Andreas Wendl
Azure Security & Governance Architect
Azure security, governance, and cloud security posture for complex enterprise environments — with measurable security and governance outcomes.
Focus
Azure security, governance and CSPM for complex enterprise environments.
I work on clearly defined security and governance workstreams, combining architecture, technical implementation and automation without broad end-to-end platform ownership.
Wiz, Defender for Cloud, Azure Policy, Entra ID, RBAC, PIM and security automation. Architecture depth paired with hands-on implementation and clear reporting.
- Improved Microsoft Defender for Cloud Secure Score from approximately 60–70% to 90%+ at enterprise scale.
- Reduced critical security findings to zero.
- Migrated standing RBAC to time-bound Privileged Identity Management (PIM).
- Automated secure provisioning and governance workflows through ServiceNow and Azure DevOps.
Enterprise-scale proof
Selected scale and outcomes across Azure security, governance and CSPM workstreams.
385
Azure subscriptions
~67k
Azure resources
12
Wiz-connected cloud environments
Azure, AWS, GCP and Oracle Cloud
~1M
Resources covered through Wiz
Defender for Cloud: Secure Score improved from approximately 60–70% to 90%+.
Wiz: critical issues reduced to 0; high-severity issues reduced to 43 across the connected estate.
Governance controls: privileged access governance and secure provisioning automated at enterprise scale.
Cloud Security Engineer (Azure) — Adecco Group
Security governance & automation at enterprise scale
2022 – Present
- Technical ownership of defined Azure security, governance and CSPM workstreams at enterprise scale.
- Own the Wiz workstream across 12 cloud environments and ~1M resources since January 2024.
- Drive Azure security posture and governance across 385 subscriptions and ~67k Azure resources using Defender for Cloud, Azure Policy and related controls.
- Build security reporting, remediation and platform integrations using PowerShell, ServiceNow and Azure DevOps, with Wiz integrations into Splunk and Microsoft Sentinel.
- Design policy-as-code guardrails aligned with Microsoft Cloud Security Benchmark.
- Deliver Entra ID, RBAC and PIM governance with auditable privileged-access controls and periodic reviews.
Consulting / Contract Work — Cronos Europa (EU Institution)
Secure cloud architecture in a regulated environment
- Delivered short-cycle assignments in a highly regulated environment.
- Translated requirements into secure cloud architecture within defined security and governance constraints.
- Worked in a regulated, multi-stakeholder environment with strict security, compliance, and change-management requirements.
Selected Case Studies
Examples of enterprise-scale Azure security, governance and CSPM workstreams.
Enterprise Multi-Cloud CSPM with Wiz
Wiz rollout and posture governance across 12 cloud environments and ~1M resources, spanning Azure, AWS, GCP and Oracle Cloud.
Download one-pager (PDF)Azure Security Posture Improvement
Defender for Cloud posture improvement across 385 subscriptions, including Secure Score improvement to 90%+.
Download one-pager (PDF)Privileged Access Governance at Scale
Large-scale Azure RBAC and PIM governance across hundreds of security groups and thousands of users.
Download one-pager (PDF)Secure-by-Design Azure Governance
Security and governance controls embedded into Azure provisioning through policy, RBAC/PIM and automation.
Download one-pager (PDF)Services
Specialist Azure security, governance and CSPM workstreams with clearly defined scope and outcomes.
Cloud Security Posture / CSPM
Wiz and Defender for Cloud for posture assessment, contextual risk prioritisation, remediation governance, integrations and continuous improvement.
Azure Governance & Policy
Azure Policy and Policy-as-Code guardrails, DENY controls, exemptions and benchmark/control alignment.
Identity & Privileged Access Governance
Entra ID, Azure RBAC and PIM for privileged-access models, eligible access, migrations, reviews and automation.
Security Automation & Reporting
PowerShell, APIs, Azure DevOps and ServiceNow integrations, plus reporting and automation that support posture, governance and remediation.
Secure Platform Guardrails
Secure-by-default controls embedded into provisioning, with policy enforcement and RBAC/PIM integration.
Contact
If you have a defined Azure security, governance or CSPM problem, I’m happy to review the scope and discuss an approach.
To get a useful reply quickly, include: environment scale, current workstream (CSPM / Governance / Policy / PIM / Security Automation), target outcome, timeline, and major constraints.
Availability
Remote-first (EU hours) — targeted or longer-term specialist workstreams; occasional onsite by exception