Certified Information Systems Security Professional (CISSP)
credential in minutes from over 15,000 CVs with the power of AISecure your enterprise architecture, establish resilient risk management frameworks, and ensure regulatory alignment. Find vetted cybersecurity leaders matched to your project demands in minutes.
Meet FRATCH Certified Information Systems Security Professionals (CISSP)
Stefan V.
Last position:
Managing Director and Technical Lead at Building a Trading Company
- Developed business strategy, positioning, and market approach for a new B2B and B2C trading company.
- Designed and implemented the corporate website and online shop end to end, and coordinated suppliers and digital sales capabilities.
Jerry B.
Last position:
Owner at DIGIPM Consulting e.U.
From 02/2023 to 05/2024: IT interim manager within an international construction chemicals group headquartered in Germany as Global TSA Manager in a carve-out project responsible for the IT workstream.
End-to-end management of an international IT carve-out and TSA program, including transition of five service providers, governance and operating structures, service continuity, provider performance, SLA/KPI and cost management, SIAM and supplier management, security services, operational readiness, and transition into stable operations.
From 06/2024: IT consulting in project management and IT service management areas, providing PM/PMO coaching and support.
Georgios S.
Last position:
Senior Software Engineer at UBS Bank
- Implementations of a code refactoring framework able to refactor thousands of repositories leveraging Generative AI
- Use Python (Django, Flask, FastAPI), Java and Typescript in Azure Cloud (Data Lake, VMs, AI) and GitLab infrastructure
- Mentoring and pair programming
- Obtained Azure AI-900 and AI-102 certifications
Rudolf E.
Last position:
Datacenter Engineer, Network & Security Administrator at International insurance group
Operation and further development of the network and security infrastructure.
Monitoring, analysis and resolution of network and security incidents.
Cross-department collaboration with other specialist teams for operations, further development and reporting.
Firewall vulnerability analysis.
Firewall rule approvals.
Troubleshooting IP communication issues in the network and firewall infrastructure.
Security-critical IT infrastructure, processing of personal data, compliance with legal regulations.
Products: Palo Alto Networks Firewalls, Cisco ACI, Checkpoint Firewalls, F5
Technologies: SDN, SDWAN, Cisco EPIC, Cisco ACI
Herbert F.
Last position:
Pentest Center of Excellence - Strategy & Implementation at Cybersecurity & IT Risk Managed Services
- Built board/management business-case scenarios; assessed services, vendors, contracts and financials; defined target operating model, service catalogue, organization, processes and tooling.
- Implemented near-shore CoE in Romania and supported rollout to an international insurance group
Philipp L.
Last position:
External Consultant & Interim Manager at Löffler Management GmbH
- Project manager for IT governance and IT compliance (including ISAE 3402, ISO 27001, DORA and NIS2 implementations)
- Project manager for digital transformation (including ServiceNow)
- Industries: banking, insurance and automotive
Robert F.
Last position:
Interim Project Manager at IT services company of a regional energy supplier
- Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
- Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
- Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
- Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
- Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
- Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
- Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.
René Z.
Last position:
DevSecOps & Kubernetes Engineer (Freelance) at mgm technology partners GmbH
Development of a Custom Jenkins Shared Library (Groovy)
Integration of security checks in CI/CD pipeline (Shift-Left Approach)
Automated vulnerability scanning and remediation workflows
GitOps-based deployments with ArgoCD
Semantic versioning automation with Git integration
Container lifecycle management (Build/Scan/Tag/Push)
ArgoCD webhook integration for event-driven deployments
Complete cluster automation with Ansible
Bare-metal Kubernetes installation from scratch
High-availability control plane setup
Unified deployment system for multi-application orchestration
Configuration management according to NIST SP 800-128
Host security: Linux hardening, SELinux/AppArmor
Network security: NetworkPolicies, micro-segmentation
Application security: RBAC, Pod Security Standards
Data security: Encryption at rest and in transit
Defense-in-depth principles
Certificate management with cert-manager
Secrets management with External Secrets Operator connected to Vault
Infrastructure monitoring with Checkmk
Prometheus/Grafana monitoring stack
Security event detection and logging
Automated health checks and incident response procedures
MetalLB load balancing for bare-metal
Nginx ingress controller with SSL passthrough
NetworkPolicies for security zones
Rook-Ceph distributed storage, CNI configuration (Weave Net)
Container & orchestration: Kubernetes (bare-metal), Docker, Helm
CI/CD & GitOps: Jenkins (Custom Shared Library), ArgoCD, Groovy
Automation: Ansible, Bash, Python
Security: nftables, RBAC, NetworkPolicies, cert-manager, Vault, Sealed Secrets
Monitoring: Checkmk, Prometheus, Grafana
Storage & networking: Rook-Ceph, MetalLB, Nginx Ingress, Calico
Collaboration: Jira, Confluence
OS: Debian, Ubuntu
Julian W.
Last position:
Renewal of the active network infrastructure
As part of this project, the existing active network infrastructure was modernized and aligned for the future. The goal was to introduce a high-performance, secure, and scalable network and WLAN infrastructure, including a Network Access Control (NAC) solution to improve network security and central access control.
At the start of the project, a comprehensive requirements analysis was carried out, taking into account the technical, operational, and security-related needs of the clinic sites. Based on this, a technical tender was prepared for new switches, WLAN access points, and the NAC solution.
By successfully delivering the project, a modern, standardized, and secure network infrastructure was established that meets the growing demands for availability, mobility, and IT security in clinical operations.
Tasks:
- Support of the tender process, including technical evaluation of the offers and bidder assessment
- Lead and coordinate the entire project delivery
- Align the project process with internal stakeholders, business units, and the hospital IT team
- Manage external service providers during implementation and installation of the systems
- Monitor implementation, including quality control, project acceptance, and issue management
- Coordinate communication between hospital IT and external service providers during the NAC implementation
- Carry out escalation management for technical and organizational challenges
- Ongoing budget tracking as well as monitoring of project effort and additional costs
- Prepare decision papers on project changes, additional services, and risks for management
Sascha L.
Last position:
CEO at SEComply
- Founder & creator of a cutting-edge Governance, Risk & Compliance SaaS solution.
- Developing and executing business development strategies to identify new opportunities and expand market presence.
- Providing information security consulting services.
- Specializing in governance, risk, and compliance (GRC) topics such as risk management, ISO 27005, ISO 27001, NIS 2, DORA, PCI DSS, EU-GDPR, and more.
- Past projects:
- Kyndryl Austria GmbH: delivered IAM blueprint, conducted risk assessments, developed transformation strategy and roadmap for client projects, and provided support in pre-sales activities to align solutions with client needs.
- Cashpoint Sportwetten GmbH: conducted ISO 27001:2022 gap analysis, enhanced ISMS processes, updated security training, aligned with ISO 27001:2022 standards, and improved vulnerability management practices through regular assessments and remediation planning.
- Hornbach Baumarkt AG: supported the CISO in achieving ISO 27001 compliance, implementing a secure software development lifecycle (SDLC), strengthening vulnerability management practices, and enhancing risk management frameworks.
- MHP Management- und IT-Beratung GmbH: created and reviewed security concepts aligned with ISO 27001 standards.
- Stromnetz Berlin GmbH: developed a comprehensive security concept based on ISO 27001 requirements.
- dmTech GmbH: conducted IT security training for employees, fostering awareness and adherence to security best practices.
- Finanz Informatik GmbH: managed PCI DSS-related tasks, including compliance assessments and control implementations.
- TIPS Messtechnik GmbH: conducted NIS2 gap analysis, developed a comprehensive compliance roadmap, and provided supportive actions to address identified gaps and ensure alignment with regulatory requirements.
Enrique G.
Last position:
Security Architect at Capgemini
I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.
Rene S.
Last position:
Head of Digital Services & IT at reet systems gmbh / THEOPHIL Holding GmbH
- Overall responsibility for IT, software development, and digital services of the company for brands such as Rosenberger, Rosehill, Burger King Austria (approx. 70 companies)
- Built the holding's lakehouse and data analytics platform
- Established and led the software development and IT department
- Established and led the operation (cloud-native AWS) of the B2B platform
- Connected IoT systems and developed models for predictive maintenance and production planning, data lake/lakehouse, and BI
- Preparation for ISO 27001 information security certification
- Technologies: Cloud, AWS, Java, Cypress, Angular, Python, Go
Marco Z.
Last position:
Product Owner IT Services; Solution Architect central service delivery at BWI
Create product vision
Commission Scrum teams
Create schedule and coordinate with project lead
Coordinate and align with stakeholders
Harmonize processes across initiatives
Present project content at C-level
Create security concept for classified information up to DEU GEHEIM and NATO SECRET considering BSI GS, KRITIS, SÜG, VSA
Plan service changes to underpinning services
Design architecture for secure infrastructures
Dependency management in project context
Risk management
Requirements management
Commission and oversee protection needs analysis and information security concept
Coordinate service design activities
Lukas K.
Last position:
Chief Information Security Officer (CISO) at eurofunk Kappacher GmbH
- leading and developing information security team
- responsible for security decisions in customer projects (in sensitive public sector)
- ensuring that sophisticated compliance requirements are adequately met
Stephan L.
Last position:
Managing Director at SwissArx UG (haftungsbeschränkt)
- Sole responsibility for the management and strategic direction of an IT services and consulting company
- Responsible for company development, business development and market positioning
- Development and implementation of corporate strategies, business models and processes
- Contact person for customers, partners and stakeholders
Discover over 15,000 top freelancers
Certified Information Systems Security Professionals (CISSP) statistics
Aggregated from the professional profiles of matched freelancers.
Experience
22 years
Position duration
2.4 years
Positions per freelancer
15
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
85%
Master's degree or higher
68%
Doctorate
18%
Certifications per freelancer
11
Most common languages
German, English, French
Speak two or more languages
100%
Based on our profile pool as of 26 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of experts holding this certification are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates for Certified Information Systems Security Professionals (CISSP)
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 26 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Certified Information Systems Security Professionals (CISSP) experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (97%)
- Professional Services (59%)
- Banking and Finance (54%)
- Manufacturing (46%)
- Transportation (44%)
- Healthcare (38%)
- Insurance (38%)
- Telecommunication (38%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the certification
The Global Benchmark for Cybersecurity Leadership
The Certified Information Systems Security Professional credential, administered by ISC2, represents an elite standard in information security. It validates that an expert possesses the advanced technical expertise and strategic management acumen required to design, implement, and govern comprehensive cybersecurity programs. Rather than focusing solely on administrative policies or narrow technical controls, it bridges the gap between executive strategy and technical operational defense.
The Eight Core Knowledge Domains
- Security and Risk Management, covering compliance, governance, threat modeling, and business continuity
- Asset Security, emphasizing data classification, retention, privacy requirements, and handling controls
- Security Architecture and Engineering, evaluating secure design principles, cryptography, and vulnerability mitigation
- Communication and Network Security, addressing network components, secure channels, and infrastructure design
- Identity and Access Management, controlling logical access, identification systems, and authentication methodologies
- Security Assessment and Testing, designing vulnerability assessments, audit strategies, and test outputs
- Security Operations, handling digital forensics, incident management, disaster recovery, and continuous monitoring
- Software Development Security, applying security concepts throughout the full software development lifecycle
Professional Profiles Holding the Credential
Professionals holding this credential frequently work as Chief Information Security Officers, interim security leaders, principal security architects, and governance advisors. They operate across regulated environments such as financial services, healthcare, and critical infrastructure. These specialists excel at aligning complex defensive technologies with business priorities, orchestrating incident responses, and translating technical cyber risk into actionable executive guidance.
Value Delivered to Hiring Organizations
Engaging an external consultant with this credential provides immediate assurance of verified experience and strategic capability. These specialists rapidly audit security postures, resolve regulatory non-compliance, and architect scalable defense mechanisms. Their comprehensive perspective minimizes the risk of architectural blind spots, accelerates time-to-compliance, and protects enterprise assets against sophisticated threat vectors.
