Filderstadt, Baden-Wurttemberg, Germany · Available for consulting
Security.
Strategy.
Policy-as-Code.
Management consultant, cybersecurity architect, and PhD researcher bridging governance frameworks with automated infrastructure — building the next generation of policy-driven DevSecOps.
15+
Years in public sector & consulting
MSc
Information Security
MBA
International Management
PhD 2031
Policy-as-Code & Governance Compilers
PaC
Policy-as-Code Expert
What I Offer
Core Service Areas
From strategic consulting to hands-on infrastructure automation — a full-spectrum offer across governance, security, and cloud architecture.
⚠️ Important Notice
Consulting is a secondary activity. My primary employer always takes priority. Consulting engagements are available by appointment only or on Saturdays. Please plan accordingly when reaching out.
DevSecOps & Cybersecurity Consulting
End-to-end DevSecOps framework design, security governance automation, and compliance-as-code implementation. BSI-aligned processes for critical infrastructure and enterprise teams.
Request a consultation
Infrastructure as Code
Terraform-based cloud infrastructure design on Hetzner, automated provisioning, GitOps pipelines, and full IaC governance frameworks.
CI/CD & Automation
GitHub Actions pipeline design, containerised workflows, Docker/Kubernetes orchestration, and automated compliance gates for regulated environments.
Policy-as-Code Implementation
Translating governance and compliance requirements into machine-readable, automatically enforced code policies across cloud and on-premise environments.
Management Consulting
Strategic advisory for digitalisation, security posture improvement, and technology governance. Specialised in public sector and mid-size enterprise transformation.
Security Auditing
Automated and manual security audits with the SecurityAuditor dashboard. BinBot binary analysis, vulnerability reporting, and remediation roadmaps.
Ventures
Active Businesses
Registered entities and active ventures — each with a distinct focus and online presence.
Live Website
Kestura
UG (haftungsbeschränkt) · Management consulting and cybersecurity services firm based in Filderstadt, Baden-Wurttemberg, Germany. Specialising in DevSecOps, Policy-as-Code, and security governance for enterprise and public sector clients.
Website
Elias Lenz MBA Beratung
Independent consulting practice built on MBA International Management and 15+ years of public sector experience. Offering strategic advisory, digital transformation projects, and executive-level cybersecurity consulting.
Academic Research
Ongoing PhD Research
Part-time, research-based PhD in Cybersecurity (distance learning, University of Plymouth), translating regulatory and policy requirements into machine-enforceable Policy-as-Code, with AI-assisted automation to reduce compliance-related human error while preserving human oversight. Case study: German public sector migration to cloud-native platforms. Expected completion 2031.
Doctoral Thesis · In Progress
Governance-to-Policy Compilers: Automating Compliance through Policy-as-Code
Research framework — defined and approved
Literature review — PaC, governance compilers, DevSecOps
PaCHumanCentricPrototype — human-centric PaC demo built
CyberAI2026 — paper series in progress (June 2026)
Thesis writing — structured submission
Defence & publication — target 2031
01
Policy-as-Code Automation
Designing compilers that translate human-readable governance requirements into machine-enforceable policy code across cloud environments.
02
Governance Compilers
Novel architectural patterns for converting regulatory frameworks (GDPR, BSI, ISO 27001) into automated, continuously tested policy artefacts.
03
Human-Centric PaC
Bridging the usability gap — making policy-as-code accessible to non-technical governance stakeholders without sacrificing machine enforceability.
04
Secure by Design
Embedding security and compliance as first-class artefacts in the software development lifecycle via shift-left automation frameworks.
AI Security Research
AI × Cybersecurity — Defending AI, Defending with AI
Work sits at the intersection of Policy-as-Code (PaC) and AI: securing AI/ML systems, and using AI-driven automation to strengthen security operations. This profile is updated as PhD research and applied projects progress — last updated August 2026.
Defending AI — Securing AI/ML Systems
Hardening AI agents, AI coding pipelines, and AI transparency records so they stay auditable and governable by default.
Tideline
Private Repo
Human-in-the-loop approval cockpit for AI agents. Surfaces the policy/delegation chain behind each paused agent action, enforces a browser-signed Tier-3 structural lock for high-risk actions, and generates one-click EU AI Act Annex IV-style evidence packs.
Agent Governance
CodePilot
Private Repo
Multi-agent coding system (Planner / Coder / Reviewer / Security / QA / Releaser) where every consequential action routes through Tideline for single-named-human approval — not an unreviewed PR merge.
Multi-Agent Systems
atrs-as-code
Private Repo
Governance-to-policy compiler turning the UK Algorithmic Transparency Recording Standard into YAML records, validated in CI, cross-walked to BSI Bausteine and ISO/IEC 42001, and diffed against deployed Terraform so an AI system's transparency record can't drift from what's running.
Rego / Terraform / CI
ai-security-labs
Private Repo
Hands-on OWASP ML Top 10 labs, including an FGSM adversarial-attack implementation against a CNN plus gradient-norm / confidence-based defense evaluation with ROC-curve analysis.
Python / Adversarial ML
Defending with AI — AI-Enhanced Security Operations
Using AI and automation to replace manual audits and strengthen continuous compliance and threat governance.
DevSecOps PaC Pipeline
Private Repo
Policy-as-Code/DevSecOps pipeline (Terraform + OPA/Conftest + GitHub Actions) that evaluates every infrastructure change against BSI C5, NIST SP 800-53, and ISO 27001-mapped Rego policies pre-merge, blocks violations, and emits signed compliance evidence — replacing manual audits.
OPA / Rego / Terraform
nis2-compliance-as-code
Private Repo
NIS2 automation for German SMEs, combining IaC policy enforcement with an AI-adaptive training platform.
IaC / AI-Adaptive Training
Agent Runtime Governance
Research in Progress
Ongoing research extending Policy-as-Code into AI-agent runtime governance: each agent tool call is evaluated as a JSON payload against Rego policies by an OPA proxy before execution — governing agent behavior continuously, not just static infrastructure.
OPA Proxy / Runtime PaC
Open Source & GitHub
Active Projects
Public repositories and tooling — from infrastructure automation to security auditing dashboards.
Demo Access Console
Live Demo
Lightweight test-flow console for issuing temporary demo codes, expiring them automatically, invalidating access when a demo ends, and exporting an audit CSV for enforceable access rules.
Deployed Demo
PaCTerraformPaC
Infrastructure automation framework combining Terraform with Policy-as-Code enforcement. Core tooling for the PhD research prototype.
HCL / Terraform
PaCHumanCentricPrototype
Private / Coming Soon
Human-centric Policy-as-Code demo — making governance automation accessible to non-technical policy authors.
Python / YAML
SecurityAuditor
Private / Coming Soon
Automated security auditing dashboard. Vulnerability scanning, compliance reporting, and remediation roadmap generation.
JavaScript / TypeScript
BinBot
Private / Coming Soon
Automated binary analysis tooling. Detects vulnerabilities, extracts metadata, and integrates with CI/CD security gates.
Python
Kestura Website
Source for the Kestura brand site — static HTML/CSS, hosted and version-controlled on GitHub.
HTML / CSS
More on GitHub
Additional tooling, research artefacts, and DevSecOps experiments across public and private repositories.
Various
Let's Build Something Secure
Whether you need DevSecOps strategy, Policy-as-Code implementation, or a security audit — reach out directly. Based in Filderstadt, working internationally.