Christian F.-IT-Security Expert
Check rate
Experience
Project Lead & Cyber Security Consultant
Deutsche Börse Gruppe
- Established a cyber resilience framework for AI-accelerated threats in the Frontier AI Threat Endurance (FATE) program: capability assessments, maturity assessments and gap analyses covering cyber security, operational resilience, incident response, recovery and governance, followed by target concepts and improvement measures
- Supported action owners from specification through implementation: implementation roadmaps, decision papers, management presentations and governance reporting, as well as audit- and supervision-ready documentation; managed stakeholders from IT, Information Security, Risk Management, Operational Resilience, Business Continuity and the business units
IT-Security Champion
BITMARCK
- Established SDLC governance: increased security testing maturity according to OWASP SAMM from 0.25 to 1.25 (factor 5) by building a security testing program and embedding automated security gates in the CI/CD pipeline
Internal Audit
LBBW
- Successfully completed an internal audit of software development in the mainframe environment: end-to-end assessment from requirements management to production release, findings on software approval, programming guidelines and document control agreed with the business units and transferred into an action plan; strengthened regulatory compliance (DORA, ISO 27001, NIST) and the cyber resilience of critical core banking systems
- Audited the use of AI in software development: raised findings, agreed them with the business units and transferred them into the action plan; addressed governance requirements for compliant AI use (EU AI Act, DORA, BAIT)
Project Lead & Lead AI Security Architect
BNP Paribas
Enterprise AI Control Framework – Group-wide Secure AI & LLM Governance
Designed and implemented a group-wide security and governance framework for the use of LLMs and autonomous AI agents in a highly regulated banking environment. Objective: secure, regulation-ready and audit-ready AI implementation (EU AI Act, DORA, MaRisk, BAIT, GDPR).
- Enabled secure AI use at an international financial institution: risk-assessed 6 AI use cases, defined 12 controls across 6 risk categories and transferred them into a group-wide AI security concept with a governance structure – the basis for regulation-compliant AI implementation (EU AI Act, DORA, MaRisk, BAIT, GDPR)
- Developed an AI risk taxonomy (Model Risk, Data Risk, Prompt Injection, Model Abuse, Supply-Chain Risk, Shadow AI)
- Conducted structured LLM and agent threat modeling workshops (STRIDE for AI, OWASP LLM Top 10, MITRE ATLAS)
- Defined technical security controls; developed AI red teaming guidelines and attack scenarios (Prompt Injection, Jailbreaks, Data Exfiltration, Model Evasion, Agent Abuse)
IT-Audit
Centogene
- Identified 3 critical security vulnerabilities: targeted ISO/IEC 27001 audit of 5 applications and 3 APIs, analysis of DevSecOps processes, CI/CD pipelines and cloud architectures with an action plan for security maturity and audit readiness
IT Auditor
TÜV NORD GROUP
- Audit partner for ISO 27001, BSI IT-Grundschutz, B3S, KRITIS, NIS2, DORA, BAIT, MaRisk and IS risk management in the chemical, pharmaceutical, financial institution, insurance, public authority and energy sectors
Project Manager for Pentest Automation
Leading international AI provider
- Achieved 45 % time savings in penetration testing: responsible for pentest automation from use-case definition to validation of automated findings; built an AI-supported security automation framework (n8n) to speed up CVE analysis and documentation
IT Risk Manager / Project Lead
Deutsche Rentenversicherung
Implementation of IS Risk Management & Business Impact Analysis in KRITIS (NIS2, ISO 27001, BSI 200-2 to 200-4)
Full transparency on risks and measures, an audit-ready methodology, digitalized workflows and effective fulfillment of regulatory requirements.
