# Moritz Schacke

> Software Developer & Business Informatics Specialist – Clarity. Maintainability. Performance.

I build software to a plan: understandable for whoever develops it next, maintainable through years in production and fast for everyone who uses it. Since 2020 I have been building and running the support ecosystem of the Behnke Group. Alongside, I take on commissions with devgineers: software, development processes and product security.

- Saarland, DE · Remote worldwide
- 6+ years of coding
- 5 years of platforms in continuous production
- B.Sc. Business Informatics
- 6 entry offers via devgineers

**Software, built to plan.**

- **Understandable:** Code the next person understands without me. Clear names, clear boundaries, no magic.
- **Maintainable:** Built for years in production, not just until launch. Tests, updates and monitoring are part of the plan.
- **Fast:** Performance is a requirement, not an afterthought. Measured, not guessed.

## devgineers (Part-time self-employed – taking on commissions)

Software. Processes. Security. Through devgineers I take on commissions alongside my job: custom software, modernisation and rebuilds, websites with hosting and maintenance, Linux servers, development processes (secure SDLC, Scrum) and technical product security and CRA consulting – in sprints where every interim state is visible.

- https://devgineers.de
- https://devgineers.de/kontakt
- https://moritzschacke.de/en/projekte/devgineers

## Experience

### Owner – software engineering, secure SDLC & CRA consulting – devgineers

10/2026 – present

Alongside my employment I take on commissions with devgineers – as the single contact from the first question to handover.

- Custom software, modernisation and rebuilds in sprints with a working state after every sprint.
- Websites with hosting and maintenance, and setting up, hardening and maintaining Linux servers.
- Development processes and product security: secure SDLC, Scrum, CRA gap assessments and secure SDLC reviews.

### Product and Development Security Coordinator (PDSC) – Telefonbau Behnke GmbH

10/2026 – present

In addition to my role as a developer, I am responsible for product and development security: from the Cyber Resilience Act to secure development processes and evidence in CI/CD.

- Implementing the Cyber Resilience Act (Regulation (EU) 2024/2847) for the products: requirements and risk analysis, technical documentation and alignment with harmonised EU standards such as EN 18031.
- Vulnerability management: a central reporting point for vulnerabilities, confidential handling within the deadlines of CRA Art. 14 and GDPR Art. 33, published security advisories.
- Secure development processes: requirements, reviews, tests and approvals traceable from commit to release – as the basis for conformity assessment and updates throughout the support period.
- CI/CD with GitLab Ultimate: security scans for code, dependencies and secrets, software bills of materials (SBOM), tests and coverage as evidence in the pipeline.
- A secure supply chain down to production: signed, encrypted software releases as well as signed firmware and secure boot when devices are first programmed.

### Business Informatics Specialist, Software Development – Telefonbau Behnke GmbH

01/2026 – present

Developing and running the group's web platforms and internal tools – secure, documented and with AI-assisted tooling.

- Support ecosystem: the new support server (PHP 8.5, REST API, sign-in with TOTP and passkeys), the security reporting point, the status page and the wiki system for product documentation in three languages.
- Secure and documented code: strict typing, static analysis at the highest level (PHPStan max), automated tests in GitLab CI, security built into the framework rather than case by case, and documentation maintained alongside the code.
- AI in development: AI-assisted work with Claude Code and Codex, integrating LLM APIs and AI platforms – with review, tests and clear limits on what an agent may read and change.
- Internal tools and infrastructure: licence-secured APIs for firmware, manuals and changelogs, a shared CDN for all web projects and tools for production.

### Business Informatics Specialist, Software Development – Notrufzentrale Behnke GmbH

10/2025 – 12/2025

### Working Student (Master of Science) – Telefonbau Behnke GmbH

04/2025 – 09/2025

Development of new features and internal tools, extension of core systems.

### Working Student (Bachelor of Science) – Telefonbau Behnke GmbH

10/2020 – 03/2025

Modernisation of existing PHP and Java tools.

### Temporary Assistant, Technology & Support – Telefonbau Behnke GmbH

08/2020 – 10/2020

## Education

### Master of Science in Business Informatics

IWi im DFKI, Universität des Saarlandes, Saarbrücken · 04/2025 – 09/2025

Discontinued after one semester.

Data Engineering, Artificial Intelligence, Computer Graphics, Project Management, IT Law

### Bachelor of Science in Business Informatics

IWi im DFKI, Universität des Saarlandes, Saarbrücken · 10/2021 – 03/2025

Bachelor's thesis “AI as an Innovator for Automating Process Modelling”: a comparison of eight LLMs for BPMN generation.

