Certified Information Systems Security Professional (CISSP)
experts in Germany, matched in minutes from 15,000 CVs with the power of AI.CISSP holders bring practical depth in security governance, risk management, and enterprise architecture. They are used to designing controls, guiding incident response, and aligning security with business needs. Get fast, precise access to vetted freelancers who hold the CISSP.
Meet FRATCH Certified Information Systems Security Professional (CISSP) in Germany
Jonas P.
Last position:
Cyber Security Manager - Home Connect PKI - Team Lead at Bosch - BSH Hausgeräte GmbH
- Lead the team responsible for providing millions of home appliances with trust.
- Certification authority management at scale: Over 300 million certificates issued.
- Certificate lifecycle management, HSM hardening and air gap-based security controls.
- Prepared PQC transition, NIS2 and CRA readiness initiatives.
- Developed and implemented comprehensive security controls and vulnerability management, based on industry best practices and standards.
- Listed top on Bosch Products Hall of Fame 2025 for disclosure of vulnerabilities.
- Achieved a 50%+ team performance improvement through AI automation.
Tadeusz A.
Last position:
Lead Architect Enterprise Architecture & Security at CGI
Lead Architecture in an interdisciplinary architecture team covering enterprise, solution, NOOTS, cloud and security architecture as well as regulatory and European interoperability requirements.
Public / Government
Development and management of target architectures, principles, standards and technical guardrails; assessment of Security-by-Design, IAM, data protection and interface/integration architectures; architecture reviews, security assessments, risk analyses, and preparation of decision records, target visions, roadmaps and decision papers. Architectural knowledge and consideration of relevant AD-NOOTS requirements, particularly for IAM, authorization, secure integration and interoperability.
Technologies / Methods: Enterprise Architecture, Solution Architecture, Security Architecture, Cloud Architecture, NOOTS / EU-OOTS, IAM, Authorization, Security-by-Design, API/Integration Architecture, Interoperability, Risk Analysis, Architecture Governance
Security and integration requirements as well as technical decisions are structured in reliable architecture and decision artifacts.
Enrique G.
Last position:
Security Architect at Capgemini
I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.
Julian W.
Last position:
Renewal of the Active Network Infrastructure
As part of this project, the existing active network infrastructure was modernized and made fit for the future. The goal was to introduce a powerful, secure and scalable network and WLAN infrastructure, including a Network Access Control (NAC) solution to improve network security and centralized access control.
At the beginning of the project, a comprehensive requirements analysis was carried out, taking into account the technical, operational and security-related requirements of the hospital sites. On this basis, a technical tender was prepared for new switches, WLAN access points and the NAC solution.
The successful implementation of the project established a modern, standardized and secure network infrastructure that meets the growing requirements for availability, mobility and IT security in hospital operations.
Activities:
- Supporting the tender process, including technical evaluation of offers and bidder evaluation
- Leading and managing the entire project implementation
- Coordinating the project process with internal stakeholders, business units and hospital IT
- Managing external service providers during the implementation and installation of the systems
- Monitoring the implementation, including quality control, project acceptance and defect management
- Coordinating and managing communication between hospital IT and external service providers as part of the NAC implementation
- Managing escalations in the event of technical and organizational challenges
- Ongoing budget monitoring and control of project expenses and additional costs
- Preparing decision papers for management on project changes, additional services and risks
Marco Z.
Last position:
Product Owner IT Services; Solution Architect central service delivery at BWI
Create product vision
Commission Scrum teams
Create schedule and coordinate with project lead
Coordinate and align with stakeholders
Harmonize processes across initiatives
Present project content at C-level
Create security concept for classified information up to DEU GEHEIM and NATO SECRET considering BSI GS, KRITIS, SÜG, VSA
Plan service changes to underpinning services
Design architecture for secure infrastructures
Dependency management in project context
Risk management
Requirements management
Commission and oversee protection needs analysis and information security concept
Coordinate service design activities
Mohamed G.
Last position:
Lead / Principal Cloud, AI & Security Architect at Freelancer / CC Conceptualise GmbH
Projects:
Project: RWE – Development of a company-wide Zero Trust cybersecurity architecture (CITADEL) Role: Senior Enterprise Cybersecurity Architect / Zero Trust Architect Company: RWE AG Description: Concept and implementation of the strategic CITADEL cybersecurity target architecture at RWE, based on the Zero Trust architecture principle and aligned with regulatory requirements such as NIS2, ISO 27001 and company-wide security governance policies. The goal was to build a measurable, auditable and scalable security architecture with a strong focus on Identity Governance, compliance transparency and operational manageability. Responsibilities & Achievements:
- Zero Trust architecture design: Developed a company-wide Zero Trust reference architecture (Identity, Device, Network, Application, Data) including trust zones, control points and enforcement mechanisms according to NIS2.
- Identity & Access Governance (IGA): Designed and introduced IGA governance structures including role models, recertification processes, segregation of duties (SoD) and lifecycle management for identities and access.
- Security governance & KPIs: Defined and implemented security KPIs and metrics to manage Zero Trust maturity, identity risks and compliance at the management level.
- Compliance & reporting: Built standardized compliance reports and dashboards to support internal audits, external assessments and regulatory evidence (e.g. NIS2).
- Architecture & stakeholder alignment: Worked closely with Enterprise Architecture, IT operations and business units to integrate the CITADEL architecture into existing IT and security landscapes.
- Strategic security consulting: Advised programs and projects on Zero Trust compliance, identity centricity and regulatory requirements in the energy and critical infrastructure (KRITIS) environment. Technologies & Methods: Zero Trust Architecture, NIS2, Identity Governance & Administration (IGA), IAM, RBAC, SoD, Entra ID, SailPoint, Zscaler, Terraform / IaC, Policy as Code, security KPIs, compliance reporting, NIST 2.0, ISO 27001, Enterprise Security Architecture, governance frameworks, risk & control management
Project: Scalable AI Workbench Platform on Microsoft Azure Role: Cloud Architect & Engineer Company: Siemens Energy Description: Design, development and operation of a secure, modular cloud infrastructure to support Data Science, Machine Learning and AI applications for various engineering teams at Siemens Energy. Responsibilities & Achievements:
- Cloud architecture: Designed and implemented an Infrastructure-as-Code solution (Terraform) for automated provisioning of Azure resources (Resource Groups, Storage Accounts, Cosmos DB, Application Insights, networking, PostgreSQL Flexible Server, Azure Container Apps, Azure Container Registry).
- Developer portal: Used Backstage with custom frontend and backend plugins (Node.js, TypeScript, React.js, PostgreSQL, Container Apps) to enable self-service and empower developers, data scientists and AI/ML engineers.
- Role-based access control: Implemented Azure RBAC to grant targeted access (e.g. Storage Blob Data Contributor, Reader) to engineering groups (e.g. AI Engineers) for relevant resources.
- Data platform engineering: Built and configured a multi-layered storage landscape (Raw, Curated, Vector data), including automated container creation and access control for advanced analytics and AI workloads.
- DevOps integration: Integrated with Azure DevOps for CI/CD pipelines to automate deployment, monitoring and compliance.
- Security & compliance: Implemented Private Endpoints, network policies and Managed Identities to ensure data protection and regulatory compliance.
- Collaboration: Worked closely with cross-functional teams to align the cloud infrastructure with business and technical requirements and drive digital transformation at Siemens Energy. Technologies: Azure, Terraform, Azure DevOps, Cosmos DB, Application Insights, Azure Storage, Private Endpoints, Azure Synapse, Azure Machine Learning, Azure Entra ID, RBAC, Backstage, Node.js, React.js, PostgreSQL, Python (automation), Git
Andreas I.
Last position:
Cybersecurity Specialist Assessor at Bundesnetzagentur
- Recognition of national notified bodies
- Preparation of cybersecurity competency reports
- EU Radio Equipment Directive
Sergey K.
