Software Security Engineer — DevSecOps · Zero Trust · Cloud Security · Kubernetes

I design and build secure distributed systems — from Zero Trust architectures and Kubernetes hardening to developer-facing security tooling. I care about making security a first-class engineering concern, not an afterthought.

🌐 mfuchs.dev · 📝 Blog

I'm a Software Security Engineer with roots in SRE and software engineering. My work sits at the intersection of distributed systems and security, where reliability, trust, and resilience aren't trade-offs but design goals.

I've architected Zero Trust network models, hardened Kubernetes clusters, and built developer-facing security tooling that doesn't slow teams down. I've led IAM and OAuth2/OIDC integrations at scale, using Keycloak and custom authorization policies to enforce least-privilege access across microservice meshes.

I believe security belongs in the delivery pipeline, not bolted on at the end — threat modeling early, shifting left with SAST/DAST, and treating every deployment as an opportunity to reduce attack surface.

• 🔐 Focus Areas: Security · Cloud
• 🛠️ Primary Stack: Go · Kotlin · Java
• 🧭 Expertise: Zero Trust · IAM · Kubernetes
• 📡 Background: SRE · Software Engineering

🔐 Security Threat modeling, Secure Development Lifecycle, secure coding, security awareness. Zero Trust OAuth2 / OIDC Keycloak SAST / DAST mTLS WAF OWASP Top 10 Secrets Management

☁️ Cloud & Infrastructure Kubernetes-native security, cloud hardening, IaC, observability. Kubernetes Helm Terraform AWS GCP OPA / Rego Istio Prometheus OpenTelemetry

⚙️ DevSecOps Shift-left security, CI/CD hardening, policy-as-code. GitHub Actions Trivy Snyk Cosign SBOM Supply Chain Security Policy as Code GitOps ArgoCD

🏗️ Architecture Distributed systems design, microservices, resilience patterns. Microservices Event-Driven Go Kotlin Quarkus Java Spring Boot Gin Keycloak Shibboleth API Gateway Service Mesh

• Rescue Smart — Website for a first aid training provider offering DGUV-compliant occupational first aid courses, refresher training, and AED/emergency scenario instruction. Next.js TypeScript Tailwind CSS Resend Vercel
• B&K Arbeitsschutz — Corporate site for a DEKRA-certified workplace safety consulting firm near Munich. Next.js TypeScript Tailwind CSS Resend Vercel
• Kreisjugendfeuerwehr Starnberg — Regional platform coordinating 43 youth fire brigades and 600+ members, with a password-protected member area and secure PDF downloads. Next.js TypeScript Tailwind CSS Resend Vercel

Plus professional work spanning e-commerce platforms on GCP/StackIT, university IAM platforms (Keycloak & Shibboleth), fullstack client projects, and Zero Trust research at a university SecLab.

• 2026 · Meetup Munich — Zero Trust with Keycloak: How to Securely Integrate IAM into Microservices Architectures
• 2025 · heise devSec — Zero Trust with Keycloak: Securely Integrating IAM into Microservice Architectures
• 2023 · UniNow — Zero Trust Architecture & Passkeys: The Duo Against Lateral Movement
• 2023 · ZKI IAM — Passkeys: The Future of Authentication in Shibboleth with privacyIDEA
• 2023 · ZKI IAM — Security and Convenience: How Tailscale Reimagines Admin Access
• 2022 · heise devSec — Beyond OAuth 2.0 and OpenID Connect: Hidden Features in Keycloak
• 2022 · Meetup Munich — DevSecOps - Securing Your Web App in Three Simple Steps