Federico L.-ISO – Senior Consultant Quality & Information Security

Daimler Truck Financial Services is moving from traditional data centers to the Azure Cloud. As part of the Cloud Data Center (CDC) project, DTFS is migrating traditional data centers in Europe (EMEA), Asia & South Africa (APAC), Canada, and South, Central and North America (NAFTA), and transferring service operations to the Azure Cloud. DTFS supports the global sale of Daimler commercial vehicles through leasing, financing and insurance and, with a contract volume of 25,4 billion euros, is one of the world’s largest financial services providers for commercial vehicles ([link]  Works as Senior PMO and Senior Management Consultant with the Global IT Director and Head of Innovation Projects  Works as Senior PMO and Senior Management Consultant with the international PM and PO teams (Project Management/Project Owner)  Created a master plan using MS-Project for the CDC project, enabling DTFS to gain a clear and transparent overview of the project after one year  The master plan gave management and teams clear and accurate information on the status of the overall project and each subproject, by region and country  Reports from the master plan enabled management and teams to take corrective action and address deviations so the project could be completed On Time, On Budget and On Quality  Regularly reports project progress to the Global IT Director and PM teams  Handed over the CDC master plan to the DTFS PM at the end of the contract

• Northland Power develops, operates and owns clean wind energy facilities.
• Member of the Security team, jointly responsible for the Cyber & Information Security of the wind energy facilities.
• Responsible for preparing all documentation and measures (policies, security concepts, cryptography, key management) to implement SzA in accordance with BSI IT-SiG 2.0 and EnWG.
• Prepared and developed measures (policies, SOP, ISMS handbook, BCM, IT emergency plans, IAM, backup & recovery, MDM, supplier, password, patch, asset & configuration, and network management) to establish an ISMS in accordance with ISO 27001:2022.
• Identified, assessed and addressed critical and potential attack scenarios affecting the wind energy facilities as part of risk management.
• Conducted risk analysis, risk treatment, protection needs assessments and vulnerability analysis of the IT/OT infrastructure.
• Developed IT/OT emergency plans and incident response processes, and plans for rebuilding IT/OT systems as part of BCM (BIA, RIA & DRP).
• The project was terminated early because the wind turbines were sold and the company closed its operations in Germany.

• UKD is the largest hospital in the state capital and one of the most important medical centers in North Rhine-Westphalia.
• Operator of Critical Infrastructure (KRITIS gemäß §8a BSIG) with an ISO 27001:2022-certified ISMS.
• Works directly as Senior Management Consultant to the IKMT division head (CIO) and leader of innovation projects.
• Responsible for information security across the entire IT division as ISO.
• Creation, maintenance, and improvement of ISMS policies and SOPs.
• Training and awareness for IT employees in IT security, incident response processes, and IT system recovery.
• Created and serves as the main point of contact for UKD's new IT strategy, as well as a BIA and DRP for IT system recovery.
• Preparing to introduce Business Continuity Management gemäß ISO 22301 for the IKMT division and UKD.
• Created an IT cybersecurity strategy and roadmap for implementing additional tools and solutions for UKD's cybersecurity.
• Created an IT emergency plan (as part of the DRP), IT security plan, incident response plan, and related supporting plans (data protection, antivirus, cryptography, configuration and hardening measures, asset and configuration management, patch management, roles and permissions (IAM), IT emergency preparedness, etc.).
• Contributed to developing measures to achieve SzA (Systeme zur Angriffserkennung) compliance gemäß BSI IT-SiG 2.0.
• Developed a security plan, carried out a proof of concept (PoC), assessed and evaluated options, and supported the purchase and implementation of a security system for medical device monitoring.
• Set up a Security Operations Center (SOC), including working concepts and definitions for preventive measures, threat detection, and incident response.
• Set up a Security Information Event Management (SIEM) system with Splunk.
• Senior PMO to the division management since February 2023, responsible for tracking all IT-related projects (>2K Projekte).
• Created and managed Gantt charts for all IT-related projects (IT & medical, IT security, SAP, etc.).
• Created a patch management security plan, processes, and Standard Operating Procedures (SOP).
• Contributed to the continuous improvement process (KVP) for the certified ISMS in preparation for the first surveillance audit.
• Regularly reported project progress to the division management and executive board.

