ISO/IEC 27001 Lead Auditor

• Industry: Mechanical engineering, automotive manufacturing
• Regulations: Data Act
• Project focus: Data governance, compliant use of machine data, data platforms
• Commissioned by: CFO, Platform Product Owner

Achievements/Results (early stage):

• Provided compliance support for the development of an international unified data use platform based on Databricks.
• Created the conditions for compliant and effective use of machine data, including:
• Technical: Gap analysis and closing gaps in the segmentation and maintenance of collected machine data.
• Technical: Addressing data exports from the platform to users and third parties.
• Organizational: Drafting and finalizing the required data use agreements.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Development and implementation of multi-domain infrastructure strategies to optimize system performance in OT and IT.
• Design of security concepts for multi-domain infrastructures, including IT security management.
• Oversight of incident management, problem management, and change management.
• Managing the entire lifecycle of a strategic project, including planning, execution, delivery, and stabilization.
• Supporting IT governance, IT architecture, and risk management.
• Conducting workshops on IT security and infrastructure.

• Clients: SMEs and public organizations

• Coordination of the B3S and ISO 27001 implementation project, considering the upcoming KRITIS evidence procedure
• Providing consulting services in ISO 27001, B3S, KRITIS, and IT baseline protection
• Collaborating with the Information Security Officer (ISO)
• Identifying company assets for IT risk management
• Developing a zone concept for IT risk management
• Creating an action plan for B3S
• Developing a template for risk analyses

• Recognition of national notified bodies
• Preparation of cybersecurity competency reports
• EU Radio Equipment Directive

• Led 34 specialists in application management and software engineering
• Developed and ran fleet management for 45,000 vehicles for the German Armed Forces using SAP R/3 and SAP S/4 Hana modules
• Provided and enhanced software for rental and leasing business as well as mapping all company processes of BwFPS, including mobile apps
• Supported the electrification of the Bundeswehr vehicle fleet
• Developed and operated cloud-based custom solutions
• Responsible for the security architecture of the entire IT landscape, following the IT security requirements of the Bundeswehr, BSI IT-Grundschutz, and critical infrastructures
• Secured terrestrial communication networks, mobile networks, IT middleware, and applications against cyberattacks
• Migrated the fleet management system to SAP S/4 Hana, achieving efficiency gains
• Developed a complexity index for the IT landscape and reduced it through retirement, modernization, and interface removal
• Used AI models to support procurement processes, knowledge management, and process simplification

• Innovation/pilot project eGesundheit Deutschland
• SaaS company in the media sector, NRW
• Secure software development lifecycle, NRW
• BSI IT-Grundschutz expert opinions for several clinics

• GfK Data center IT Infrastructure project onsite coordinator (Equinix DC FR2/FR7) training FEs in Equinix DC Carla, FNT, Jira Confluence, ServiceNow (Change/Problem/Incident MGMT), DCIM, ITSM, ITIL
• Reporting significant incidents as the on-site technical coordinator and initial point of contact for vendor escort and smart hands
• Utilizing CMDB-GUI, NIQ-Browser, CMDB-Filtering-GUI, OSS-Radar, BigBrother, CheckMK, and TTWOS for 2nd and 3rd level troubleshooting support
• Maintaining MDF, IDF, computer rooms, and closets; coordinating with service desk, reception, and security for visitor access
• Managing asset lifecycle including operation, retirement, stocking, and destruction with proper SanDisk procedures
• Leading footprint data centre optimization and reduction in FR2/FR7; handling network, server, storage, desktop, hosting, IT security, video conferencing, and telephone operations
• Coordinating server relocations, fibre optics/copper cable preparations, CMDB updates, and stakeholder cooperation
• Implementing IT infrastructure design, maintenance, configuration, and construction following Dell/HP/Apple ESD safety precautions
• Single POC for change management network, Star Track, backup & storage, cloud, Linux, Windows, EUS teams & Software Centre installs
• Successfully completed DC Footprint Reduction Project 2021/2022 and GfK New Hardware DC Refresh Initiative
• Planning, configuring, and installing Dematic server rooms and switch configurations in Heusenstamm, Wurzburg, Kahl am Main, and Graz Austria
• Providing on-site media equipment setup for HP, hospitals, manufacturers, and laboratories
• Ensuring professional rack and cable management following best practices
• Maintaining up-to-date plant maps accessible to all teams showing technology space and spare locations
• Offering technical assistance for live events, town halls, forums, streaming, and hybrid events on and off campus
• Providing second level support for Poly video conferencing systems across multiple time zones
• Conducting frequent computer room walkthroughs, recording power, cooling, alarm, security threats, and mapping wireless environment and access points

• Replacement of the existing host-based archive system (document management system – DMS) is well underway.

• The internal audit is intended to ensure the organization’s quality standards.

• GDPR

• ISO 27001 ff.

• BSI

• DORA

• Patient data regulations

• Host / Cloud / S3 / Container / Highly scalable / Nuxeo

• Budget: 50.000

• Team: 1

• Support companies to fulfil requirements and to implement following management systems: ISO 9001, ISO 22301, ISO 27001, ISO 27017, ISO 27018, TISAX
• Carrying out internal and external audits regarding the following standards: ISO 9001, ISO 27001, ISO 27017, ISO 27018, TISAX

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures