Kamen Beronov

Munich, Germany|kberonov@o2mail.de|Updated 27 October 2026

German and Bulgarian – native|English – fluent|Japanese – conversational

Solution and security architect in regulated environments – banks, insurers, industry, federal authorities and their IT service providers. Fifteen years in architecture, with twelve earlier years in publicly funded research. Doctorate in mathematical physics; certified data protection officer.

Three directions run through the work below. Each links to the evidence for it.

Modernisation with AI in the loop Reconstructing undocumented legacy systems with AI agents against a recorded behavioural baseline; retrieval-augmented generation over internal documentation; establishing agent use in a department without a budget line.
Security and identity architecture Federal cross-agency identity management; workforce IAM at major banks and a large insurer; data-centric security; the authorisation-management requirements of German banking supervision, and GDPR, implemented rather than read.
Presales and solution engineering RFI and RFP responses and security questionnaires; proofs of concept and demonstrations; effort and feasibility estimation; architecture presentations and decision papers up to management level.

Selected projects

Ordered by recency. The labels say which direction each one serves.

2025—2026 Modernisation & AI Modernisation of an undocumented legacy code base at a major bank – three build stages between 2003 and 2011, partly available only as compiled artefacts; core some 2 GiB of JARs plus about 50,000 lines of custom code. An automated test suite was built first, as a recorded behavioural baseline, because without it no change could be shown to preserve behaviour. Module behaviour was then reconstructed with AI agents and decompilation, and the core dependency reduced to under 30 %. Configuration carried RDBMS-specific SQL where the refactoring assumed the generic standard; each case was decided individually – generalise the query, maintain dialect variants, or accept the use case as database-specific, exclude it from cross-dialect testing and document it.

2025—2026 Modernisation & AI AI in production use. A retrieval-augmented generation system over internal documentation and ticket systems, together with proposed metrics for the cost of poor documentation search. Agent use established in the department without a dedicated budget line, by demonstrating against recurring real tasks rather than abstract use cases – now six colleagues, over half of those handling larger programming tasks.

2025—2026 Security & Identity Single sign-on against Entra ID for both main components of a supported product suite, including legacy applications – in production at two customers operating their own TLS and proxies, in testing at a third. On-premises Keycloak as SSO identity provider and as a provisioned target system, as a proof of concept; tenant administration through Microsoft Graph using the device authorization grant, so that every action remains attributable to a person rather than to an application.

2024—2026 Security & Identity Single sign-on programmes at a major bank and a large insurer – OIDC and OAuth 2.0, SAML 2, TOTP, single logout, federation and user consolidation; signature and encryption services built in-house. As a proof of concept, the password dialogue of an unmodifiable native legacy application was replaced by OAuth: authorization code with PKCE over a loopback redirect through the system browser, designed and built independently.

2023—2024 Security & Identity Compliance automation at a leading IT service provider to the German banking sector. No procedure existed; auditors had requested evidence the customer could not produce. Documentary compliance verification with archiving, encryption, retention rules, error handling and SIEM integration – reusing the encryption and archiving built inside the federal ingestion pipeline below, one development line carried across customer and industry. In production for two years.

2022—2025 Security & Identity Federal cross-agency identity management. HR data arrived from many sources of differing quality that shared no data model. A core schema was designed for all internal personnel data regardless of employing institution and, on that basis, a relaxed schema for external personnel, with automated quality measures that reject an input batch below a defined threshold. The ingestion pipeline was built single-handed. The cross-vendor interface documentation was owned and maintained across two substantially divergent data models for the full duration of both project phases. Three institutional IAM infrastructures connected.

2014—2018 Security & Identity Data-centric security across heterogeneous stores. Format-preserving encryption, masking, tokenisation, identity-based encryption, RBAC and ABAC, data lineage – in relational databases, data warehouses, Hadoop and Spark. A one-year engagement at an insurance holding integrating format-preserving encryption into the data warehouse; a year at an energy utility for central masking and test-data management.

2012—2014 Security & Identity Identity management centralisation in a global group – several source systems (LDAP, Oracle, SAP), more than 80 target systems and several cloud services, across every project phase from requirements and design documents through to support.

2017—2018 Security & Identity Audits and information security management – privileged access management at the German armed forces' IT provider; an ISMS and ISO 27001 audit preparation at a SaaS provider; GDPR readiness at mid-sized companies across industries; preparation of a European Central Bank audit at an institutional bank.

2006—2010 Security & Identity Federated infrastructure and grid computing – grid middleware integrated against a federation of public certificate authorities, with virtual organisations and short-lived proxy certificates carrying organisation membership attributes, delegated onward by the job management system. Multi-hop delegation for unattended processes, two decades before AI agents raised the same question.

