$ whoami

Michael Fuchs

Software Security Engineer

▌

I design and build secure distributed systems from Zero Trust architectures and k8s hardening to developer-facing security tooling. I care deeply about making security a first-class engineering concern, not an afterthought.

View ProjectsGet in Touch
scroll

$ cat about.md

About Me

I'm a Software Security Engineer with roots in SRE and software engineering. My work sits at the intersection of distributed systems and security where reliability, trust, and resilience aren't trade-offs but design goals.

I've architected Zero Trust network models, hardened Kubernetes clusters, and built developer-facing security tooling that doesn't slow teams down. I've led IAM and OAuth2/OIDC integrations at scale, using Keycloak and custom authorization policies to enforce least-privilege access across microservice meshes.

I believe security belongs in the delivery pipeline not bolted on at the end. That means threat modeling early, shifting left with SAST/DAST, and treating every deployment as an opportunity to reduce attack surface. I enjoy helping engineering teams build that instinct from the ground up.

Focus Areas

Security · Cloud

Primary Stack

Go · Kotlin · Java

Expertise

Zero Trust · IAM · K8s

Background

SRE · Software Eng.

$ cat skills.json | jq

Expertise

🔐

Security

Threat modeling, Secure Development Lifecycle, Secure Coding, Security Awareness.

Zero TrustOAuth2 / OIDCKeycloakSAST / DASTThreat ModelingmTLSWAFOWASP Top 10Secrets Management
🤖

GenAI Security

Securing AI coding agents and LLM-powered workflows: trust boundaries, prompt injection, tool permissions, and safe review practices.

Prompt InjectionCoding AgentsAgent PermissionsRules File BackdoorsSlopsquattingModel PoisoningMCP SecurityAI Code Review
🔗

Supply-Chain-Security

Protecting the path from dependency to deployment: provenance, signed artifacts, SBOMs, and hardened build pipelines.

SBOMCosignSLSATrivyDependency ReviewArtifact SigningProvenance
☁️

Cloud & Infrastructure

Kubernetes-native security, cloud hardening, IaC, observability.

k8sHelmTerraformAWSGCPOPA / RegoIstioPrometheusOpenTelemetry
⚙️

DevSecOps

Shift-left security, CI/CD hardening, policy-as-code.

GitHub ActionsCI/CD HardeningSnykPolicy as CodeGitOpsArgoCD
🏗️

Architecture

Distributed systems design, microservices, resilience patterns.

MicroservicesEvent-DrivenGoKotlinQuarkusJavaSpring BootGinKeycloakShibbolethAPI GatewayService Mesh

$ grep -R projects/

Selected Work

Security Architecture Reviews

Several security architecture reviews for clients under NDA: medical devices with high patient-safety impact, IoT devices together with their cloud backends, and the validation of an API and access concept for the identity provider of a public hyperscaler.

  • Medical device threat modeling with STRIDE & MITRE ATT&CK
  • End-to-end review of IoT devices and their cloud
  • Validation of API & access concept for a hyperscaler IdP
Threat ModelingSTRIDEMITRE ATT&CKIoTCloud SecurityIAMOAuth2/OIDCAPI Security

Stock distribution at international e-commerce platform

Development and operation of several applications for advertising campaign and stock data management on an international e-commerce platform built on GCP and a sovereign European cloud, for a client under NDA.

  • Renovate-driven dependency management
  • Threat-Modeling & CI/CD security gates
  • Automated core business processes
KotlinJavaSpring BootKtorGCPSovereign CloudTerraformAngularVueTypeScript

IT Platform & IAM at an university

Operation, scaling, and automation of central university IT platforms with full DevSecOps focus and cloud-native IAM integration. Enforced Privacy & Secure by Design principles mandated by university policy.

  • Keycloak & Shibboleth IAM integration
  • Cloud-native migration of legacy systems
  • GitLab CI/CD with IaC (Terraform + Ansible)
KeycloakShibbolethKubernetesTerraformAnsibleGitLabAWSKotlinGo

Several fullstack Client Projects

Fullstack development across multiple clients: legally-admissible incident log for DRK, SPAs for a major automotive OEM, cloud migrations, and a shareholder identification platform.

  • OAuth2/OIDC with Keycloak
  • On-premise to GCP cloud migration
  • Secure coding per internal guidelines
Spring BootReactTypeScriptKeycloakDockerk8sGCPAWS

Zero Trust Research at University

Security research on identity and authentication in academic environments within the scientific group SecLab. Evaluated Zero Trust approaches and built proof-of-concept secure software architectures.

  • Zero Trust evaluation framework
  • PoC secure software architectures
  • Scientific publications & conference talks
KeycloakShibbolethZero TrustIdentity ManagementPython

Zwischenzeit

Unofficial native iPhone, iPad & Apple Watch calendar for therapists using the TTools practice software. Shows the practice day at a glance between two patients, with check-in status, prescription progress and treatment documentation. Privacy-first, since it handles real patient health data.

