City-Reinigung Leverkusen – company website
Website for a dry cleaner in Leverkusen since 1976 – built so that people searching locally find it.
- WordPress
- Local SEO
- Responsive design
Captured
Open to projects Kerpen, near Cologne
Mohammadreza Tavakoli
I build websites, automations and AI agents – with the rigour of someone who audits trust services for a living.
Four short questions – then send it directly or from your own email app. Nothing is sent without you.
Day job Auditor for electronic identities and trust services
TÜV TRUST IT GmbH TÜV AUSTRIA Group
A private side business, independent of my employer – TÜV TRUST IT is not involved in these projects.
- ISO/IEC 27001:2022 Lead Auditor
- IT-Grundschutz-Praktiker
Work in production
Two client websites, live today – shown as they are, not as mock-ups. And the system behind an online business.
Take Haghighi – trilingual community website
One site, three languages. Persian runs right to left, so the whole layout mirrors – not just the text.
- Right-to-left layout
- Trilingual
- hreflang
- schema.org
Captured
E-commerce automation platform
Internal system – no public demo
- TypeScript
- Chrome extension (MV3)
- Node.js
- PostgreSQL
- Railway
What the automation connects. The parts are real; the moving dots are only an illustration.
More builds
- ongoingApplications built on AI agents
- LLMs / GenAI
- Prompt engineering
- Astro
- demo stage2026 – ongoingTradingGuard – risk and discipline tool
- MQL4
- Node.js
- Rule design
- completed2022 – 2023Trading journal with discipline rules
- MQL4
- Automation
- Data analysis
What you can hand over
Three kinds of work, one standard. If your project fits none of them, the fourth card is for you.
Process automation
Repetitive work that someone does by hand today runs on its own afterwards – with a traceable log, so you can see what happened.
- Today
- Someone copies data between portals and spreadsheets by hand.
- Afterwards
- It runs on its own – nobody copies data by hand any more.
- Browser extensions that drive portals without an API
- Syncing data between systems that do not talk to each other
- Reporting and monitoring instead of manual checks
Websites & applications
Fast, findable sites without needless weight – from a one-pager to an application with accounts and a database. This site is one example.
- Today
- Your site is slow, hard to find or hard to change.
- Afterwards
- Fast, findable, multilingual if needed – and yours to keep.
- Company and profile sites, multilingual
- Applications with login, database and reporting
- Technical findability: structured data, load time, accessible markup
AI agents & integration
Putting AI where it actually holds up – and building it so it is hard to misuse. My thesis examined AI agents from the attacker’s side.
- Today
- An AI demo that works in the meeting and fails in daily use.
- Afterwards
- Agents that see multi-step tasks through – tested for prompt injection and misuse before handover.
- Agents that see multi-step tasks through reliably
- Connecting language models to existing systems
- Testing the agents I build for prompt injection and unintended behaviour
Something else
A tool made to measure, an unusual integration, a process nobody has automated yet. Describe it – I will tell you honestly whether it is doable.
How a project runs
Talk
You describe what gets in the way today. I tell you honestly whether I am the right person – and if not, who might be.
Scope in writing
What gets built, what does not, what it costs and how we will know it works – agreed in writing before any work starts.
Visible progress
You see working versions early instead of waiting for a delivery date. Decisions are written down.
Handover with a trail
Code, logins and concise documentation are handed over to you. Automations log what ran and when – so it stays yours, even without me.
Built like it will be audited
Auditing is my day job. I do not offer it here – but it shapes how I build.
Traceable
Automations write a log, so you see what happened – not only that something happened.
Yours
Code, logins, domain and data belong to you. Everything is documented so someone else could take over.
Sparing with data
Nothing is collected that is not needed. This site sets no cookies and loads nothing from third parties.
Fast and findable
Static where possible, structured data, accessible markup – the groundwork search engines and AI assistants read.
Research
My thesis examined how attackers can use autonomous AI agents. That is why I test the agents I build not only for whether they work, but also for how they could be misused.
Bachelor thesis 2026 Grade 1.7
Autonomous AI agents in cybercrime
Risks, scenarios and options for companies
Three attack scenarios worked through
- Autonomous reconnaissance and target selection
- AI-assisted social engineering and phishing
- Exploitation through agentic loops
76 pages German
About
I audit trust service providers against eIDAS and ETSI EN 319 401/411 – as a certified ISO/IEC 27001 Lead Auditor with hands-on experience from critical energy infrastructure and from building AI agents myself.
At TÜV TRUST IT (part of the TÜV AUSTRIA Group) I audit electronic identities and trust services: audit and certification projects against eIDAS and the ETSI standards EN 319 401 and EN 319 411, on site at trust service providers in Germany and abroad.
Before that I spent two and a half years as a working student at a transmission system operator – critical infrastructure in the energy sector, most recently in information security. There I contributed to the ISMS to ISO/IEC 27001: security policies, reviews of risk analyses, preparing internal and external audits – and turning controls from the standard into tasks someone can actually track.
Alongside that I have been building software for years: a trading journal, a complete automation solution made of a browser extension and a server, websites, and applications built on AI agents. My bachelor thesis examined what autonomous AI agents mean in the hands of attackers. That double role is why, on AI topics, I can do more than quote the standard – I know where these systems typically break.
Professional background – not services on offer.
Current
(Junior) Auditor – Electronic identities & trust services (eIDAS)
since 09/2026
Certifications
- ISO/IEC 27001:2022 Lead Auditor
- IT-Grundschutz-Praktiker
- CyberRisikoCheck (DIN SPEC 27076)
Education
Bachelor of Science – Cyber Security Management
2022 – 2026
Final grade 2.0 (German scale, 1.0 = best). Focus: ISO/IEC 27001 & ISMS, BSI IT-Grundschutz, risk analysis, business continuity management, data protection, IT law. Practical project: auditing a company against ISO/IEC 27001.
Languages
- German native
- Persian native
- English full professional (C1)
- French intermediate (B1)
Full career and areas of focus
Professional background – not services on offer.
Career
since 09/2026
(Junior) Auditor – Electronic identities & trust services (eIDAS)
TÜV TRUST IT GmbH TÜV AUSTRIA Group Cologne
- Audit and certification projects against eIDAS and ETSI (EN 319 401/411), in Germany and abroad
- On-site review and assessment of security concepts at trust service providers (TSP/QTSP), with detailed audit reports
- Developing certification procedures further, supporting accreditation processes, working with supervisory authorities
10/2024 – 03/2026
Working student, information security – OT governance & OT management
Amprion GmbH Transmission system operator, critical energy infrastructure Pulheim
- Building and maintaining security policies to meet ISO/IEC 27001 and internal requirements
- Preparing, supporting and following up internal and external audits (including ENTSO-E OPDE)
- Reviewing risk analyses and checking supplier statements for compliance
- Turning ISMS controls into trackable tasks (Jira)
- Producing ISMS reporting for standards committees and the executive board as a basis for decisions
- Designing and running company-wide security awareness campaigns
09/2023 – 09/2024
Working student, system management for process data processing (PDV)
Amprion GmbH Pulheim-Brauweiler
- Handling tickets in process control technology (OT), applying security policies to PDV systems
- Setting up and hardening configuration laptops (BitLocker, anti-virus, patch management)
Areas of focus
Standards & frameworks
- eIDAS / eIDAS 2.0
- ETSI EN 319 401
- ETSI EN 319 411
- ISO/IEC 27001
- ISO/IEC 2700x series
- BSI IT-Grundschutz
- DIN SPEC 27076
Audit & governance
- Audit and certification projects
- Building and running an ISMS
- Risk management
- Compliance & reporting
- Business continuity management
- Security awareness
AI & development
- AI agents
- LLMs / GenAI
- Prompt engineering
- Prompt injection & jailbreaking
- Workflow automation
- Web and app development
Questions before you hire
You work full-time as an auditor. Do you have time for my project?
Development work is a private side business, independent of my employer. I take on only a few projects, so each one gets my direct attention. Before you commit, you get a realistic start date – not an optimistic one.
What does it cost?
It depends on scope, so there is no price list. Before any work starts, you get a written proposal with scope and price. The first conversation and a rough estimate are free.
Who owns the result?
You do – code, logins, domain and data are fully handed over to you.
Our software has no interface for this. Can it still be automated?
Often, yes. Where a system or portal has no API, a browser extension can do the work in the browser – provided its terms of use allow automated access, which we check first. That is how my e-commerce automation runs.
Do you also offer IT security or ISMS consulting?
No. I audit at an accredited certification body, and whoever audits should not consult in that field. Security shows up here as a quality of what I build – not as a separate service.
Which languages can we work in?
German, English or Persian. Websites are possible in any of them – including right-to-left layouts.
Put it on my desk.
Four questions and your enquiry is written. Send it directly from this page or open it in your own email app – nothing is sent until you decide.
I reply personally – no sales team, no autoresponder.