Certified Information Security Manager (CISM)

• Acting as project controller for the STEAM sub-project within Iqony's long-term modernisation programme for an industrial water demineralisation plant at the BP refinery site in Gelsenkirchen-Scholven alongside the parallel WATER sub-project
• Managing cost control, SAP PS data integrity and project tracking in a challenging data environment

• Supported the implementation of §8a requirements of the BSI Act for critical infrastructures.
• Systematically prepared and supported internal and external audits, resolving previous deviations (HA, NA, VP)
• Implemented the specific requirements of the IT security catalog
• Developed training, created run books, and conducted assessments to ensure operational effectiveness.

• Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
• Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
• Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
• Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
• Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
• Implement continuous monitoring solutions to detect and respond to threats in real time.
• Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
• Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
• Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
• Collaborate with project teams to address findings and ensure that security risks are managed effectively.
• Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
• Facilitate a culture of security awareness throughout the organization through training and regular communication.
• Lead security initiatives that align with the organization’s long-term strategic goals.
• Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
• Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

• Functioned as a Fractional CIO for the GCC's largest gaming distributor, leading a complete IT transformation infrastructure upgrade and outsourcing of IT services and ERP applications
• Oversaw the development and rollout of two CEO-sponsored business systems with a $40 million budget, including the implementation of a comprehensive Hydrocarbon Accounting System (Tieto) and a Supply Chain Management System integrating seven multi-vendor applications across Qatargas, Rasgas, and Qatar Petroleum
• Led Schlumberger's global outsourcing, securing a $350 million deal over five years with a 15% cost reduction, managing a global team of over 30 and implementing operational models and frameworks for chargeback, procurement, and IT management
• Navigated technically intricate and organizationally demanding projects for prestigious companies worldwide across more than 30 countries, leading diverse teams and driving strategic innovation

• Placed via recruiter 1st Solution with Deutsche Bahn. Supported and advised on Audit and Cyber Security matters there
• Carried out numerous CSAs (Control Self Assessments), with close exchange with application owners and development of possible remediation solutions, and entered them in DB's risk2value tool from vendor GBTEC2
• Advised on the creation of internal and external security risks

• Development of comprehensive services in cybersecurity, IT governance, and AI
• Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
• Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
• Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
• Responsible for company growth, client relations, and strategic partnerships

• ISMS consulting

• Interim management

• Conducting security analyses & audits

• BCM consulting

• Executive management

• Responsible for IT strategy and operational IT governance in the D-A-CH region, covering infrastructure, applications, operations, security, and support
• Developed and implemented a strategic IT transformation to improve scalability, efficiency, and security of IT systems
• Managed a team of 25 specialists and coordinated with global and regional IT stakeholders
• Deployed a centralized IT service model for 250+ sites to standardize and optimize processes
• Supported and technically executed a carve-out to ensure business continuity
• Introduced modern cloud technologies and automation solutions to optimize processes
• Ensured compliance with ISO 27001, GDPR, and ITIL standards to minimize security risks
• Reduced IT costs by 20% through cloud migration and IT consolidation
• Built and led a high-performing IT team with focus on innovation and service orientation
• Led IT transformation projects including ERP migration, IT security, and digitalization
• Improved IT security level by implementing ISO 27001 and GDPR-compliant processes
• Optimized service times by 30% through AI-powered process automation

• Led cross-industry initiatives in product management, IT governance, agile transformation, and business development.
• Advised executives on portfolio strategy, innovation roadmaps, governance frameworks, and operational execution.
• Developed KPI dashboards and frameworks translating strategy into measurable results.

• Consulting on an ongoing IT security architecture project
• Documenting past progress and planning next steps
• Applying and implementing the BSI IT baseline protection
• Building and maintaining security management systems
• Applying the ISO 27001 standard series
• Integrating ITIL processes into security architectures
• Collaborating with public clients, regulatory authorities and internal and external service providers

• 21 projects ≥ 6 months at large and medium-sized companies
• 13 projects as project or subproject manager
• 6 international projects with English as project language

• Align information security objectives with executive management
• Monitor and steer the Information Security Management System (ISMS) in collaboration with the information security team
• Serve as the primary point of contact for all information security matters and advise internal staff and process owners (e.g., Supplier Management, HR)
• Further develop and improve the ISMS and information security policies
• Deliver training and drive ongoing employee awareness
• Hold monthly coordination meetings (jour fixe)
• Conduct risk analyses together with executive management and process owners
• Support audits (e.g., ISO 27001) as well as customer-specific audits
• Structure assessment and handling of information security incidents in cooperation with the information security team
• Support preparation of the annual plan and budget for information security measures
• Plan and conduct internal audits and management reviews
• Integrate the ISMS with other management systems

• Led infrastructure and security integration project for Private Equity acquisition, reducing security vulnerabilities through streamlined governance.
• Restructured resource allocation for strategic projects, enhancing governance through automated tracking and reporting to executive stakeholders.

