SYSTEM ONLINE SECTOR // DIGITALSCHLAG.DE --:--:-- UTC

[ SECURITY OPERATIONS // PERSONAL TERMINAL ]

DIGITALSCHLAG

STEFAN LICHTENSTERN // SENIOR SECURITY PROFESSIONAL // SOC TECHNICAL LEADERSHIP

MISSION BRIEF

BUILD THE OPERATING MODEL. AUTOMATE THE ROUTINE. ESCALATE THE SIGNAL.

Design, operate and evolve Security Operations where architecture, telemetry, detection, automation and human analysis work as one system.

01 / DEPLOYMENT SYSTEMSSCHEMATIC // DS-01
Green CRT-style technical schematic of a fictional modular deployment craft.
DEPLOYMENT CRAFTTACTICAL / MODULAR / FIELD SUPPORT
02 / PROFILEHUMAN OPERATOR

Security Operations built as a system: architecture, detection, automation, process and analyst judgement.

My path spans anti-abuse investigations, Linux and enterprise infrastructure, automation, malware analysis and Security Operations. Today my focus is the technical and functional leadership of SOC environments, the architecture and evolution of managed security services, and the engineering required to make operations scalable without losing analytical quality.

I approach SOC work from below the security layer as well: protocols, operating systems, infrastructure and automation matter when an alert becomes an incident and context decides what happens next.

SOC ARCHITECTURESOC AS A SERVICEINCIDENT RESPONSETHREAT HUNTINGDETECTION ENGINEERINGSECURITY AUTOMATIONSIEM / EDR / XDR
MOTION TRACKERGRID 07
CONTACTS03 VECTOR317° PROXIMITYCLOSE STATUSTRACKING
03

CORE OPERATIONS

ARCHITECT // DETECT // AUTOMATE // RESPOND

01

SOC ARCHITECTURE

Design operating models, service boundaries, customer integrations and technical workflows that remain usable under real operational load.

[ DESIGN ]
02

DETECTION & RESPONSE

Correlate telemetry, engineer detections, investigate incidents, hunt for threats and drive response from signal to controlled outcome.

[ RESPOND ]
03

AUTOMATION & ORCHESTRATION

Build API integrations, analyst workflows and automation frameworks that remove repeatable work while preserving analyst control.

[ ORCHESTRATE ]
04

TECHNICAL LEADERSHIP

Set technical direction, prioritize operational work, resolve complex escalations and continuously improve SOC efficiency and service quality.

[ LEAD ]
COMMAND LOGLIVE
00:00 // TELEMETRY BUS ONLINE
00:01 // ENRICHMENT PIPELINE READY
00:02 // UNKNOWN SIGNAL ON GRID 07
00:03 // CORRELATED ACTIVITY CONFIRMED
00:04 // ANALYST WORKFLOW INITIALIZED
00:05 // RESPONSE PATH ARMED

>
04

SOC BUILD-UP // 2017-2024

GROUP-WIDE SECURITY OPERATIONS // GLOBAL SCOPE

PROGRAM RECORDSCHWARZ GROUP
2017-2024

BUILDING A GROUP-WIDE SECURITY OPERATIONS CAPABILITY

Contributed to the build-up and continuous development of a Security Operations Center for the globally operating Schwarz Group. The work covered the full technical and operational range of SOC activities: monitoring, triage, incident response, malware analysis, threat intelligence, detection engineering, threat hunting and security automation.

A recurring engineering goal was to turn repeatable analysis and response steps into reliable automation while keeping complex decisions visible to analysts.

SOC BUILD-UPGLOBAL OPERATIONSMALWARE ANALYSISTHREAT INTELLIGENCEDETECTION ENGINEERINGINCIDENT RESPONSETHREAT HUNTINGSECURITY AUTOMATION
CASE 01 / AUTOMATED MALWARE ANALYSISPIPELINE
01INGESTSUSPICIOUS SAMPLE
02QUEUEWORK DISTRIBUTION
03SANDBOX CLUSTERMULTIPLE ON-PREM ENGINES
04CORRELATERESULT AGGREGATION
05CLASSIFYAUTOMATED DECISION
06MISPTI EVENT / IOC RECORD

Queue-based processing distributed samples across multiple on-premises sandboxes, correlated their analysis results and executed automated malicious/benign classification before publishing confirmed findings and indicators to MISP.

CASE 02 / URL & E-MAIL BLACKLISTINGAUTOMATED RESPONSE
INDICATOR>ENRICH>ASSESS>DECIDE>ENFORCE

Established automated URL and e-mail blacklisting workflows to move validated indicators from analysis into protective controls with minimal manual handling.

05

OPERATIONAL RECORD

INFRASTRUCTURE // SECURITY // AUTOMATION // SOC LEADERSHIP

CURRENT ASSIGNMENTACTIVE DUTY
JUL 2025 - PRESENT

SHE // SENIOR SECURITY PROFESSIONAL

SOC TECHNICAL LEADERSHIP

Technical and functional SOC leadership with responsibility for SOCaaS architecture, service development and operational processes. Highest technical escalation level; engineering of automation frameworks, API integrations and AI-assisted analyst workflows; standardized CrowdStrike Falcon Next-Gen SIEM customer integrations; Incident Response, Threat Hunting and Detection Engineering.

01
SHE INFORMATIONSTECHNOLOGIE AG2025 - PRESENT // SOCaaS / MSS

SENIOR SECURITY PROFESSIONAL // SOC TECHNICAL LEADERSHIP

Architecture and evolution of managed SOC services, technical leadership, complex escalation handling, automation and API integration, AI-assisted analyst workflows and standardized customer onboarding for CrowdStrike Falcon Next-Gen SIEM.

SOCaaSTECHNICAL LEADERSHIPCROWDSTRIKE FALCONNG-SIEMAPI INTEGRATIONINCIDENT RESPONSETHREAT HUNTINGDETECTION ENGINEERING
02
MIRO MINERALOELRAFFINERIE OBERRHEIN2024 - 2025 // INDUSTRIAL SECURITY

IT SECURITY OPERATIONS ENGINEER

Security Operations and security engineering in an industrial enterprise environment with operationally critical infrastructure.

SECURITY OPERATIONSSECURITY ENGINEERINGINDUSTRIAL ENVIRONMENT
03
SCHWARZ GROUP2017 - 2024 // ENTERPRISE / GLOBAL

SOC BUILD-UP // SECURITY OPERATIONS // CYBER DEFENSE

Build-up and technical development of group-wide Security Operations at global scale. Broad SOC responsibility across monitoring, malware analysis, threat intelligence, automation, detection, incident response and threat hunting.

SOC BUILD-UPGLOBAL SCALEMISPMALWARE ANALYSISSECURITY AUTOMATIONDETECTION ENGINEERING
04
ARAGO2017 // AUTOMATION

AUTOMATION ENGINEER

Automation engineering for complex IT systems and cross-system operational workflows.

AUTOMATIONSYSTEM INTEGRATIONOPERATIONS
05
TIPICO / BOOXWARE2016 - 2017 // SECURITY

IT SECURITY ANALYST

Security analysis and operational security work in a production-driven internet environment.

SECURITY ANALYSISOPERATIONSTHREAT DETECTION
06
INOVEX2011 - 2015 // INFRASTRUCTURE

LINUX SYSTEM ADMINISTRATOR

Built and administered company-wide IT infrastructure including Zabbix monitoring, Zimbra, Openfire, clustered pfSense firewalls and redundant WLAN infrastructure using EAP, LDAP and RADIUS.

LINUXZABBIXPFSENSELDAP / RADIUSINFRASTRUCTURE
07
1&1 / UNITED INTERNETCLOUD CORE SERVICES

LINUX SYSTEM ADMINISTRATOR

Administration of key platform services in the 1&1 cloud environment, including storage and online-office services used across 1&1, WEB.DE and GMX.

LINUXCLOUD SERVICESCORE INFRASTRUCTUREPRODUCTION OPERATIONS
08
1&1 INTERNET AG2008 - 2010 // ANTI-ABUSE

ANTI-ABUSE ANALYST // ADVANCED

Investigated and secured compromised customer websites and servers across 1&1, WEB.DE and GMX. Handled abuse cases involving spam, phishing, hacking, malware and DDoS, developed automation scripts and coordinated across technical, fraud, legal and communications interfaces.

ANTI-ABUSEPHISHINGMALWAREDDOSINCIDENT ANALYSISSCRIPTING
ROLE VECTORCAREER PATH
ANTI-ABUSE ANALYSIS LINUX INFRASTRUCTURE SECURITY ANALYSIS AUTOMATION ENGINEERING SECURITY OPERATIONS SOC TECHNICAL LEADERSHIP
TECHNICAL FOUNDATIONIHK
SOFTWARE DEVELOPMENT

FACHINFORMATIKER // ANWENDUNGSENTWICKLUNG

Software development, infrastructure and automation form the technical foundation behind my approach to Security Operations.

06

TECHNICAL ARCHIVE

DIGITALSCHLAG CONCEPT SCHEMATICS

A1 / CONTROL DECKOPERATIONS
Green CRT-style cutaway schematic of a fictional operations deck with consoles and displays.
CONTROL DECK // OPERATOR STATION
A2 / AIRLOCKFACILITY
Green CRT-style technical schematic of a fictional pressure airlock.
AIRLOCK // PRESSURE TRANSITION
A3 / TRANSPORTLOGISTICS
Green CRT-style technical schematic of a fictional modular transport craft.
TR-01 // MODULAR TRANSPORT
A4 / SECURITY UNITCONCEPT
Green CRT-style technical schematic of a fictional bipedal security unit.
SU-01 // BIPEDAL SECURITY UNIT
07 / CONTACTOPEN CHANNEL

[ IDENTIFICATION ]

STEFAN LICHTENSTERN

SENIOR SECURITY PROFESSIONAL // SOC TECHNICAL LEADERSHIP

HOSTDIGITALSCHLAG.DE
LOCATIONLUDWIGSHAFEN AM RHEIN // GERMANY
PROFILEXING // STEFAN LICHTENSTERN
CHANNELPROFESSIONAL CONTACT