Presales and customer engagement

RFI and RFP responses and security questionnaires – qualification of customer requirements into solution designs, with effort and feasibility assessment, in close cooperation with presales, sales and product management; in support of and in substitution for the dedicated bid-support role
Competitive bids – tenders, RFI and RFP rounds, customer workshops, estimation and costing; won the competitive bid for a Swiss university's identity management programme
Proofs of concept – single sign-on against Entra ID and Keycloak; the OAuth retrofit of a native legacy application; column-level encryption under separate identity-based keys; retrieval-augmented generation over documentation and ticket systems
Presentation and enablement – demonstrations built against recurring real tasks; offer and architecture presentations and decision papers up to management level; workshop facilitation; training and advising users and stakeholders
Knowledge transfer – owner of an internal knowledge-transfer group, delegating documentation to its members; fastest progress of all such groups in the monthly reviews, with the largest task list

Professional experience

Beta Systems Software AG, Berlin – Senior Solution Architect, home office Munich, since 2019

2023–2026 – Lead Architect. End-to-end responsibility for self-contained solutions at very large customers, from requirements capture through design and implementation to go-live and customer acceptance. Focus on single sign-on and federation, signature and encryption services, automation with PowerShell and Kubernetes
2019–2022 – Technical Lead. Project leadership for up to 8 internal team members; requirements management, solution introduction, acceptance testing, quality management

bizcon AG, Munich – Senior Consultant, 2011—2018

Project leadership for data protection and compliance and for big-data security; DevSecOps; transition management across four groups, each headquartered in a different country
Security architecture and operations – access management, encryption, monitoring, log analysis and lifecycle; access history analysis with Logstash and R; PKI, high availability, containerisation. AWS administration for the company – accounts, identity and access management, cost control for 20 to 40 staff

Earlier: coSyMBA UG, Munich – managing director since 2009, IT and process consulting for regulated industries, software development with a team of 10 · EU FP7 and Horizon 2020 expert, evaluator and rapporteur 2010–2017 · Leibniz Supercomputing Centre 2009–2010 – federated identity management, PKI, certificate lifecycle, Kerberos, ITIL-conformant process management, EU-wide coordination of up to 15 subprojects · FAU Erlangen-Nürnberg 2001–2008 – group lead, up to 8 staff, annual budget to €0.5M, acquisition of projects and supervision of master's and doctoral candidates · research and teaching at the universities of Nagoya and Kyoto and at the Bulgarian Academy of Sciences 1989–2001

Skills — security and identity

Identity & access management Federation protocols: OIDC and OAuth 2.0 including the device authorization grant and authorization code with PKCE for native applications, SAML 2, SCIM, TOTP, single logout; authorisation models RBAC and ABAC; workforce IAM with role models, segregation of duties, recertification and approval workflows; Active Directory and LDAP, Entra ID, Kerberos; PKI and certificate lifecycle; Garancy, SailPoint, DirX, Keycloak, Centrify, Nevis

Non-human identities Delegated rather than application-bound tokens, with authorisation and traceability at the level of a person; multi-hop delegation with short-lived proxy certificates and organisation membership attributes; the standards landscape for agent access to enterprise data, and which parts of it are settled enough to build on

Data-centric security Format-preserving encryption, masking, tokenisation, identity-based encryption, column-level keys; row- and column-level access concepts; data lineage (Apache NiFi, Micro Focus SDM, Dataguise); data quality gating; securing relational databases, data warehouses, Hadoop, Spark, MongoDB and Elasticsearch

Regulation and compliance German banking supervisory requirements for IT – implementation of the user-authorisation management requirements at banks and at a banking-sector IT service provider; GDPR and the German Federal Data Protection Act, as a certified data protection officer; ISO 27001 and ISMS build-up and audit preparation; European Central Bank audit preparation; automated compliance verification

Skills — modernisation, AI and platforms

AI in the development cycle Claude via API and agents, GitHub Copilot; retrieval-augmented generation over documentation and ticket systems; AI-assisted analysis, reconstruction of undocumented behaviour, refactoring and automated testing – with a recorded behavioural baseline as the deterministic gate

Legacy and testing Characterisation testing and behavioural baselines before change; test-case engineering and automated test environments; multi-project Maven structures replacing monolithic coupling; decompilation; dialect differences across relational databases

Databases and data platforms MS SQL Server, Oracle, PostgreSQL, MySQL, DB2 dialect work; Hadoop, Spark, Hive; Elasticsearch, MongoDB; earlier high-performance computing, cluster management and parallel computing; log archiving at 10 GB per day

Development and interfaces PowerShell, Java, Python, Go, TypeScript, C#, Perl; JDBC/ODBC, REST, XML, XSLT, XQuery, JSON, YAML; Git, CI/CD, Jenkins, Maven

Cloud and platforms AWS – administration since 2011, certified 2025; Kubernetes, Docker, Rancher; private and hybrid cloud; signature and encryption services built in-house

Architecture and process Current- and target-state architectures and governance; UML and modelling with Sparx Enterprise Architect; requirements engineering; cross-vendor interface documentation; dated and sequenced architecture decision records frozen with the corresponding code state; ITIL and ISO 20000; estimation and costing; multi-project coordination

Publications

2026 – Position paper on authorisation and traceability for AI agents accessing enterprise data: the delegation chain problem, which parts of the standards are settled and which are still drafts, and a sequencing heuristic for regulated organisations
2026 – Article on identity-provider selection for smaller budgets: build versus buy, Keycloak against Entra ID
2014—2018 – White papers, conference contributions and webinars on data-centric security, the GDPR and industry codes of conduct

Certifications and education

2025AWS Certified Cloud Practitioner

2017—2018ISO 27001 Foundation; Certified Data Protection Officer

2009—2013ISO 20000 certified IT Service Process Manager; Major Incident Manager, Leibniz Supercomputing Centre

Doctorate1992—1996 Kyoto University, Japan – Research Institute for Mathematical Sciences; mathematical physics, numerical simulation

M.Sci.1984—1989 St. Kliment Ohridski University, Sofia, Bulgaria – mathematics and computer science, highest grade