I am the sole IT for the German subsidiary of a Chinese automotive group — infrastructure, Microsoft 365 governance, security baseline, business applications, and the new-office network build-out. I have built a complete IT landscape from nothing, and I am at my best turning operational friction into structured, scalable systems.
From that same seat I also write — long-form analysis on what the Chinese auto industry's push into Europe actually looks like at the operational layer: dealer DMS to factory ERP, residual-value to leasing risk, homologation to OTA. One track builds the systems; the other reads them. The vantage is the same.
Long-form analysis on China–Europe automotive. Published on Substack and 知乎; archived here.
AI agents broke the lean team's two oldest problems in the same year. The fix starts with a different question.
Building in Europe is sold as de-risking. On one line it does the opposite — and the meter that proves it reads near-zero today, climbs for a decade, and sits on no single person's dashboard.
本地化被当成降风险。可在某一条线上，它正好相反——那块证明它的表，今天读数接近零，却要涨十年，而且不在任何一个人的仪表盘上。
Projects spanning infrastructure delivery, security, and internal software.
IT project lead for the complete ELV/IT build-out of a 1,700 m² headquarters — structured cabling, server room, CCTV, access control — from design review through vendor management to acceptance. As-built network: FortiGate 100F HA firewalls, Huawei S6730 core (iStack), 6 UniFi access switches, 18 Wi-Fi 7 APs, dual-UPS A/B power. Plan optimisation cut direct costs by over €30,000; delivered 2026, now carrying the post-build hardening programme.
Drafted the company's data-security & AI-governance policy set (in legal review with local counsel and HQ); established a procurement security pre-assessment process with a 5-working-day SLA and management incident reporting. Local execution of EU-level security alignment — NIS2 readiness roadmap, CCTV DPIA preparation, GDPR + PIPL dual-compliance briefs — applying BSI IT-Grundschutz methodology.
Sole builder and operator of four production business systems on self-managed Linux infrastructure (Node.js / MySQL / nginx / PM2) — ticketing & assets, vehicle fleet, order-to-delivery tracking, and office digital signage — replacing manual coordination with structured workflows integrated into Microsoft 365 and Lark.
Automated Windows 11 provisioning via Microsoft Autopilot and Intune with GroupTag-based device scoping. New devices ship directly to employees and self-configure — cutting manual deployment effort by over 70%.
Security baseline across identity and endpoints — enforced MFA, legacy authentication blocked, Conditional Access (geo / device / risk), Defender for Endpoint, silent BitLocker with key escrow, and a break-glass strategy, with incident reporting to the group CISO.
Local coordination for the German rollout of the group CRM (Salesforce, HQ-led programme) — Entra SSO integration and the EU-side GDPR DPIA.
Automated data synchronisation between ERP and WMS systems for a logistics operation, eliminating manual entry and reducing labour costs by 25% while supporting 200+ tickets annually.
A full-stack personal portfolio with password-protected interview profiles, dynamic routing, and JWT-based authentication — self-hosted on a managed VPS.