What a year! Just like many others do, I use the end of the year to look back at what happened and acknowledge both achievements and struggles. I've written lots of those reviews over the years and this practice helps both present and future me see how things evolved over a longer timespan. So, without further ado, let's get to it.
Professional
- The biggest change of 2025 for me was that I've started at a new company in a new role. It's now nearly a year that I've been working at DocuWare as a security engineer in a central enabler team focusing on product and cloud security. This kind of role change was and is huge for me. Especially as I realized that I didn't only dare try something different. I could indeed contribute a lot of the experience, knowledge and skills I've built up over my career in this new, more focused area. At the same time, there's a lot more to learn and grow into, and I love that I continue to be very intrigued to do so.
- For the first time, I've done third-party product assessments for security myself instead of asking our security team. Well, now we are the security team! It's been a really nice topic to get hands-on very early on the new role.
- I've done threat models and security reviews before for my own teams. This year, however, I've done them for and with a bunch of our engineering teams - which required building up a lot of context in very little time, again and again. I love that my teammate and I continuously experimented with even better ways to do threat modeling and make it a beneficial experience for everyone.
- In a cross-team collaboration, we've provided a convenient pipeline template to scan for vulnerabilities that teams could plug in easily and quickly to get going. It's been picked up widely and the feedback received was pretty good throughout the year.
-
I've conceptualized our very first security champion program, we refined it
in our team, and we managed to get buy-in from stakeholders very quickly.
Another personal achievement here was that I've repeated the same presentation for
all our team leads of all domains - 7 times in 2 days in 2 languages. Personal high score!
The potential champions are currently learning about the pilot we want to
run so they can make an informed decision whether they'd like to opt in from the start. Next year will be super interesting in this regard.
- We've grown a lot in the team, individually and as a team - even a lot quicker than I've observed this with other teams before. And it shows, we're having way different conversations now than we had beginning of the year. Everyone is sharing transparently, acting as sounding boards, truly collaborating - I just love seeing this. We've become more resilient, faster in our feedback, a lot more intentional and strategic in what we spend our time on and how we approach situations. I'm very grateful for my team including our manager so we can continue to improve together!
Community
- I've paused speaking at conferences during the first half of the year to start at my new company without overloading myself or overburdening my new team. Therefore, I've only spoken at 3 conferences during the last months this year, including once more at a new conference in a country I haven't spoken before. Until now, I've had 110 speaking engagements overall, 51 of them conference sessions, given at 28 conferences, in 13 countries. Truth be told, I'm still amazed at such numbers, and I need to see them in front of me every end of the year to realize this actually happened.
- Sadly, I had to cancel my very first speaking engagement this year due to sickness that I just couldn't spread further at a conference. Hence, I didn't make it to my first Øredev - yet. On the other hand, I got super fortunate that this was indeed the very first case I had to cancel an engagement since I've started public speaking in 2017!
- I co-curated my first dedicated conference track - the security testing deep dive track at Agile Testing Days, together with Kristof Van Kriekingen and Santhosh Tuppad. I loved that we could give the stage to lots of awesome folks and offer the audience a whole variety of insights this way!
- So far, I've given lots of workshops at conferences - yet this year I
managed to give my first one at a security conference at BSides Munich!
-
I acted as session chair for the first time at BSides Munich - trying to do sketchnotes at the same time. Phew, that combination was tough, yet I made it. Definitely a first timer for me.
- Including this one, I've written 11 blog posts this year - more than I expected. It didn't feel like I was writing much during the year, probably because I originally planned to write a lot more. Well, reality kicked in and I chose to prioritize other topics, so there was no energy and capacity left for writing much. Yet 11 posts aren't too bad after all.
- We had the second edition of the Open Security Conference and it was both a big struggle to make it happen and a huge success! I just loved seeing folks enjoy themselves thoroughly in the
space we co-created and share their own experiences out loud on social
media. Very much looking forward to the third edition next year! Fingers crossed we learned enough as an organizer team to make the third one go smoother.
- I've started my very first CTF team together with Mireia Cano and Martin Schmidt, joining our first official CTF competition. We continued practicing throughout the year, even saw each other in real life at a conference for the first time. Just love that we have this small, safe group to learn together by solving security challenges!
- The security card game that Martin Schmidt, Philipp Zug and I are building is still alive, and while we're deliberately keeping the pace slow, the game grew both in concept and in content. We had a chance to showcase it at two conferences this year and gain further feedback and ideas - it's just a celebration in itself that we continue to work on this for so long now despite it being a pure leisure time, slow project. It's one of those rare sustainable ones!
- Last year, Shiva Krishnan and I had started a series of leadership workshops with our very first community cohort. We really struggled to get this going last year, and beginning of this year was no difference. We nearly reached the point to give up and pivot. Yet then our small cohort fully engaged and we actually made this happen! Super proud we did pull through in the end and had impact we hoped for. Even though it wasn't easy most of the time.
Personal
- In my volleyball team, we've managed to level up leagues in spring and started in the higher league in fall! Super proud and we're already learning a lot given our new challenges.
- Another volleyball highlight, and an extremely rare one: Together with our senior's team, I've had the honor to join the German senior championships! Yes, it's as wild as it sounds. Well, we got very lucky as there weren't many teams in our region for our age group, and yet: this was a true once-in-a-lifetime event. Playing against former premier league players, or even the dream team of former national team members is truly a unique experience you could only dream of. Acting as a referee for such games is just as well! This was a true rollercoaster of emotions and I wouldn't miss it.
- Over the last years, I sustained several small, but persistent and annoying injuries restricting my range of movement and affecting quality of life. I picked up custom training to help me get back to better shape, and it paid off massively. For example, I can finally kneel again which wasn't possible for nearly the whole year. Also when it comes to a bunch of other areas, I'm super happy that I managed to take care of my health a lot better this year.
- I finally started to relax a bit again. It didn't work all the time, there were plenty of stressful and packed phases, and yet. The constant tension and anxiousness faded. Lots of people from all parts of life noticed that something changed compared to last year for the better, and it's been very clearly attributable to my change of workplace. I found my optimism again and rediscovered the joy in doing what I'm doing.
- Lastly, I managed to complete another personal challenge. This year's Calm and Steady endeavor was truly very personal. While I still have lots of stuff to work on, I did take things easier and celebrated when I noticed that I've been kinder to myself. I took more time for myself. Sometimes just to do... not much of anything. Or just things that I like doing for no other reason than that I like doing them. The best part here was being on this journey of reclaiming time and catering to our needs together with my best friend aka sister, holding ourselves accountable with each other. If you happen to read this: Thank you so much for all the wisdom shared in tough moments, all the reminders of taking things slower (yes, even slower than that), all the encouragement and reassurance that this is a basic need and not selfishness. I've already shared this with you, yet let me repeat it once more: without you I wouldn't have taken as many interpersonal risks this year and I'm both proud of you and very grateful to have you in my life!
Enjoying the Last Weeks of the Year
This year was a really good one for me, and I'm truly grateful. No one can choose what might happen during a year and I've been blessed. Special thanks and kudos go out to all the amazing people who shared my journey this year in little and big ways - you all made it so much better.
Now that it's the end of the year, some chores are coming up that I usually do over the holiday season. There are new conference proposals to draft so I can submit them beginning of the year - I've already preselected conferences I'd like to try my luck with in 2026. Finally, there's my next personal challenge to commit to and pour into written form so I can share it, make it real, and make it happen.
But whatever task awaits, I'm doing my best to enjoy this time of reflection and thinking ahead. And that includes that at times I'm just doing nothing, resting, playing games, exercising, whatever. I'm ready for what's to come in 2026!