Projects:

Project: RWE – Development of a company-wide Zero Trust cybersecurity architecture (CITADEL) Role: Senior Enterprise Cybersecurity Architect / Zero Trust Architect Company: RWE AG Description: Concept and implementation of the strategic CITADEL cybersecurity target architecture at RWE, based on the Zero Trust architecture principle and aligned with regulatory requirements such as NIS2, ISO 27001 and company-wide security governance policies. The goal was to build a measurable, auditable and scalable security architecture with a strong focus on Identity Governance, compliance transparency and operational manageability. Responsibilities & Achievements:

• Zero Trust architecture design: Developed a company-wide Zero Trust reference architecture (Identity, Device, Network, Application, Data) including trust zones, control points and enforcement mechanisms according to NIS2.
• Identity & Access Governance (IGA): Designed and introduced IGA governance structures including role models, recertification processes, segregation of duties (SoD) and lifecycle management for identities and access.
• Security governance & KPIs: Defined and implemented security KPIs and metrics to manage Zero Trust maturity, identity risks and compliance at the management level.
• Compliance & reporting: Built standardized compliance reports and dashboards to support internal audits, external assessments and regulatory evidence (e.g. NIS2).
• Architecture & stakeholder alignment: Worked closely with Enterprise Architecture, IT operations and business units to integrate the CITADEL architecture into existing IT and security landscapes.
• Strategic security consulting: Advised programs and projects on Zero Trust compliance, identity centricity and regulatory requirements in the energy and critical infrastructure (KRITIS) environment. Technologies & Methods: Zero Trust Architecture, NIS2, Identity Governance & Administration (IGA), IAM, RBAC, SoD, Entra ID, SailPoint, Zscaler, Terraform / IaC, Policy as Code, security KPIs, compliance reporting, NIST 2.0, ISO 27001, Enterprise Security Architecture, governance frameworks, risk & control management

Project: Scalable AI Workbench Platform on Microsoft Azure Role: Cloud Architect & Engineer Company: Siemens Energy Description: Design, development and operation of a secure, modular cloud infrastructure to support Data Science, Machine Learning and AI applications for various engineering teams at Siemens Energy. Responsibilities & Achievements:

• Cloud architecture: Designed and implemented an Infrastructure-as-Code solution (Terraform) for automated provisioning of Azure resources (Resource Groups, Storage Accounts, Cosmos DB, Application Insights, networking, PostgreSQL Flexible Server, Azure Container Apps, Azure Container Registry).
• Developer portal: Used Backstage with custom frontend and backend plugins (Node.js, TypeScript, React.js, PostgreSQL, Container Apps) to enable self-service and empower developers, data scientists and AI/ML engineers.
• Role-based access control: Implemented Azure RBAC to grant targeted access (e.g. Storage Blob Data Contributor, Reader) to engineering groups (e.g. AI Engineers) for relevant resources.
• Data platform engineering: Built and configured a multi-layered storage landscape (Raw, Curated, Vector data), including automated container creation and access control for advanced analytics and AI workloads.
• DevOps integration: Integrated with Azure DevOps for CI/CD pipelines to automate deployment, monitoring and compliance.
• Security & compliance: Implemented Private Endpoints, network policies and Managed Identities to ensure data protection and regulatory compliance.
• Collaboration: Worked closely with cross-functional teams to align the cloud infrastructure with business and technical requirements and drive digital transformation at Siemens Energy. Technologies: Azure, Terraform, Azure DevOps, Cosmos DB, Application Insights, Azure Storage, Private Endpoints, Azure Synapse, Azure Machine Learning, Azure Entra ID, RBAC, Backstage, Node.js, React.js, PostgreSQL, Python (automation), Git