- Established IS risk management from the ground up: assessed around 300 risks across 150 assets, addressed all 25 critical risks, built 4 core processes and transferred regulatory requirements (ISO 27001, NIS2, BSI 200-2 to 200-4 including BIA) into regular operations that now run without external support
- Built an audit-proof ISRM system in accordance with BSI IT-Grundschutz 200-2/200-3/200-4 (including BIA), NIS2, ISO 27001 and B3S
- Conducted protection needs and impact assessments for business processes, IT services and information networks, including the derivation of criticality levels
- Established governance structures and a central risk register; conducted risk analyses across the entire IT portfolio
- Integrated ISRM and BIA processes into the HiScout GRC platform; defined reporting and escalation paths and trained the specialist departments
Project Lead
Landwirtschaftliche Rentenbank
Remediation of Vulnerability Management Findings (§44 KWG audit)
Demonstrable closure of findings, strengthened governance in vulnerability management (including Rapid7 Nexpose) and fulfillment of regulatory requirements.
- Analyzed vulnerabilities identified by BaFin, including impact and risk assessment; prioritized them based on criticality
- Created an action and implementation plan (responsibilities, timelines, compliance relevance); documented tracking of remediation
- Conducted effectiveness checks and prepared the final report for submission to BaFin
IT Security / Project Lead
Helaba
- Redesigned centralized vulnerability scanning for software libraries: managed the migration from OWASP Dependency-Track to JFrog Xray, established governance foundations (policy, RACI, processes) and integrated security tools into existing CI/CD pipelines in coordination with development, architecture and internal audit
- Hardened the software supply chain against AI-accelerated attacks (action plan in response to the ECB letter dated 07/2026 to all significant institutions): established JFrog Xray as a shift-left control when downloading critical components and as a continuous scan-at-rest for production artifacts; set up SBOM generation for critical applications
- Established supervisory reporting and evidence management: defined a KPI set for JST reporting (SBOM coverage, time-to-detect from CVE publication, blocking rate for critical downloads, MTTR by criticality class), established audit-proof exception governance with CVE-specific ignore rules (max. 30 days, four-eyes principle, compensating controls) and created a script for a DORA crisis exercise from alert to the timely initial notification
Project Lead
Helaba
DORA and NIS2 Compliance Implementation
Proven compliance with DORA and NIS2, strengthened security foundation, reduced cyber risk, and complete audit and reporting documentation.
- Introduction of security, resilience, and governance requirements in line with DORA and NIS2
- Development of processes and controls for ICT risk management, vulnerability management, and continuous monitoring
- Proactive vulnerability assessments and penetration tests; establishment of an ICT risk management framework including resilience tests
- Controls for third-party risk management (security assessments, contracts, monitoring); risk-based NIS2 measures including incident reporting and coordination with authorities
Penetration Tester / Red Team
Various clients (including the financial sector)
- Penetration tests and red-team simulations in complex corporate environments; including a red-team assessment with 25 tests on 15 systems, uncovering 4 critical vulnerabilities – from scoping to remediation
Project Lead
Deutsche Rentenversicherung (via Telekom Security)
Secure SDLC, Cloud Compliance & IT Security Governance (BSI IT-Grundschutz, ISO 27001, NIS2, KRITIS, C5)
Proven increase in software and cloud security, standardized governance, audit-ready processes, and sustainable integration of security by design.
- Consulting, assessment, and implementation of compliance and security requirements (ISO 27001, BSI IT-Grundschutz, NIS2, KRITIS, §8a BSIG, GDPR, BSI C5)
- Development of a secure cloud and data architecture for health and social data, including C5 gap analysis and audit preparation; integration of Azure Security / Sentinel / Key Vault / Defender
- Establishment of a secure SDLC and DevSecOps approach including SAST/DAST, AppSec standards, code reviews, and shift-left automation (pipelines, secrets management with Vault)
- BSI checks, KRITIS assessments, threat modeling (STRIDE/OWASP); hardening of SAP, cloud, containers, and infrastructure
- Optimization of IAM and role models, security policies, development guidelines, and awareness training for development teams
Cyber Security Expert
Telekom Security
- Reviewed and embedded 150+ security requirements in the SDLC: completed 6 projects based on BSI IT-Grundschutz, KRITIS, and NIS2; applied BSI modules in 6 heterogeneous software development environments
IT Security / Project Lead
Helaba
Strengthening the First Line of Defense – Cybersecurity Risk Management
KRI reduced by 70% while assets grew by 68% (scope nearly doubled); total number of vulnerabilities reduced by 36%, with 45.000 to 50.000 vulnerabilities closed per month in regular operations. Figures documented internally and confirmed by management.
