Datenschutzbeauftragter (DSB)

Transformation assignment: IT Operating Model and Governance

• Management of the operationalization of a new IT operating model for a service- and customer-oriented organization in the managed services and Microsoft 365 environment.
• Translation of the target organizational model into concrete roles, responsibilities, organizational elements, decision-making paths and collaboration principles.
• Design and operationalization of a layered model with autonomous delivery teams, supporting units and clearly defined governance functions.
• Design of governance for Service Delivery Management, People Leads, Global Service Owners (GSO), operational teams, clusters and management committees.
• Structuring of the transformation rollout into ramp-up, implementation, hardening and operations, as well as development of kick-off, communication and feedback formats.
• Further development of PMO and office structures as well as portfolio and workforce management to create transparency around resources, risks, dependencies and decision requirements.
• Facilitation of cross-functional workshops and decision-making meetings, and translation of different stakeholder interests into actionable principles, rules and measures.

Interim assignment: IT Service and Operations Management

• Assumption of operational responsibility for Citrix and AD/Access, including incident, escalation, transition and quality management in day-to-day operations.
• Clarification of operational interfaces and clear separation of responsibilities between internal units, Service Delivery Management and external service providers.
• Conduct of structured GAP analyses of existing service descriptions, preparation of make-or-buy decisions and clarification of roles with KPI integration.
• Management of conflicting objectives, dependencies and escalations in complex customer, operations and transformation situations.

Selected results

• The transformation target model was translated into directly applicable roles, governance rules, organizational elements and rollout formats.
• Decision-making paths, responsibilities and interfaces between operational delivery, supporting functions and management were described transparently and bindingly.
• The foundations for self-organized teams, standardized service descriptions and reliable portfolio, resource and management transparency were established.

Methods: Operating Model Design, Governance Design, RACI, GAP Analysis, Stakeholder Analysis, Workshop Facilitation, Change Communication, Risk and Escalation Management, KPI and Service Management

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

AI telephone assistant platform

Claude Code, Google AI Studio, Python, LLM / Voice-AI, PostgreSQL

• Conception and hands-on development of an AI-supported telephone assistant platform (voice AI / LLM) – from idea and architecture to MVP/product.
• Built agentic workflows and full automations with Claude Code and Google AI Studio.
• Also delivered AI-supported work in client engagements: used Claude Code for governance documentation, requirement drafts, and automations.

• Project manager for the analysis, implementation, and optimization of digital processes
• Concept, management, and optimization of comprehensive marketing campaigns for lead generation via Paid Social (incl. Meta Ads, TikTok Ads)
• Concept and implementation of content production and marketing activities
• Project management in omnichannel marketing and process automation
• Implementation of digital tools to improve customer acquisition and support
• Internal stakeholder management and coordination of external service providers

Industry: Finance/Insurance

• Sparring partner for the data protection team
• Taking over tasks from the data protection backlog
• Updating data protection processes
• Updating TOMs
• Revising template documents (including DPA, data protection guidelines)
• Conducting audits (authorization concept, software development)
• Taking over tasks from day-to-day operations
• Processing data protection reports
• Conducting DPIA and TIA
• Reviewing data processing agreements
• Designing and delivering trainings
• Standard Data Protection Model
• AI and data protection

Result: Successfully supported the data protection team, worked through the data protection backlog, and delivered trainings successfully

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), Access Control Policy, Vulnerability Management Policy, Business Resilience Programme, Risk Governance Plan
• Consolidation into an integrated emergency manual (12 chapters) with immediate-action checklists for six emergency scenarios, a prioritized action table and a formal approval structure
• Review and documentation of the applicability of NIS2 and HinSchG, including the legal justification for non-applicability

As project manager for the Odoo implementation at a small company, I was responsible for designing, implementing, and training a fully integrated CRM and accounting system. Through structured requirements analysis, precise data migration, and targeted change management, I was able to complete the rollout in just eight weeks. The project led to a significant reduction in manual tasks, faster business processes, and increased real-time transparency.

Main Responsibilities

Requirements analysis and process mapping Configuration of Odoo modules: CRM, Sales, and Accounting Data migration (Excel/CSV → Odoo) and quality control Creation of workflows, automated email rules, and dashboards Conducting training sessions and providing support after go-live Project coordination (budget, schedule, stakeholder communication)

Key Achievements

Full implementation of the Odoo suite within the set timeframe (8 weeks) 30% reduction in accounting time and 25% acceleration of the lead-to-sale flow 100% customer satisfaction after go-live, based on survey results Successful migration of 100% of existing master data without data loss Establishment of a sustainable support infrastructure (3-month post go-live support)

Impact

Improved decision-making through real-time dashboards and automated reports Increased efficiency and cost savings (≈ €8,000/month) Scalability for future growth (additional modules can be integrated seamlessly) Strengthened sales and finance departments through seamless process integration

This summary highlights how I created concrete and measurable value for the company through structured project work, technical expertise, and targeted training.

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Support in building and further developing the information security management system
• Cooperation with external consultants in the certification team for the support structure
• Involvement in project planning, identification, and implementation of the necessary measures according to BSI IT baseline protection
• Professional support for in-house subject matter experts in creating the documents required for certifications
• Carrying out the work according to BSI 200-2

Development of an AI console for integration into different open source solutions (ERP, CRM..)

Development of the target architecture Integration of different AI platforms (ChatGPT, Anthropic, Perplexity) Workflow with cross-platform use of the AI platforms Voice input and voice output History Console-based project management Generation of custom agents (Crewai..) Integration of the agents into the AI workflow

• Consolidation
• Mergers
• Law firm chart of accounts / cost centers
• Preparation of annual financial statements
• Digital process development and optimization of the accounting/closing and reporting area
• Optimization of the DATEV software environment

Senior Security Consultant in the PHOENIX project

• Creation of security documentation according to BSI IT Baseline Protection
• Conducting BSI IT Baseline Protection checks in several languages
• Creation and maintenance of milestone plans, work packages, project plans, and project documentation
• Structural analyses, determination of protection needs, modeling, baseline protection checks, risk analyses, HiScout tool
• Consulting on information security and data protection
• Review of operating concepts

• Governed multi-agent orchestration for regulated, EU-based companies – self-hostable, compliant with the EU AI Act and GDPR („by design“), BYOM (own models/GPU).
• Two-gate governance: agent deliberation + mandatory human approval, full signed audit trail; graduated autonomy model („internal → autonomous per skill“).
• Verified knowledge graph („Company Brain“) with source evidence for every answer; own orchestration framework (Virtual Team Framework).
• Industry solutions for financial services: compliance monitoring, invoice and contract review; hands-on development with LLMs (including Anthropic/Claude), agentic workflows, RAG.
• Building the governance-focused multi-agent platform TeamIntel (see AI reference projects).

• Informing and advising on obligations under applicable data protection regulations
• Reviewing compliance with data protection regulations and the client’s strategies for protecting personal data through own audits
• Advising on and preparing data protection impact assessments as well as data protection notices and data protection guidelines and policies
• Drafting, advising on and negotiating data processing agreements
• Raising awareness among management and staff on data protection by creating training materials and concepts and delivering training sessions
• Industries include: financial services, healthcare, trades, mechanical engineering, recruitment, auditing and tax consulting