Last position:
Managing Director Cybersecurity at CBA-Cybersecurity and Business Advisory GmbH
- Development of comprehensive services in cybersecurity, IT governance, and AI
- Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
- Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
- Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
- Responsible for company growth, client relations, and strategic partnerships
Giovanni S.
Last position:
Technical Product Manager at Logicc GmbH
Acted as the primary bridge between Legal, Engineering, and Business units to ensure zero compliance violations while maintaining product velocity.
Led the development of a GDPR-compliant AI aggregator platform, managing a roadmap that balances legal constraints with aggressive feature delivery.
Scaled the engineering team from 4 to 9 developers, establishing hiring protocols and technical onboarding processes to support rapid product iteration.
Boosted the development process by introducing structured sprint cycles and backlog refinement, resulting in a 20% reduction in feature delivery time.
Architected and prototyped agentic AI workflows with n8n and RAG pipelines on Langchain.
Robert F.
Last position:
Interim Project Manager at IT services company of a regional energy supplier
- Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
- Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
- Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
- Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
- Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
- Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
- Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.
Arndt S.
Last position:
Information Security Officer according to TISAX at Automotive Supplier
Dirk S.
Last position:
Managing Partner at SPOT Management GmbH
Alexander P.
Last position:
Head of integration for six country subsidiaries at XSYS Holding
- Analyzed the required scope of processes, infrastructure, and SAP for integrating the MacDermid subsidiaries
- Validated proposals from the new service providers
- Managed the collaboration and tracked the tasks of business and IT experts
- Coordinated communication and the PMO
- Created cutover plans in three waves for SAP conversion, Salesforce, and Ariba
Jan K.
Last position:
Consultant for Information Security & Auditor at Kopiasonsulting GmbH
Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures
Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks
Conducting red teaming processes, including penetration tests and security analyses for companies
Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)
Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX
Advising companies in critical infrastructures on information security and compliance with the IT Security Act
Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)
Integrating data into monitoring tools (Prometheus, Grafana)
Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management
Security assessments and penetration testing of IT and network architectures
Alexander S.
Last position:
Lead Audit Conformity & IT Security Catalog at DAX group energy provider in the renewable energy sector
- Supported the implementation of §8a requirements of the BSI Act for critical infrastructures.
- Systematically prepared and supported internal and external audits, resolving previous deviations (HA, NA, VP)
- Implemented the specific requirements of the IT security catalog
- Developed training, created run books, and conducted assessments to ensure operational effectiveness.
Discover over 15,000 top freelancers
Certified Information Systems Security Professional (CISSP) statistics
Aggregated from the professional profiles of matched freelancers.
Experience
23 years
Position duration
2.3 years
Positions per freelancer
17
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
81%
Master's degree or higher
59%
Doctorate
15%
Certifications per freelancer
12
Most common languages
German, English, French
Speak two or more languages
100%
Based on our profile pool as of 15 Nov 2026.
Daily rate distribution
The chart shows how the daily rates of experts holding this certification in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates for Certified Information Systems Security Professional (CISSP) in Germany
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 15 Nov 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Certified Information Systems Security Professional (CISSP) experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (97%)
- Professional Services (58%)
- Banking and Finance (52%)
- Healthcare (48%)
- Transportation (48%)
- Manufacturing (45%)
- Insurance (42%)
- Telecommunication (42%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the certification
What CISSP means
The Certified Information Systems Security Professional, better known as CISSP, is ISC2’s flagship credential for senior security work. It signals broad, structured knowledge across information security and the ability to connect policy, architecture, operations, and risk.
What it validates
- Security governance and program design
- Risk assessment and control selection
- Security architecture and engineering decisions
- Identity, access, and asset protection
- Incident response and recovery planning
- Security operations in complex environments
This is not a narrow tool certificate. CISSP is about making sound security decisions across the full enterprise.
Typical holder profile
CISSP is common among security managers, architects, consultants, and senior engineers. It also fits freelancers who advise on security roadmaps, assess maturity, or support regulated projects where trust, documentation, and cross-team coordination matter.
In Germany, companies often look for CISSP holders when they need clear communication with technical and non-technical stakeholders. That matters in mixed teams, international projects, and remote engagements where expectations must be explicit.