  • Threat model, Face ID lock & no on-device persistence
  • Watch app & complication without credentials
  • Zero third-party dependencies, CodeQL & OpenSSF Scorecard
Swift 6SwiftUIwatchOSWidgetKitSwift TestingGitHub Actions

B&K Arbeitsschutz

Corporate website for a DEKRA-certified workplace safety consulting firm based near Munich. Covers occupational safety supervision, a training academy, equipment testing services, fire safety consulting, and personal protective equipment.

  • Full service & academy overview
  • DEKRA-certified partner presence
  • Deployed on custom domain
Next.jsTypeScriptTailwind CSSResendVercel

Rescue Smart

Website for a first aid training provider offering DGUV-compliant occupational first aid courses, refresher training, driver's license first aid, and AED/emergency scenario instruction across Germany.

  • DGUV & FeV regulatory compliance
  • Course catalogue with flexible scheduling
  • Same-day certification workflow
Next.jsTypeScriptTailwind CSSResendVercel

Kreisjugendfeuerwehr Starnberg

Regional platform for the Youth Fire Department of Starnberg district, coordinating 43 youth brigades and 9 children's brigades with over 600 members. Features a password-protected member area, secure PDF downloads, a contact form, and event management.

  • HMAC-based password-protected member area
  • Secure private PDF downloads
  • Contact form with email integration (Resend)
Next.jsTypeScriptTailwind CSSResendVercel

$ grep -R talks/

Talks & Writing

  1. 2026Graz Connects 2026: AI Assisted Design & Engineering of Digital Solutions & Systems

    The Trust Trap – Security of Coding Agents

    How coding assistants such as GitHub Copilot, Cursor, and Claude affect software security: from vulnerabilities in generated code to slopsquatting, model poisoning, and rules file backdoors. The talk closes with recommendations for secure configuration, usage guidelines, and review practices.

    GenAI SecurityCoding AgentsSlopsquattingSupply Chain Security
  2. 2026Coding Festival meets Platform Engineering @ DATEV

    The Trust Trap: Security of Coding Agents

    A practical look at the trust boundaries of AI coding agents, from insecure generated code and prompt injection to hallucinated dependencies and tool permissions. Demonstrations show why passing tests are not enough and how scoped authority, dependency review, and independent security checks help teams keep control of agent-assisted development.

    GenAI SecurityAI SecurityCoding AgentsPrompt InjectionSupply Chain Security
  3. 2026heise devSec

    From XZ to Trivy: What Supply Chain Attacks Reveal About Our Pipelines

    Lessons from XZ Utils, polyfill.io, Shai-Hulud, and Trivy on how trust in maintainers, domains, version tags, and security scanners exposes software supply chains. A practical account of what worked, what failed, and how teams can assess pipeline weaknesses and prioritize their first security improvements.

    Supply Chain SecurityCI/CDDevSecOps
  4. 2026Meetup Munich

    Zero Trust with Keycloak: How to Securely Integrate IAM into Microservices Architectures

    This talk walks through how to implement Zero Trust principles in real microservices architectures using Keycloak, SPIFFE/SPIRE, and mTLS, covering everything from replacing static API keys to workload identity and end-to-end secure service communication with JWT and X.509 SVIDs. No theory, no marketing language, just concrete architecture decisions, real code, and the mistakes that actually happen in production.

    Zero TrustKeycloakIAMMicroservices
  5. 2025heise devSec

    Zero Trust with Keycloak: Securely Integrating IAM into Microservice Architectures

    Article on securely integrating Identity & Access Management into microservice architectures using Keycloak as the central IAM component within a Zero Trust model.

    Zero TrustKeycloakIAMMicroservices
  6. 2023UniNow

    Zero Trust Architecture & Passkeys: The Duo Against Lateral Movement

    Talk on combining Zero Trust Architecture with Passkeys as an effective strategy for preventing lateral movement in modern IT environments.

    Zero TrustPasskeysAuthentication
  7. 2023ZKI IAM

    Passkeys: The Future of Authentication in Shibboleth with privacyIDEA

    Conference contribution on integrating Passkeys as a modern authentication method into Shibboleth-based university infrastructure using privacyIDEA.

    PasskeysShibbolethprivacyIDEAIAM
  8. 2023ZKI IAM

    Security and Convenience: How Tailscale Reimagines Admin Access

    Talk on using Tailscale to simplify and secure admin access in university data centers - without compromising on security or usability.

    TailscaleVPNZero TrustAdmin Security
  9. 2022heise devSec

    Beyond OAuth 2.0 and OpenID Connect: Hidden Features in Keycloak

    Article exploring lesser-known but powerful Keycloak capabilities beyond the standard OAuth 2.0 and OpenID Connect protocols - from Token Exchange to Fine-Grained Authorization.

    OAuth2OIDCKeycloak
  10. 2022Meetup Munich

    DevSecOps - Securing Your Web App in Three Simple Steps

    Practical meetup talk on incrementally embedding security practices into everyday development: from a first SAST scan to a fully integrated DevSecOps pipeline.

    DevSecOpsCI/CDSASTSecurity

$ chmod +x contact.sh && ./contact.sh

Get in Touch

Whether you want to talk security architecture, explore collaboration, or just have a technical conversation. I'm happy to connect.

Email

LinkedIn

linkedin.com/in/michifuchs

GitHub

github.com/theexiile1305