• Prepared and delivered awareness training for the company and its subsidiaries.
• Reviewed penetration test (PenTest) results and created an action plan to address identified vulnerabilities.
• Optimized IT processes to support business processes.
• Contributed to ensuring IT service availability.
• Reviewed existing ISMS files to assess the current state and conduct a gap analysis for implementing an ISMS gemäß ISO 27001.

• Responsible for certifying (attestation of compliance) the new cloud services of the Police Service Platform (PSP) against the international C5 standard.
• Conducted a gap analysis and contributed to establishing and improving an ISMS gemäß ISO 27001, IT-Grundschutz, and the new BSI-Kompendium.
• Created and adapted policies and SOPs for the entire federal office (BCM, BIA, RIA, DRP, IT emergency plans).
• Created and improved information security (SiKo) and IT emergency plans for IT operations and cloud services (IAM, backup and recovery, patch management, crypto and key management, asset and configuration management).
• Worked with the SOC team to update the threat landscape.
• Delivered internal training sessions, workshops, and awareness activities.
• BKA security clearance – SÜ2.
• The project was ended early due to the Covid-19 pandemic.

• Conducted audits in accordance with ISO 27001 for various customers.
• Conducted EU GDPR workshops and pre-audits for TÜV SÜD Munich and its customers.

• Planned, expanded, and built the new Compliance Services & Solutions division.
• Advised customers on implementing ISMS (ISO 27001), BCM (ISO 22301), IT-Grundschutz, BaFin & MaRisk.
• Successfully implemented and achieved dual certification for an ISMS (ISO 27001) and a BCM (ISO 22301) within 14 months.
• Achieved ISO 27017 / ISO 27018 certification to protect personal data as a Cloud Service Provider (CSP).
• Conducted IT security assessments (PenTest, Vulnerability Scans) and created IT emergency plans.
• Conducted seminars, training sessions, and workshops on GDPR and information security.
• Conducted information security audits in accordance with ISO 27001, ISO 27006, and ISO 19011.

• Senior Project Manager, Business Analyst and Senior PMO as an interim manager for banks, insurance companies, retail and industry.
• Technical roll-out and change management for an international mining company during the introduction of new ERP systems.
• Strategic development of ITSCM, IT services and IT security as an interim CISO.
• Implementation of ISMS according to ISO 27001 and BCM according to ISO 22301 in Chile, Argentina and Brazil.
• Interim Business Development Manager for various IT companies.
• Business Analyst and interpreter for IT projects (Spanish/German/English).

• Responsible for the preparation, programming and security of wireless solutions for digital data collection for the 2011-2012 census.
• Delivered training to external staff on digital data collection.
• Strategic development of ITSCM, IT services and IT security, and management of all innovation projects.
• Restructured the IT department and negotiated with senior management and the works council.
• Introduced policies according to ISO 27001, ISO 22301, ITIL, COBIT and OECD.
• Built and launched the first SOC with a SIEM platform for automated Threat Lifecycle Management (TLM).
• Introduced PMO, development and project methods (PMI, CMMI, CMMN).
• Led the cross-country improvement of the telecommunications network (RFP).
• Interim people management responsibility for more than 50 employees.

• Introduced an electronic cash card (eWallet) using Smart Card technology as a subsidiary of the banks.
• Managed the technology platform for eWallet administration as an Open Innovation project.
• Licensed the cash card from Mondex International (MasterCard).
• Introduced and led an interbank committee for operations and technology matters.
• Developed the model for production, operation and settlement of electronic money in collaboration with the banking regulator and central bank.
• Developed the financial model for investment and profit sharing, taking money market stability into account.
• Served as the liaison (Business Analyst) between the banks for project implementation.
• People management responsibility for more than 20 employees.

• Developed, implemented and managed all electronic banking products for the corporate sector.
• Developed and launched eCommerce solutions for the bank.
• Advised on the secure development of eCommerce and EDIFACT in Chile.

• Responsible for COMEX, Financial EDIFACT & eCommerce for German and European banks.
• Responsible for the financial institutions section at CeBIT.
• Developed and promoted eCommerce at German banks.
• Member of European interbank committees in Frankfurt, Paris and London.
• Led an eCommerce project between commercial banks and the central bank of the state (LZB) in Frankfurt.