Skip to content
Frederik Berg
A wooden lookout tower above a small valley at dusk, a messenger on the road, a second tower on a far hill
Frederik Berg

Frederik Berg

Security Analytics Consultant

SVA System Vertrieb Alexander GmbH

About

I work as a Security Analytics Consultant at SVA, where I build and run SOC and SIEM platforms on the Elastic Stack: infrastructure and detection rules as code, automated operations, and the reporting around them. Before that I did research at the Chair for Embedded Software at RWTH Aachen on the functional safety of interconnected medical devices, with three publications and a lecture on microcontroller programming.

Outside work I run a small Kubernetes homelab on Hetzner that hosts services for family and friends, watched by an Elastic SIEM and operated by AI agents that I build as part of my personal AI infrastructure. I co-organise the Effective Altruism group in Aachen, and I spend the rest of my time bouldering, cycling and hiking.

Interests

  • Security Analytics & Detection Engineering
  • AI Agents & Personal AI Infrastructure
  • Kubernetes & Self-hosting
  • AI Safety
  • Effective Altruism

Education

  • Computer Science, continuing education

    RWTH Aachen University, 2022 – 2024

  • M.Sc. Automation Engineering

    RWTH Aachen University, 2019 – 2022

  • B.Sc. Mechanical Engineering

    Leibniz University Hannover, 2014 – 2019

Experience

  1. May 2024 – present

    Security Analytics Consultant

    SVA System Vertrieb Alexander GmbH, Aachen

    • Build and operate a fully automated, multi-tenant SOC and SIEM platform on Elastic Security, with infrastructure, detection rules, upgrades and monitoring as code (Terraform, Ansible, CI/CD) and Fleet with Elastic Defend on the endpoints.
    • Designed and built a vulnerability management platform on Elastic that brings scanner, asset and exposure data from several sources into one view with reporting.
    • SOAR automation of SOC use cases with Tines.
    • IT security workshops, trainings and talks, among them sessions and hands-on labs for an IT security bootcamp and a webinar with a live demo of the SOC platform.

  2. Apr 2019 – present

    Security Homelab and Personal Projects

    Germany

    • An Elastic SIEM on my own Kubernetes cluster, configured entirely as code, with detection rules over Kubernetes audit logs, network flows and container runtime events.
    • AI agents that triage alerts and security advisories and operate the cluster, as part of a personal AI infrastructure with a backend, web and iOS clients, long-term memory and scheduled agents.
    • Open-source tools around it, among them MailVerdict, kube-borg-backup and Baton; see Projects.

  3. Aug 2022 – Sep 2023

    Research Associate

    Chair for Embedded Software, RWTH Aachen University, Aachen

    • Research on the functional safety of interconnected medical devices, including control algorithms in C and Matlab, contract-based design and hardware security.
    • Three publications, first author of the paper on the ASMO hardware platform.
    • Ran the lecture Advanced Microcontroller Programming and Debugging, restructured its content, gave tutorials and created and graded the exams.
    • Managed projects and supervised students.

  4. Mar 2023 – present

    Co-organiser

    Effective Altruism Aachen, Aachen

    • Organising the local group's meetups and events and looking after its website and newsletter.

  5. Oct 2020 – Aug 2022

    Student assistant, software development for medical measurement equipment

    Chair for Embedded Software, RWTH Aachen University, Aachen

    • Software in C and Matlab to control medical measurement equipment, including a blood pump control system.

  6. Oct 2018 – Mar 2019

    Student assistant, Android app development

    Institute of Transport and Automation Technology, Leibniz University Hannover, Hannover

    • An Android camera app in Java that processes visible light signals.

  7. May 2017 – Jul 2017

    Internship, software development

    KraussMaffei Berstorff GmbH, Hannover

    • Programming of the BPC Touch control system in C#.

Accomplishments

  • Certified Kubernetes Application Developer (CKAD)

    The Linux Foundation / CNCF · Dec 2025

  • Elastic Certified SIEM Analyst

    Elastic · Jan 2025 · valid until Jan 2027

    Verify

  • Elastic Certified Observability Engineer

    Elastic · Dec 2024 · valid until Dec 2028

    Verify

  • Tines Core and Tines Advanced

    Tines · Dec 2024

  • Elastic Certified Analyst

    Elastic · Jul 2024 · valid until Jul 2030

    Verify

  • Elastic Certified Engineer

    Elastic · Jun 2024 · valid until Jun 2032

    Verify

  • CompTIA Security+

    CompTIA · Mar 2024 · valid until Mar 2027

    Certificate

  • Google Cybersecurity Professional Certificate

    Google / Coursera · Mar 2024

    Verify

  • ML4Good, AI alignment camp

    ML4Good · Sep 2023

    Ten days of deep learning and AI safety; project on compute governance and security.

    Certificate

Blog

All posts →
  • Research

    An authenticating proxy or a VPN in front of self-hosted web apps?

    A VPN hides services completely and protects any protocol; an authenticating proxy leaves them reachable but checks every HTTP request against a central login, with per-app access and a full audit trail. For web apps a well-configured proxy is enough; admin interfaces are worth both.

  • Research

    How hard is a whole-blood donation on the body?

    A whole-blood donation costs a few per cent of peak endurance for about two weeks and takes months to replace in iron stores, but it does not measurably raise the risk of infection in men. Iron, not circulation or immunity, is the part worth watching for regular donors.

  • ResearchAuch auf Deutsch

    Lifted train binding at Deutsche Bahn: is there a duty to re-check the booked connection once the DB Navigator suggests an alternative?

    There is no duty to re-check, before changing trains, whether the originally booked connection has become reachable again. The right to take a different train arises when the delay is announced through one of the channels named in clause 9.1.4 of Deutsche Bahn's conditions of carriage, DB's own timetable information among them, and it does not lapse retroactively.

  • Research

    Complete Food and Home Cooking

    Does a vegan complete-food powder beat cooking plant food at home on climate and health? On climate it comes out close, both around 1–3 kg CO₂e per 2000 kcal, so the choice should not be made on environmental grounds. On health, long-term evidence does not exist in either direction.

  • Research

    Footprints and Handprints

    A footprint figure means nothing without its accounting rule: Germany's published per-person numbers run from 6.8 to 10.4 tonnes a year, and all of them are correct. The ecological footprint is about 60 % carbon, and a handprint, the emissions someone avoids at other people, can be reported beside a footprint but never netted against it.

Publications

All publications →

  • ASMO: a decentralized and verifiable interoperability platform in intensive care

    Frederik Berg, Marc Wiartalla, Moritz Hüllmann, Andreas Derks, Stefan Kowalewski, André Stollenwerk

    Proceedings on Automation in Medical Engineering (AUTOMED 2023), 2023

  • A modular and verifiable software architecture for interconnected medical systems in intensive care

    Marc Wiartalla, Frederik Berg, Florian Ottersbach, Jan Kühn, Mateusz Buglowski, Stefan Kowalewski, André Stollenwerk

    Conference on Computer Science and Information Systems (FedCSIS 2023), 2023

  • A fully automated normothermic machine perfusion system for kidney grafts supporting physiological motivated flow profiles

    Marc Wiartalla, Frederik Berg, Jahn Kühn, Mateusz Buglowski, Stefan Kowalewski, André Stollenwerk, Christian Bleilevens

    Current Directions in Biomedical Engineering (BMT 2023), 2023

Projects

All projects →
A small cabin with a lit desk and a filing cabinet, a person outside on the path looking at a phone

Personal AI infrastructure

Claude Code sessions on a cloud VM, driven from a phone or a browser, with long-term memory, notes, scheduled agents that run my homelab, and a voice line. The core is closed source for now; the clients are open.

A person at a wooden desk sorting letters into pigeonholes, two crumpled envelopes in the waste basket

MailVerdict

A self-hosted mail client with an AI layer. A language model decides what is spam, rules handle the rest, and PostIMAP mirrors the mailboxes into PostgreSQL in both directions.

A wooden lookout tower with a watcher above a small valley, a second tower on a far hill watching the first

Homelab SOC: an Elastic SIEM with agents on the night shift

Every request, pod log, process start, network flow and login of my cluster lands in one Elastic cluster. Detection rules and a judged security-news feed wake AI agents that triage, tune and contain, and a second model watches the agents.

A person at a desk with a large open ledger, a lookout tower seen through the window

Kubernetes homelab on Hetzner

Three Hetzner servers on Talos Linux, managed by Flux, with replicated storage, apps for family and friends, and Borg backups. Every change goes through git.

A hand in a cycling glove on a handlebar, a smartwatch on the wrist, musical notes in the air

Baton

A self-hosted Spotify remote for Garmin watches, built to be used without looking.

kube-borg-backup logo

kube-borg-backup

Kubernetes backups to Borg. Snapshot a volume, clone it and ship it to a Borg repository, installed as a Helm chart.

Architecture diagram of a three-node Talos cluster running Elasticsearch and Kibana through the ECK operator

ECK on Talos

A hands-on guide to a three-node Elastic Stack on Talos Linux with the ECK operator, walked through end to end on fresh VMs.

LIOS app icon

LIOS

Text, images and files between an iPhone and a Linux laptop, in both directions, end-to-end encrypted, through your own relay.

Contact

Write me a mail, or book a slot in my calendar.

fberg@posteo.deBook an appointment