Knowledge areas
- Security and risk management
- Asset security and data handling
- Security architecture and network design
- Identity and access management
- Security assessment and testing
- Security operations and incident handling
- Software development security
The strength of CISSP is breadth. It helps companies see whether a freelancer can reason across domains instead of staying inside one specialty.
What it says about a freelancer
A freelancer with CISSP is usually ready for advisory work, audits, security reviews, policy work, and hands-on coordination in larger environments. The credential suggests they can talk to leadership, challenge weak controls, and translate risk into practical action.
For companies in Germany, that is useful when security work must fit local teams, global standards, and remote collaboration at the same time.
Best-fit project work
- Security program setup or improvement
- Cloud and infrastructure security reviews
- Identity and access redesign
- Incident response planning and tabletop exercises
- Third-party and vendor risk reviews
- Policy and control documentation
CISSP is especially relevant in projects where the main challenge is not a single technology, but the way many security areas need to work together.
Frequently asked questions
Quick answers to the questions that come up most around Certified Information Systems Security Professional (CISSP).
A freelancer with the CISSP has shown broad competence across security governance, architecture, risk, and operations. It tells you they can work beyond one tool or niche and understand how security decisions affect the whole business. That is why it is often seen on senior consultants, architects, and security leads.
CISSP sits between both worlds. It is not a pure management badge, but it is also not a deep product-specific technical certification. CISSP is most valuable when you need someone who can make sound security decisions, coordinate stakeholders, and still understand the technical details behind the controls.
The Certified Information Systems Security Professional (CISSP) is broader and more senior than many focused security credentials. It covers the full security lifecycle instead of one specialty such as cloud, testing, or access control. For companies, that makes it a good signal for strategic or cross-domain security work.
CISSP is a strong fit for security architects, consultants, managers, and experienced engineers who work across multiple security domains. It also suits freelancers who advise clients on governance, risk, compliance, or enterprise security design. If your work connects strategy and implementation, this credential is often a good match.
Preparation for the CISSP is broad and structured. Candidates usually study the full set of security domains, work through practice scenarios, and review how concepts apply in real environments. Because the exam rewards judgment as well as knowledge, practical experience matters a lot.
CISSP is designed for experienced professionals, so it is not usually a beginner certification. ISC2 expects a strong background in security-related work, and there is also an endorsement step after passing. Some candidates may use an associate pathway if they are still building the required experience.
The CISSP is maintained through ongoing professional education and continuing activity in the field. Holders are expected to stay current with changing threats, controls, and practices. For clients, that is a useful signal that the freelancer should be engaged with modern security work, not old habits.
In Germany, CISSP is especially relevant for enterprise security programs, regulated environments, and projects that involve both local teams and international stakeholders. It is also useful when remote collaboration demands clear documentation and disciplined decision-making. Companies often look for it when they need a freelancer who can lead or advise across several security topics at once.
The average hourly rate for freelancers with Certified Information Systems Security Professional (CISSP) in Germany is 121 €, which corresponds to a daily rate of about 968 € based on an 8-hour working day.
Of the freelancers with Certified Information Systems Security Professional (CISSP) in Germany, 81% hold at least a Bachelor's degree, 59% hold at least a Master's degree, and 15% hold a doctorate.
On average, freelancers with Certified Information Systems Security Professional (CISSP) in Germany have 23 years of professional experience, with a single engagement typically lasting around 2.3 years.
The most common languages among freelancers with Certified Information Systems Security Professional (CISSP) in Germany are German (100%), English (100%), and French (23%).
The most common industries among freelancers with Certified Information Systems Security Professional (CISSP) in Germany are Information Technology (97%), Professional Services (58%), and Banking and Finance (52%).
The most common business areas among freelancers with Certified Information Systems Security Professional (CISSP) in Germany are Information Technology (100%), Project Management (90%), and Operations (58%).
FRATCH Certified Information Systems Security Professional (CISSP) main locations
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Countries:
- Germany
- Austria
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