Frequently asked questions
Not sure where to start with Certified Information Systems Security Professionals (CISSP)? These answers cover the essentials.
A consultant holding the CISSP has demonstrated comprehensive mastery across the eight domains of information security. This includes enterprise risk management, secure system architecture, network defense, identity governance, and incident recovery. The credential confirms an expert can design, implement, and manage advanced security programs aligned with business objectives.
While tactical credentials focus on hands-on penetration testing and ethical hacking techniques, the Certified Information Systems Security Professional emphasizes broad architectural design, governance, and leadership. It prepares consultants to oversee entire security postures rather than executing isolated technical exploits. Organizations engage these professionals to build defenses, establish policies, and direct cross-functional security strategies.
Candidates pursuing the CISSP must demonstrate extensive cumulative paid work experience spanning multiple security domains before earning full status. Those who pass the comprehensive examination without the required practical tenure receive an associate designation until they satisfy the background criteria. Candidates must also complete a professional endorsement process and commit to a strict code of ethics.
Both certifications target senior practitioners, but the CISSP covers a broader combination of technical architecture, engineering, and managerial oversight. In contrast, CISM concentrates more narrowly on security governance, program development, and incident management from an administrative viewpoint. Many organizations choose holders of the ISC2 credential when projects demand deep architectural understanding alongside strategic governance.
The examination for the Certified Information Systems Security Professional evaluates conceptual comprehension, scenario analysis, and professional judgment rather than basic memorization. Most testing centers employ computerized adaptive testing that adjusts question difficulty based on prior answers. Test takers must analyze complex real-world situations, evaluate competing priorities, and select the most effective enterprise security solution.
Professionals maintaining the CISSP must complete ongoing continuing professional education activities throughout a recurring multi-year cycle. These activities include attending industry conferences, conducting technical research, publishing security literature, and completing advanced training courses. Active standing also requires the payment of regular maintenance dues directly to ISC2.
Hiring a CISSP expert is critical during enterprise cloud migrations, zero trust implementations, and post-merger infrastructure consolidations. Organizations facing rigorous regulatory scrutiny, such as major compliance audits, also rely on these consultants to design resilient controls. They are equally valuable for interim executive security leadership and comprehensive enterprise risk assessments.
The CISSP proves broad, vendor-neutral expertise across the entire security spectrum rather than configuration knowledge for a single commercial product. While vendor-specific certifications show familiarity with individual tools, this credential confirms the consultant knows how to integrate diverse systems into a unified defensive posture. It ensures that tactical vendor implementations serve a coherent, enterprise-wide security strategy.
The average hourly rate for freelancers with Certified Information Systems Security Professionals (CISSP) is 122 €, which corresponds to a daily rate of about 973 € based on an 8-hour working day.
Of the freelancers with Certified Information Systems Security Professionals (CISSP), 85% hold at least a Bachelor's degree, 68% hold at least a Master's degree, and 18% hold a doctorate.
On average, freelancers with Certified Information Systems Security Professionals (CISSP) have 22 years of professional experience, with a single engagement typically lasting around 2.4 years.
The most common languages among freelancers with Certified Information Systems Security Professionals (CISSP) are German (100%), English (100%), and French (23%).
The most common industries among freelancers with Certified Information Systems Security Professionals (CISSP) are Information Technology (97%), Professional Services (59%), and Banking and Finance (54%).
The most common business areas among freelancers with Certified Information Systems Security Professionals (CISSP) are Information Technology (100%), Project Management (85%), and Operations (56%).
FRATCH Certified Information Systems Security Professionals (CISSP) main locations
Our freelancers and interim experts are at home all over Germany — available on-site in Berlin, Hamburg, Munich and every major business hub, or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg In Austria our freelancers and interim experts support companies from Vienna to Graz — on-site where your project needs them, or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Vienna Graz Across Switzerland our specialists are active in Zurich, Geneva, Basel and Bern — working on-site or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Zurich Geneva Basel Bern Countries:
Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
