braum.me as a concierge business card (3-second hook), stefanbraum.de as the editorial hub, braum.org as a venture overview, braum.dev as an engineering sandbox. All from one brand and tech line.

Own build of the hub stack on Astro 5, TypeScript strict, Tailwind 4 and @astrojs/node. Forest-green palette as the visual foundation, editorial-first layout. Three.js skill sphere, GSAP entry animations, AmbientShader (lazy via idle callback), DIY SplitText, custom cursor. Self-hosted on Coolify with Docker multi-stage builds. Repos published as OSS on GitHub as sanitized snapshots.

The classic intranet was document-centric, with knowledge spread across SharePoint, Teams, HR tools and process manuals. Finding answers took time. The goal was a modern knowledge layer for company-wide knowledge.

Concept for a modern SharePoint intranet with AI-supported knowledge search: an orchestrator agent with specialized HR, IT and process agents, RAG, source management and governance. The project was designed and fully handed over to the responsible team.

The SAP HCM lifecycle makes modernizing the HR system landscape necessary. HR processes and data are tied to the existing system.

Pre-evaluation of the HR system modernization: comparing SuccessFactors, Dynamics HR and Workday on functionality, TCO and integrations. The result was an initial target architecture, migration options and an IT-side decision paper for management.

Contracts, internal approvals and HR documents relied on printed and scanned signatures. Postal delays, waiting times and media breaks shaped the process. Compliance pressure (traceability, audit trail) was growing.

Introduction of Adobe Sign as the central e-signature tool. Integration into M365 and HR and contract workflows, a use-case catalog with the business units, a rights and template model. Adoption strategy with a wave plan and stakeholder mapping. Alignment with compliance and audit requirements.

Innovation and patent research was manual, slow and concentrated on a few specialists. Competitor monitoring and white-space analysis remained qualitative. R&D needed systematic support from AI-based patent analytics.

Introduction of LexisNexis PatentSight and TechDiscovery as an AI-supported IP platform. Use-case definition together with the innovation and patent leads. Integration into the innovation dashboard, power-user training and a reporting standard for competitor and white-space analyses.

Introducing Microsoft 365 Copilot called for a strategy, defined use cases and an operating model. Practical understanding of what AI can do in day-to-day work had to be built up, also to prevent shadow AI in the business units.

Building the M365 Copilot program from zero to a company-wide agent program. Phase 1: pilot groups, a champions network, licensing and data-protection governance, training, prompt coaching and success measurement. Phase 2: custom agents with use cases in IT, export control, logistics and HR, agent governance, enablers in the business units, feedback loops and an organizational skilling initiative with Microsoft.

IT teams at six sites in six countries worked with different processes, standards and levels of documentation. The service desk needed a structure organized around services rather than systems.

Establishing shared governance and service structures for the IT teams at 6 sites (DE, HU, UA, MK, MX, TN): global IT meetings and regular calls, common standards and documentation requirements. Alongside, continuous improvement of the service desk with a service-oriented category structure and measures to increase user acceptance.

Phishing and social engineering as central risk areas of information security. The goal was a continuous awareness program instead of individual trainings, with maturity reporting to executive management.

Introduction of SoSafe as a continuous awareness program. Multilingual learning content, regular phishing simulations, click-rate tracking and maturity KPIs. Rollout strategy per site, an escalation path for repeated findings, anchored in the ISMS action backlog. The program is continuously developed further, including new modules.

Classic e-learning content is expensive to produce and localize, and hard to keep current. A global workforce across several sites needs training content in several languages, quickly and without a studio setup.

Building an AI-enabled learning platform on Moodle with HeyGen (video AI) and ElevenLabs (voice AI). Content pipeline for avatar-based training videos in 6 languages, without external production. Integration into the learning lifecycle (authoring, review, publishing, reporting). Governance model for voice and avatar clones, including legal clarification.

Growing demand for cloud workloads required a solid, consistent foundation: shared structures, policies and tagging standards that every workload team builds on.

Design and implementation of an Azure landing zone up to level 400. Management groups, subscription layout, naming and tagging standards. Security baseline (policy framework, RBAC, central logging, network and identity integration). Infrastructure as code as the standard for every workload and every configuration: templates, modules, GitOps workflows. Onboarding process between platform and workload teams.

The goal was continuous, round-the-clock detection and response across cloud, on-premises and endpoint environments, with one central view instead of scattered individual sources.

Introduction of a managed security operations center with a specialized provider. Consolidation of cloud, on-premises and endpoint telemetry, detection use cases, response playbooks and continuous tuning. Extended with the same provider's endpoint security and endpoint management solution.

Harmonizing site-specific BCM and crisis management processes and establishing overarching cyber risk governance. Drivers were rising requirements from audits and insurers.

Building a group-wide cyber risk framework (risk inventory, assessment methodology, action tracking). Business continuity plans harmonized, critical business processes prioritized, recovery times defined. Tabletop exercise with executive management and IT leads. Emergency plans and communication templates established.

