Nikolaus B.-Senior Cybersecurity Consultant |ISO27k ISMS Lead Impl. & Audit |ISB|BSI|GRC|EU AI Act|GRC|BCM|DORA|TPRM

Check rate
Experience
Information Security, IS-Governance & Crossfunctional Governance
Zürich Beteiligungs-AG (Deutschland)
- Conducted security assessments for supplier qualification, business unit onboarding, and ongoing reviews of service providers and partners (Ongoing Assurance).
- Assessed technical and organizational measures (TOMs) against GDPR and information security requirements.
- Handled security reviews and approval processes in the Global Approval Navigator (OneTrust).
- Advised business units and IT on information security, security requirements, and risk-appropriate measures.
- Supported the development of SOC/SIEM processes and tools as part of the ISMS in line with ISO/IEC 27001.
- Analyzed cyber threats and coordinated security objectives and measures to address Security Findings with the SOC team.
- Monitored and assessed current security advisories and security-related metrics (KPIs).
- Reviewed, assessed risks, and approved exception requests (Security Exceptions).
- Independently analyzed and handled Security Events and supported the handling of security incidents.
- Planned and supported awareness initiatives to strengthen security awareness.
- Created, implemented, and reviewed information security policies and standards.
- Conducted protection needs analyses and gap assessments to identify security gaps and risk deviations.
- Defined and reviewed technical and organizational risk treatment measures.
- Advised on Third Party Governance with consideration of DORA, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, and BCM in line with ISO 22301.
ICT Risk Management and Information Security
Toyota Kreditbank GmbH (TKG)
- Advised on the development of Security Incident Management and security incident handling processes.
- Advised on SOC/SIEM processes and tools as part of the ISMS in line with ISO/IEC 27001.
- Analyzed cyber threats and coordinated security objectives and measures to address Security Findings with the SOC team.
- Advised on ICT third-party risk management for all of the client's subsidiaries.
- Supported the implementation of DORA requirements and ensured IT compliance with consideration of MaRisk, EBA guidelines, BAIT, and BSI IT-Grundschutz.
- Advised on information security, ICT risk management, AI governance, and Business Continuity Management based on ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, and ISO 22301.
- Coordinated security requirements and measures with the business units involved, IT, and other stakeholders.
- Independently created policies, requirements, and concepts for information security, ICT risk management, outsourcing, and BCM.
- Advised and supported internal and cross-functional SWIFT projects for KYC reattestation under CSCF v2025 as a SWIFT Customer Security Programme (CSP) Assessor.
- Used OneTrust Data Mapping, Inventory Manager, and Risk Register, as well as Confluence, ServiceNow (SNOW), and Microsoft 365.
ICT Risk Management and Information Security
B. Metzler seel. Sohn & Co. AG
- Independently developed policies, requirements, and concepts for ICT risk management and information security
- Advised business units on ICT risk management and information security matters
- Developed the ICT risk management framework governing the identification, assessment, and management of ICT risks
- Evaluated the information security management system (ISMS), including adapting it to new challenges
- Conducted risk analyses to identify and assess potential ICT risks and information security risks for the Metzler Group
- Advised on defining and implementing measures to minimize risks and improve the resilience of ICT systems
- Advised on ensuring compliance with relevant internal and external regulatory requirements (MaRisk, DORA, BAIT, BSI IT-Grundschutz, ISMS, ISO 27001, ISO 42001, ISO 27005, BCM ISO 22301)
- Advised on internal and cross-functional projects (SAP DORA Compliance, Target2, §8a-BSI Act)
Information Security Subproject Lead
Die Autobahn GmbH des Bundes
- Coordinated ISMS processes with the contractor (ISO 27001 & BSI IT-Grundschutz)
- Verified and contributed to the development of the "Network Management Platform" security concept
- Advised on and served as a contact for Autobahn security-related matters
- Reported to executive management and program management
- Provided professional support for audit processes in the Information/IT Security and Data Protection departments
- Coordinated Information/IT Security and Data Protection processes
- Supported the connection of the client and contractor SIEM systems
- Designed and established the connection between the business continuity management systems
- Advised on and contributed to implementing information security, IT security, and data protection requirements
- Contributed to audits and reviews based on BSI IT-Grundschutz and prepared for and supported the §8a audit
- Advised on the development of KRITIS measures
Cybersecurity Consultant
Bürgschaftsbank NRW GmbH
- Supported the migration from HiScout to ForumSuite (information security risk management tool)
- ISMS, Risk Management, Business Continuity Management, and emergency management
- Revised and improved the ISMS and BCM to make them audit-ready
- Created and defined measures to address deficiencies and develop emergency plans
- Advised on audit preparation and reported to department heads and executive management
- Advised on DORA RTS/ITS/Guidelines and GAP analysis
- Advised on requirements under BSI IT-Grundschutz & KRITIS audits (§8a-BSI Act), as well as NIS2
- Advised on ISO/IEC 27001/27002 & ISO/IEC 22301
- Created a bank-specific target measures catalog (BASI) and guidelines LFO, LFI
- Advised on BAIT, KAIT, VAIT, ISO 9001, and industry-specific security standards (B3S)
Cloud Security Consultant
Uniper
- Identifying and documenting gaps in the existing secure software development lifecycle
- Defining a governance framework for a modern secure software development lifecycle based on DevSecOps principles
- Identifying gaps in central tooling for DevSecOps activities and documenting them in a gap analysis presentation
- Defining and documenting selection criteria for additional tools to close identified gaps
- Creating a company-wide secure development lifecycle policy based on ISO 27001/27002 and NIST
- Improving Azure cloud infrastructure and tooling (SAST, DAST, IAST, IaC, OWASP, Mitre, CERT, CSA)
- Advising on the further development of KRITIS measures
- Point of contact for auditors
IT Security Consulting & Project Lead
Becton Dickinson (BD.com & embecta.com)
- Developing and implementing a certifiable information security strategy in accordance with ISO 27001
- Preparing presentations and business cases to support decision-making
- Establishing a certifiable ISMS in accordance with ISO 27001 (BSI IT-Grundschutz / §8a-BSI-Gesetz)
- Managing consulting firms (PWC, DIOX, BDX, TGS, CBRE)
- Managing information security incidents and reporting to senior management
- Communicating and coordinating with internal cross-functional teams
- Developing and further developing security concepts, policies, procedural guidelines, and work instructions
- Maintaining external communication with stakeholders and authorities
- Implementing, maintaining, and further developing the company-wide risk management system
- Assessing legal and regulatory requirements and implementing them in business processes
- Managing audits and raising information security awareness (external and internal)
- Advising on information protection and IT security requirements
- