Federico (F.) Leefhelm - ISO – Senior Consultant Quality & Information Security

Daimler Truck Financial Services is moving from traditional data centers to the Azure Cloud. As part of the Cloud Data Center project (CDC), DTFS is migrating traditional data centers in Europe (EMEA), Asia & South Africa (APAC), Canada, South, Central and North America (NAFTA) and transferring the service into the Azure Cloud. DTFS supports Daimler commercial vehicle sales worldwide through leasing, financing and insurance and, with a contract volume of €25.4 billion, is one of the world's largest financial service providers for commercial vehicles ([link]).  Working as Senior PMO and Senior Management Consultant with the Global IT Director and Head of Innovation Projects  Working as Senior PMO and Management Consultant together with the international PM and PO teams (Project Management/Project Owner)  Created a master plan based on MS Project for the CDC project, which enabled DTFS to gain a clear overview and transparency of the project after one year  The master plan provided management and the teams with clear and accurate information on the status of the overall project and each subproject, both by region and by country  The reports from the master plan enabled management and the teams to take countermeasures to correct deviations, so that the project could be completed on time, on budget and on quality  Regular reporting of project progress to the Global IT Director and PM teams  Handover of the CDC master plan to the PM of DTFS at the end of the contract period

• Northland Power is a developer, operator and owner of clean wind energy plants.
• Member of the security team, co-responsible for cyber & information security of the wind farms.
• Responsible for preparing all documentation and measures (policies, security concepts, cryptography, key management) to deploy intrusion detection systems according to BSI IT-SiG 2.0 and EnWG.
• Preparing and creating measures (policies, SOP, ISMS manual, BCM, IT emergency plans, IAM, backup & recovery, MDM, supplier, password, patch, asset & configuration, network management) to build an ISMS according to ISO 27001:2022.
• Identification, assessment and handling of critical and potential attack scenarios of wind farms in risk management.
• Risk analysis, risk treatment, protection requirement determination and vulnerability analysis of the IT/OT infrastructure.
• Creation of IT/OT emergency concepts, incident response processes & rebuilding of IT/OT systems within BCM (BIA, RIA & DRP).
• The project was terminated early because the wind turbines were sold and the company was closed in Germany.

• UKD is the largest hospital in the state capital and one of the most important medical centers in North Rhine-Westphalia.
• Operator of critical infrastructures (KRITIS according to §8a BSIG) with an ISMS certified to ISO 27001:2022.
• Work directly as Senior Management Consultant to the IKMT head (CIO) and leader of innovation projects.
• Responsible for the entire IT department in information security as ISO.
• Create, maintain, and improve ISMS policies and SOPs.
• Train and raise awareness among IT staff on IT security, incident response processes, and IT system recovery.
• Develop and act as main point of contact for the new UKD IT strategy, plus a BIA and DRP for IT system recovery.
• Prepare for the next introduction of business continuity management according to ISO 22301 for the IKMT department and UKD.
• Develop an IT cyber security strategy and roadmap for implementing additional tools and solutions for UKD’s cyber security.
• Create an IT emergency concept (as part of the DRP), IT security plan, incident response, and related supporting concepts (data protection, antivirus, cryptography, configuration and hardening measures, asset & configuration management, patch management, roles & rights (IAM), IT emergency preparedness, etc.).
• Participate in defining measures to become compliant with attack detection systems (SzA) according to BSI IT Security Act 2.0.
• Develop a security concept, conduct a proof of concept (PoC), evaluate and review up to procurement and implementation of a medical device monitoring security system.
• Build a Security Operations Center (SOC) with operating concept and definitions for preventive measures, threat detection, and incident response.
• Implement a Security Information and Event Management (SIEM) with Splunk.
• Senior PMO to the department head since February 2023, responsible for controlling all IT-related projects (over 2K projects).
• Create & manage Gantt charts for all IT-related projects (IT & medical, IT security, SAP, etc.).
• Develop a patch management security concept & processes and standard operating procedures (SOPs).
• Contribute to the continuous improvement process (CIP) of the certified ISMS in preparation for the first surveillance audit.
• Regularly report project progress to the department head and executive board.

• Prepare and deliver awareness training for the company and its subsidiaries.
• Review results from penetration tests (PenTests) and create an action plan to fix identified vulnerabilities.
• Optimize IT processes to support business operations.
• Help ensure the availability of IT services.
• Review existing ISMS documentation for an as-is assessment and gap analysis to implement an ISMS according to ISO 27001.

• Responsible for the certification (attestation) of new cloud services of the Police Service Platform (PSP) to the international C5 standard.
• Conduct gap analysis and help build and improve an ISMS according to ISO 27001, IT-Grundschutz, and the new BSI compendium.
• Create and update policies and SOPs for the entire federal agency (BCM, BIA, RIA, DRP, IT emergency plans).
• Develop and improve information security (SiKo) and IT emergency plans for IT operations and cloud services (IAM, backup & recovery, patch management, crypto & key management, asset & configuration management).
• Work with the SOC team to update the threat landscape.
• Deliver internal training, workshops, and awareness activities.
• BKA security clearance level SÜ2.
• The project was ended early due to the COVID-19 pandemic.

• Conducting audits according to ISO 27001 for various customers.
• Conducting EU GDPR workshops and pre-audits for TÜV SÜD Munich and its customers.

• Planning, expansion, and establishment of the new Compliance Services & Solutions division.
• Advising customers on implementing ISMS (ISO 27001), BCM (ISO 22301), IT baseline protection, BaFin & MaRisk.
• Successful implementation and dual certification of an ISMS (ISO 27001) and a BCM (ISO 22301) within 14 months.
• Achieving ISO 27017 / ISO 27018 certification to protect personal data as a Cloud Service Provider (CSP).
• Conducting IT security assessments (pen tests, vulnerability scans) and creating IT emergency plans.
• Conducting seminars, training sessions, and workshops on GDPR and information security.
• Performing information security audits according to ISO 27001, ISO 27006, and ISO 19011.

• Senior Project Manager, Business Analyst and Senior PMO as interim manager for banks, insurance companies, retail, and industry.
• Technical rollout and change management for an international mining company during the implementation of new ERP systems.
• Strategic development of ITSCM, IT services, and IT security as interim CISO.
• Implementation of an ISMS according to ISO 27001 and BCM according to ISO 22301 in Chile, Argentina, and Brazil.
• Interim Business Development Manager for various IT companies.
• Business Analyst and interpreter for IT projects (Spanish/German/English).

• Responsible for preparing, programming, and securing wireless solutions for the digital data collection for the 2011-2012 census.
• Conducted training for external staff on digital data collection.
• Strategic development of ITSCM, IT services, and IT security as well as management of all innovation projects.
• Restructuring the IT department and negotiating with executive management and the works council.
• Implementation of policies according to ISO 27001, ISO 22301, ITIL, COBIT, and OECD.
• Setup and introduction of the first SOC with a SIEM platform for automated Threat Lifecycle Management (TLM).
• Introduction of PMO, development, and project methodologies (PMI, CMMI, CMMN).
• Led the cross-border improvement of the telecommunications network (RFP).
• Interim people management responsibility for more than 50 employees.

• Introduction of an electronic money card (eWallet) using smart card technology as a subsidiary of the banks.
• Management of the technological platform for eWallet administration as an open innovation project.
• Licensing of the money card with Mondex International (MasterCard).
• Establishment and leadership of an interbank committee for operational and technology topics.
• Development of the model for manufacturing, operation, and clearing of electronic money in cooperation with banking supervision and the central bank.
• Development of the financial model regarding investment and profit distribution, considering money market stability.
• Interface (Business Analyst) between banks for project implementation.
• People management responsibility for more than 20 employees.

• Development, implementation, and management of all electronic banking products for the corporate sector.
• Development and launch of e-commerce solutions for the bank.
• Consulting for the secure development of e-commerce and EDIFACT in Chile.

• Responsible for COMEX, financial EDIFACT & e-commerce for German and European banks.
• Responsible for financial institutions at CeBIT.
• Development and promotion of e-commerce in German banks.
• Member of European interbank committees in Frankfurt, Paris, and London.
• Led an e-commerce project between commercial banks and the Landeszentralbank (LZB) in Frankfurt.