Reporting was spread across Excel files and local Power BI solutions, without a consolidated view of the global organization. KPI definitions differed by plant and function, and management reports and KPI capture ran largely manually in Excel.

Four building blocks: co-building the Data Analytics & BI team and developing it strategically. A global BI platform with SAP Analytics Cloud, SAP Datasphere/DWC, Power BI and Microsoft Fabric, including migration of local reports, governance and self-service. KPI restructuring with consistent definitions across plants and business units, clear data ownership and consolidation of heterogeneous Excel reports. New: a central KPI data capture platform replaces Excel-based collection, including ISMS, IT and OT KPIs, with automated data flows.

Engineering and CAD data spread across file servers, with local versioning per designer. No vault, no central search, no access or lifecycle model for engineering artifacts. Growing complexity from multi-site design work.

Introduction of Autodesk Vault as the central EDM platform for design data. Connection of CAD tools, migration of existing data, a rights and lifecycle model for parts, assemblies and drawings. Interface to PLM structures and master data in SAP. Training for the design teams.

For a planned acquisition, the IT landscape, risks and integration effort had to be assessed within a fixed time window.

IT due diligence on behalf of executive management: assessment of infrastructure, applications, licenses, contracts, IT security, compliance and staff. The result was a risk analysis and a decision report for executive management.

The IT organization had no dedicated applications team. Applications were looked after between the infrastructure team and the business units. M365, AI and in-house development initiatives needed a dedicated unit with clear responsibilities.

Building a new IT sub-team for applications at ODW-ELEKTRIK from scratch: hiring, onboarding, skill profiles, responsibility matrix, communication into the existing IT organization. Today the team delivers on its own, with six direct reports under my line management and coverage across the global organization.

Modernizing an identity landscape that had grown over time, with site-based directory services, toward a group-wide zero trust architecture with a single identity, MFA, conditional access and SSO.

Design and rollout of a single identity architecture on Microsoft Entra ID. Conditional access as the central policy layer, MFA across the board, SSO for core applications. Identity lifecycle model with clear ownership. Migration and cutover plan across all sites. Authentication methods have been developed further continuously since.

Establishing a unified ISMS and audit structure for an internationally organized IT function. Drivers were customer requirements (TISAX) and an ISO certification roadmap.

Building an ISMS from the ground up: policies, standards, risk management, SoA, document control, role model. Central security processes (incident handling, vulnerability reviews, action tracking). ISMS workflows automated with Power Automate (permission reviews, audit trail, supplier management). Internal audits planned and conducted, external audits supported.

Permissions were managed through manual tickets. The goal was a consistent, traceable identity lifecycle with self-service for the business units, aligned with ISMS requirements.

Introduction of a central IAM platform. Connection of Active Directory, M365, SAP and business applications. Self-service requests with approval workflows, an automated joiner-mover-leaver process, recertification campaigns. Harmonized role model and an audit trail across lifecycle events.

SAP R/3 as the HR/HCM platform was approaching end of life. A brownfield path to S/4HANA was chosen to preserve custom code and process investments. Complex custom Z-objects in the HCM context.

Contribution to selected areas of an SAP HCM brownfield project: supporting the custom-code inventory and the assessment of modifications and interfaces. Project responsibility lay with the dedicated SAP HCM teams.

Shadow IT through Excel macros and one-off automations, with business units wanting to deliver faster. The Power Platform provided a controlled framework for this, but later reached its limits in critical scenarios around scaling, governance and development depth.

2019-2020: building a Power Platform center of excellence with DEV/TEST/PROD, connector governance, licensing, templates, citizen-developer enablement and standards for code reviews and hand-off to pro-code. From 2025: designing a custom container-based process platform to replace the Power Platform, with security by design, RBAC, audit logs, UI/UX, CI/CD, a DevOps operating model and AI-assisted development with quality gates.

On-prem Exchange, Skype for Business, file server islands. Mobile work only possible through improvisation, collaborative document work only through workarounds. COVID pressure accelerated the need for a cloud workplace.

Complete migration to Microsoft 365 as the modern workplace foundation. Exchange Online, Teams (including telephony), SharePoint Online and OneDrive as the platform set. Migration waves with coexistence, a rollback plan and adoption support. File server consolidation into SharePoint with an information architecture.

A mid-sized company with an established on-premises landscape and no formulated cloud and AI roadmap. Customer requirements, compliance and competition increased the pressure on IT to change.

Helping shape the path from an on-premises-driven mid-sized company to the AI-enabled, cloud-first IT setup of a hidden champion. Over the full period: foundation (landing zone, IAM), modernization (SAP, M365), AI integration (Copilot, agents), security maturity (ISMS, SOC). Roadmap 2030 with quarterly reviews, investment planning for IT Applications and enterprise architecture based on TOGAF. An IT organization that has an answer to every business question.