- Led a strategic initiative to increase cyber resilience in the First Line of Defense
- Threat and vulnerability assessments with Rapid7 Nexpose; implementation of a Rapid7-based VM solution from PoC to regular operations (operating model, processes, reporting)
- Connection of assets and network zones; integration into ITSM processes (CMDB, ticketing) for automated processing of findings
- Introduction of enhanced security controls, detection mechanisms, and incident response processes
IT-Lead Auditor ISO 27001
AXA
- Led the implementation of an international ISMS according to ISO/IEC 27001: gap analysis, management of internal audits, coordination with external auditors (KRITIS, VAIT, Group Compliance), integration of risk management according to ISO 27005/31000
Project Manager
AXA
Implementation of IT security measures & ISMS according to ISO 27001
Established a scalable, audit-ready ISMS framework across several countries and significantly strengthened the security level and regulatory resilience.
- Led the implementation of an international ISMS according to ISO/IEC 27001:2013
- ISO 27001 gap analysis, management of internal audits and coordination with external auditors (KRITIS, VAIT, Group Compliance)
- ISMS rollout including gap-closing plans, reporting and dashboard structures; integration of risk management according to ISO 27005 and ISO 31000
IT-Auditor ISO 27001
TÜV SÜD GROUP
- ISO 27001 audits and certification preparations, including for GAZPROM (Germany, KRITIS energy), TenneT (Netherlands) and AOK (Germany)
Project Manager
relais colis (DHL-Akquisition)
- Due diligence – IT security risks following the acquisition by DHL
- Identification of integration risks and derivation of prioritized measures to improve -- IT security following the acquisition by DHL.
IT-Security & Governance Manager
DHL
- Ensured DHL's compliance and IS controls in European countries
- Established a Security Operations Center and implemented security incident management processes to increase cyber resilience
- Further developed the BCM system to ensure business continuity; established a PKI
Project Management Migration Branch Systems Frontend
Deutsche Post
- Migration of the point-of-sale system frontends of all post offices to a Windows-based platform: migration concept, software adaptation, testing, rollout including employee training and post-migration support
Software Development
Borland
- Object-oriented analysis, design and development
- UML, Java and Unified Process
- Microsoft.NET, C# and Web services
- J2EE, Servlets, JSP, Enterprise Java Beans
- BEA Weblogic, web technologies
SAP/R3
BOheads CrossMedia
- SAP/R3 and Siebel training
- Business English
- ABAP development
Software Development
Sun Microsystems
- J2EE, Java programming SL-275
SAP Software Developer
Deutsche Bank
- Business concepts, technical designs and custom developments (ABAP) in the SAP banking environment; integration of standard solutions (SAP for Banking)
Industry experience
See where this freelancer has spent most of their professional time.
Experienced in Transportation, Banking and Finance, Information Technology, Healthcare, Government and Administration, and Insurance.
Business area experience
See which departments and functions this freelancer has contributed to most.
Experienced in Information Technology, Project Management, Audit, and Product Development.