Programming, Algorithms, Software Engineering, Big Data, Strategic Management, Game Theory

### Bachelor of Science in Computer Science

SIC, Universität des Saarlandes, Saarbrücken · 10/2020 – 09/2021

Transferred to Business Informatics.

### Abitur (German university entrance qualification)

Theodor-Heuss-Gymnasium, Sulzbach (Saar) · 09/2012 – 07/2020

Advanced courses in Mathematics and English.

## Skills

Every level is backed by projects.

### Programming Languages

- PHP – Expert (since 2020)
- JavaScript – Expert (since 2020)
- SQL – Expert (since 2020)
- HTML5 & CSS – Expert (since 2020)
- Java – Advanced (since 2020)
- TypeScript – Advanced (since 2026)
- Bash – Advanced (since 2021)
- Python – Proficient (since 2024)
- C/C++ – Basics

### Backend & Frameworks

- Framework-Design (PSR-7/11/14/15/16) – Expert (since 2026)
- REST-API-Design & -Dokumentation – Expert (since 2025)
- Software-Architektur – Expert (since 2025)
- Legacy-Modernisierung & Migration – Expert (since 2020)
- Node.js & TypeScript-Ökosystem – Advanced (since 2026)
- JSON Schema & Validierung (opis, Zod) – Advanced (since 2026)
- PDF-Erzeugung (mPDF, Dompdf) – Advanced (since 2022)
- OAuth 2.0 – Proficient (since 2026)
- Laravel – Basics
- Symfony – Basics
- Spring – Basics

### Frontend & Mobile

- Vanilla JS (UI ohne Framework) – Advanced (since 2020)
- React Native & Expo – Proficient (since 2026)
- React – Proficient (since 2026)
- Bootstrap – Proficient

### Databases

- MySQL – Expert (since 2020)
- Schema-Migrationen – Advanced (since 2025)
- SQLite – Proficient (since 2026)
- PostgreSQL – Basics

### Cloud, Infrastructure & DevOps

- Linux-Server (Ubuntu): Einrichtung, Härtung, Betrieb – Expert (since 2020)
- Git & GitLab – Expert (since 2020)
- Monitoring & Health-Checks – Expert (since 2025)
- Release-Signierung & -Verschlüsselung – Expert (since 2025)
- Cron-Jobs & Hintergrundprozesse – Expert (since 2022)
- GitLab CI/CD – Advanced (since 2026)
- Docker – Advanced (since 2022)
- AWS (S3, Polly, AWS SDK) – Advanced (since 2024)
- Hosting & Serververwaltung (VPS, Plesk) – Advanced (since 2020)
- Cloudflare Workers – Proficient (since 2026)
- SIP / Kamailio – Basics (since 2021)

### Security & Compliance

- Cyber Resilience Act (EU) 2024/2847 – Expert (since 2025)
- Coordinated Vulnerability Disclosure – Expert (since 2026)
- Web-Security: CSRF, Sessions, parametrisiertes SQL, Security-Header – Expert (since 2020)
- Authentifizierung: JWT, TOTP, WebAuthn/Passkeys – Advanced (since 2025)
- Kryptografie in der Praxis (libsodium, Ed25519, Signaturen) – Advanced (since 2025)
- EN 18031 – Proficient (since 2026)
- Secure Boot (Produktion) – Proficient (since 2026)
- DSGVO (Meldefristen, Privacy by Design) – Proficient (since 2026)

### Quality & Process

- PHPStan (Level max) – Expert (since 2025)
- PSR-12 & php-cs-fixer – Expert (since 2025)
- Technische Dokumentation – Expert (since 2022)
- Code Review (auch KI-gestützt) – Advanced (since 2025)
- PHPUnit – Advanced (since 2026)
- Semantic Versioning & Release-Management – Advanced (since 2026)
- Vitest & Jest – Proficient (since 2026)
- Agile / Scrum – Proficient

### Accessibility, i18n & SEO

- Mehrsprachigkeit (DE/EN/FR und mehr) – Expert (since 2020)
- Barrierefreiheit (OpenDyslexic, Kontrast, Lesehilfen) – Advanced (since 2022)
- SEO (JSON-LD, Meta, OG/Twitter) – Advanced (since 2021)

### AI & LLMs

- KI-gestützte Entwicklung: Claude Code, Codex – Expert (since 2026)
- KI-gestützte Workflows – Expert (since 2026)
- Prompt Engineering – Expert (since 2024)
- LLM-Evaluation & Benchmarking – Advanced (since 2024)
- Model Context Protocol (MCP) – Advanced (since 2026)
- KI-Agenten-Infrastruktur – Advanced (since 2026)
- Claude, GPT, Gemini, Ollama – Advanced (since 2024)

### Game Development

- Minecraft: Spigot & Forge – Advanced (since 2020)
- libGDX & OpenGL – Proficient
- Entity Component System – Proficient
- Client/Server-Spielarchitektur – Proficient (since 2026)

### Hardware-near Development

- Board-Programmierung in der Produktion – Proficient (since 2026)
- Geräteerkennung im Netzwerk (mDNS) – Proficient (since 2022)

### Tools

- VS Code – Expert
- Composer & npm – Advanced
- IntelliJ IDEA – Proficient
- Gradle & Maven – Proficient

## Languages

- German: Native
- English: C1
- French: B1
- Dutch: A1

## Projects

### Behnke Support Ecosystem

*Flagship · Software development, Behnke Group · 2020 – present*

Support infrastructure of the Behnke Group with device management, automatic updates, a multilingual documentation wiki, custom status monitoring and a responsible-disclosure portal.

#### Building blocks

- [Support-Server](https://behnke.support): Device management and automatic update delivery.
- [Wiki](https://wiki.behnke.support): Multilingual documentation with accessibility features (font sizes, contrast, OpenDyslexic, screen ruler) and PDF export.
- [Status](https://status.behnke.support): Custom monitoring: DNS, TCP, TTFB latency and uptime history.
- [Security](https://security.behnke.support): Responsible-disclosure portal with published advisories.
- [behnke-online.fr](https://behnke-online.fr): The group's French website.

#### Details

- I set up the support server's Ubuntu VPS myself and maintain it continuously – from deployment to monitoring.

Technologies: PHP, MySQL, JavaScript, Ubuntu VPS, i18n (DE/EN/FR), Accessibility, Monitoring, Security

- [behnke.support](https://behnke.support)

### devgineers

*Part-time business · Owner & developer · 10/2026 – present*

My part-time business for software engineering, secure SDLC and CRA consulting: custom software, modernisation, websites with hosting, Linux servers, development processes and product security – I take on commissions via devgineers.de.

#### Details

- Software. Processes. Security. – six services, each bookable on its own: software engineering, modernisation & rebuilds, websites with hosting & maintenance, Linux servers & maintenance, development processes and product security.
- Entry offers with a described scope and result: CRA Gap Assessment, Secure SDLC Review, Architecture Review, modernisation check, website package and Software Discovery.
- Development in sprints of usually two weeks: a working state after every sprint, and clients steer along.
- Evidence is created in the process: security checks run in the pipeline with every release, not just before an audit.
- One contact from the first question to handover. Technical CRA consulting is not legal advice, and an assessment is not a certification.

Technologies: PHP 8.5, devgine, Secure SDLC, Scrum, CI/CD, CRA, Linux

- [devgineers.de](https://devgineers.de)
- [Discuss a project](https://devgineers.de/kontakt)
- [Entry offers](https://devgineers.de/angebote)

### devgine / web

*Own engine · Author & maintainer · 07/2026 – present*

PSR-compliant PHP web engine: container, router, middleware kernel, views with a component system and a database layer – with no runtime dependencies beyond PSR interfaces. moritzschacke.de runs on it.

#### Building blocks

- Container: PSR-11 with autowiring, contextual bindings and a service-provider lifecycle.
- HTTP & Middleware: PSR-7/15, onion middleware pipeline, security headers.
- Routing: Named routes, regex-constrained parameters, attribute routes, model binding.
- Views: PHP templates with layouts and sections; components bundle HTML/CSS/JS.
- Database: Query builder with prepared statements, schema builder, CLI migrations.
- Auth & Sessions: Session guard, remember-me, CSRF protection, secure cookies (HttpOnly/SameSite/Secure).
- Further modules: Validation, PSR-16 cache, PSR-14 events, PSR-3 logging, mail, filesystem, localisation, rate limiting, pagination, CLI, testing helpers.

#### Details

- PHPStan at level max without a baseline, tests for every public API, PSR-12 enforced by php-cs-fixer.
- Semantic versioning, conventional commits, changelog following Keep a Changelog.
- Closed source – code samples and deep dives on request.

Technologies: PHP 8.5, PSR-3/7/11/14/15/16/17, PHPStan, PHPUnit, PSR-12


### devgine / game

*Own engine · Author & maintainer*

2D game engine built on libGDX with an entity component system: composition over inheritance, designed for many entities per frame.

#### Details

- Entities are IDs, components are pure data, systems hold the logic.
- Data-oriented design instead of deep object graphs.
- libGDX handles rendering, input and the platform layer; the architecture on top is custom.
- Motivation: off-the-shelf game engines often ship more editor than engine for 2D projects.

Technologies: Java, libGDX, OpenGL, ECS, Data-oriented design


### Bachelor's Thesis: LLMs × BPMN

*Research · Author, B.Sc. Business Informatics (IWi at DFKI, Saarland University) · 01/2025*

Systematic comparison of eight LLMs generating BPMN 2.0 models from natural language – with a custom evaluation framework and real-world datasets.

#### Research

- Research question: Can freely available language models generate valid, usable BPMN 2.0 models from natural-language descriptions?
- Models evaluated: o1, GPT-4o, GPT-4o-mini, GPT-4, Claude, Gemini, Gemini 2.0, Mistral 7B
- Datasets: Camunda, hdBPMN
- Method: 20+ tasks in two task classes, including seven pseudo-BPMN tasks targeting specific specifications; identical prompting strategy for all models.
- Metrics: Valid BPMN 2.0 XML, Completeness, Precision, F1 score, Logical correctness (soundness)

Findings:

- Clear instructions produced near error-free models.
- Unstructured process descriptions clearly degraded the results of every model.
- Producing valid XML proved harder than understanding the process.
- Human review remains necessary for production use.

Technologies: LLM evaluation, BPMN 2.0, Prompt engineering, F1 score, Camunda, hdBPMN


### GameTecX

*Gaming club · Founder & developer · 2020 – present*

A gaming club among friends and, at the same time, the lab where tech ideas grow without client pressure – with custom Minecraft plugins and mods as well as GTA roleplay projects.

#### Building blocks

- Minecraft-Server: Custom plugins based on the Spigot API, tailored to the community.
- Minecraft-Mods: Custom mods built with Forge.
- GTA-RP: GTA roleplay server projects and game prototypes.

#### Details

- A playground where the tech still has to run reliably – because people play in the evening.

Technologies: Java, Spigot API, Forge, Server operations, Community management


### Eric Carphotography

*Project for a friend · Concept, development, SEO · 2021 – present*

A project for a friend: the portfolio website for his automotive photography – gallery-focused, optimised for discoverability and multilingual, free of site-builder limits.

#### Details

- SEO foundation maintained per page: meta description, OG/Twitter tags, canonical, keywords, theme-color.
- Multilingual without heavy frameworks (DE, EN, FR, NL, PL, RU, ZH).
- Lightweight cookie consent instead of third-party banners.
- Blog with multilingual content management.

Technologies: devgine, SEO, i18n, Cookie consent, Performance

- [ericcarphotography.com](https://ericcarphotography.com)

## More systems

- [Behnke Support Server (rewrite)](https://behnke.support) (08/2025 – present): Successor to the legacy support server: firmware downloads, licences, manuals and version information for Behnke products, management of accounts, devices and API keys, and a REST API for external systems. Sign-in with 2FA via TOTP and passkeys (WebAuthn).
- [Behnke Wiki System](https://wiki.behnke.support) (12/2022 – present): PHP application that serves GitLab wikis as dynamic, accessible web pages – for product documentation on Behnke intercoms, emergency call stations, IP intercoms and accessories. Plus editorial work in the German, English, French and internal wikis (around 2,800 commits).
- [Behnke System Status](https://status.behnke.support) (08/2025 – present): Central status page for all Behnke web products: a checker polls health endpoints, stores availability and latency as a time series and shows overall status, latency statistics and uptime history. Plain PHP with no dependencies and no database; it monitors itself too.
- [Behnke Security Reporting Portal](https://security.behnke.support) (04/2026 – present): Central reporting point for vulnerabilities in Behnke products: accepts reports via form or email, turns them into confidential incidents with the deadlines from CRA Art. 14 and GDPR Art. 33, and publishes advisories. Trilingual.
- [Behnke CDN](https://cdn.behnke.support/licenses) (09/2025 – 04/2026): Content delivery network for all of the group's web projects: shared, versioned scripts, styles and assets with documented licences.
- [behnke-online.fr (FR web system)](https://behnke-online.fr) (06/2024 – present): Backend, frontend and custom content management for the group's French website, with automatic synchronisation and text-to-speech via Amazon Polly.
- [Pong clone](https://github.com/moritzschacke/pong-clone): Pong in Java with raylib bindings, plus its own server.

## Contact

- info@moritzschacke.de
- https://moritzschacke.de/en/kontakt