André Vorbach
Head Of Chapter Red Team at Telekom Security
Frankfurt, Hesse, Germany
Summary
🤩
Rockstar🎓
Top SchoolAndré Vorbach is a seasoned security leader with 11+ years of experience in red teaming, incident response, and early-warning systems, currently heading the Chapter Red Team at Telekom Security in Frankfurt. He combines hands-on offensive security and penetration testing with backend development expertise, having led honeypot design and logging improvements for prominent open-source projects like Conpot to enhance visibility into ICS/SCADA attacks. His background spans government CERT incident handling at BSI to senior roles across Deutsche Telekom and T-Systems, giving him rare insight into both national-scale crisis management and enterprise security operations. Known for pragmatic tooling and protocol-level engineering, he routinely bridges research, detection engineering, and operational response. Colleagues rely on him for transforming attack analysis into actionable defenses and measurable telemetry improvements.
11 years of coding experience
5 years of employment as a software developer
MSc. Computer Science, MSc. Computer Science at University of Wisconsin-PlattevilleBSc. Computer Science, BSc. Computer Science at Fachhochschule Darmstadt
German, English, Croatian, French
Github Skills (14)
icss10
security10
honeypot10
python10
tftp9
ftp9
modbus9
bacnet9
scada9
snmpd9
snmp9
http9
json8
network-programming8
Programming languages (8)
Github contributions (5)
mushorg/conpot
Aug 2018 - Aug 2018
ICS/SCADA honeypot
Role in this project:
Back-end Developer & Security Engineer
Back-end Developer & Security EngineerContributions:6 commits, 1 PR, 10 comments in 2 days
Contributions summary:André primarily focused on enhancing the Conpot honeypot's logging capabilities and improving data collection related to network connections. Their contributions involved modifying several protocol handlers (SNMP, BACnet, IEC104, GuardianAST, S7Comm, Kamstrup, TFTP, FTP, HTTP, and Modbus) to record destination IP addresses and ports, enhancing the visibility of incoming connections. Additionally, they refactored the logging mechanism to include destination IP and port in the JSON logs and implemented the `get_interface_ip` function to obtain local IP addresses.
pythonsecurity-toolssecurityicsscada
telekom-security/t-pot-autoinstall
Apr 2015 - Jun 2018
Contributions:2 releases, 52 commits, 4 PRs in 3 years 2 months
linuxpott-potautoinstallubuntu
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.