Summary
I secure the use of AI in banks and critical infrastructures: security and governance concepts for LLMs and autonomous AI agents, AI red teaming, and reviews of the actual use of AI across the organization, audit-ready for the EU AI Act, DORA, MaRisk and BAIT. The foundation: 25+ years in regulated environments (financial sector, critical infrastructures, public administration, insurance, pharma), including 10 years as a freelancer. From software developer through twelve years in corporate security to auditor and architect: I know the perspectives of development, operations, audit and supervision from my own responsibility, and these four perspectives are exactly what secure AI implementation under DORA and the EU AI Act requires. I have written findings as an auditor and closed them as a consultant, including BaFin §44 and ECB findings. The controls I design are not copied from a framework: they stand up to an audit.
- Enabled secure AI use: risk-assessed 6 AI use cases and transferred 12 controls into a group-wide AI security concept with governance (international bank)
- Uncovered unauthorized AI use in software development: identified the use of generative AI assistants without an approved use case during an audit at a financial institution and embedded governance requirements (EU AI Act, DORA, BAIT)
- 45% time savings in penetration testing: led pentest automation for a leading international AI provider – from use-case definition to findings validation
- Reduced KRI by 70% while assets grew by 68%: established the First Line of Defense at an international financial institution, including Enterprise Vulnerability Management; 45,000+ vulnerabilities closed per month in regular operations
- Increased SAMM maturity from 0.25 to 1.25 (factor 5): established SDLC governance, a security testing program and automated security gates in CI/CD
- 15,000+ endpoints in 5 countries: led the complete rollout of a standardized vulnerability management agent (Rapid7)
- Assessed 300 risks across 150 assets and addressed all 25 critical risks: established IS risk management based on NIS2 and ISO 27001 from scratch at a German federal authority; today runs in regular operations without external support
Skills
Ai Security: Secure Ai Lifecycle, Llm/Agent Threat Modeling, Owasp Llm Top 10, Mitre Atlas, Eu Ai Act
Regulatory Compliance & It-Audit: Dora, Nis2, Iso/Iec 27001, Bsi It-Grundschutz, Kritis, Bait/Marisk, C5
Enterprise Vulnerability Management & Supply-Chain Security (Sca/Sbom, Jfrog Xray, Rapid7, Tenable)
Secure Software Development (Ssdlc/Devsecops): Threat Modeling, Ci/Cd Security, Security Gates
Security Architecture, Cloud Security & Governance (Aws, Azure, Gcp)
Is Risk Management, Isms Implementation And Internal Audit In Financial Institutions And Critical Infrastructure Organizations
Is Risk Management: Risk Identification, Assessment And Treatment, Risk Acceptance Processes, Risk Kpis And Management Reporting
Security Architecture: Enterprise Vulnerability Management, Cloud Security And Regulation-Ready Cyber Resilience In Complex It Environments
Isms: Design, Implementation And Optimization According To Iso/Iec 27001, Bsi It-Grundschutz, Nis2, Dora
Cloud Security & Governance (Aws, Azure, Gcp): Risk Analyses, Security Architectures, Shared Responsibility Models, Hardening, Control Frameworks
Ai And Data Security: Secure Ai Lifecycle, Protection Of Training Data, Models And Inference Processes, Governance And Technical Controls
Secure Sdlc / Devsecops: Threat Modeling, Secure Coding, Ci/Cd Security, Integration Of Security Requirements Into Architecture, Development And Operations
Assessments & Audits: Gap Analyses, Security Assessments (Nist Csf, Mitre Att&Ck), Audit Preparation And Execution
Management Interface: Translating Technical Risks Into Decision-Relevant Information For Management And Supervisory Bodies; Interface Between It, Development, Compliance, Audit And Data Protection
Finance And Insurance
Critical Infrastructures (Kritis)
Public Administration And Authorities (Including Bos)
Energy And Water Management
Pharma
Itc
Transport And Logistics
Consulting
Vulnerability Management / Sca: Rapid7, Tenable Nessus, Qualys, Microsoft Defender, Sonarqube, Owasp Dependency-Track, Jfrog Xray/Artifactory, Sbom (Cyclonedx, Syft, Grype, Trivy), Servicenow Vulnerability Response
Offensive Security: Kali Linux, Metasploit, Nmap, Burp Suite, Owasp Zap, Sqlmap, Bloodhound, Crackmapexec, Scoutsuite, Pacu, Wireshark, Mimikatz
Ai Security: Owasp Llm Top 10, Owasp Agentic Security, Mitre Atlas, Eu Ai Act, Rag Security (Pinecone/Weaviate), Llm-Supported Analysis Pipelines, N8n-/Python-Based Security Automation
Cloud: Aws (Security Hub, Guardduty), Azure (Sentinel, Key Vault, Defender), Gcp
Sdlc / Ci/Cd: Gitlab, Bitbucket, Jenkins, Jfrog Artifactory
Grc & Siem: Hiscout, Archer, Crisam · Splunk, Arcsight, Logrhythm
Project & Reporting: Jira, Confluence, Ms Project, Power Bi, Grafana
Programming Languages (Background): Python, Java, C#, C++, Abap, Cobol, Javascript
Languages
Education
Technische Universität Berlin
Dipl.-Informatiker · Computer Scientist
Siemens Nixdorf
Vocational training · Business Information Systems Specialist
- Computer science
Certifications & licenses
EC-Council
Deutsche Post DHL. GROUP
Deutsche Post DHL. GROUP
Statistics
Experience
Global experience
Expertise
Qualifications
Frequently asked questions
Have questions? Find more information here.
Christian is based in Bochum, Germany and can operate in on-site, hybrid, and remote work models.
Christian speaks the following languages: German (Native), English (Advanced), French (Advanced).
Christian has at least 25 years of experience. During this time, Christian has worked in at least 20 different roles and for 22 different companies. The average length of individual experience is 1 year. Note that Christian may not have shared all experience and actually has more experience.
Based on recent experience, Christian would be well-suited for roles such as: Project Lead & Cyber Security Consultant, IT-Security Champion, Internal Audit.
Christian's most recent position is Project Lead & Cyber Security Consultant at Deutsche Börse Gruppe.
In recent years, Christian has worked for Deutsche Börse Gruppe, BITMARCK, LBBW, BNP Paribas, and Centogene.
Christian is most experienced in industries like Transportation, Banking and Finance, and Information Technology. Christian also has some experience in Healthcare, Government and Administration, and Insurance.
Christian is most experienced in business areas like Information Technology, Project Management, and Audit. Christian also has some experience in Product Development.
Christian has recently worked in industries like Information Technology, Banking and Finance, and Government and Administration.
Christian has recently worked in business areas like Information Technology, Project Management, and Audit.
Christian holds a Master in Computer Scientist from Technische Universität Berlin.
Christian has 7 certificates. Among them, these include: CRISC – Certified in Risk and Information Systems Control, Certified Ethical Hacker (CEH), and CISA – Certified Information Systems Auditor.
Christian is immediately available full-time for suitable projects.
Daily rate distribution
The rates shown represent the typical market range for freelancers in this position based on recent contracts on our platform.
Average rates for similar positions
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 30 Oct 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Similar freelancers
Discover other experts with similar qualifications and experience
Federico L.
Nikolaus B.
Markus W.
Christian D.
Pierre G.
Daniel J.
Alexander S.
Oliver F.
Alagi M.
Bernhard B.
Experts recently working on similar projects
Freelancers with hands-on experience in comparable project as a Project Lead & Cyber Security Consultant
Stephan S.
Peter K.
Henry H.
Rüdiger V.
Karl-Heinz R.
Jens B.
Dustin D.
Michael S.
Alwin F.
Robert F.
Nearby freelancers
Professionals working in or nearby Bochum, Germany
Dany-Armand D.
Felix B.
Claudia C.
Rudolf E.
Fadi S.
Ömer G.
Chris H.
Raschid I.
Rainer P.
Emad S.
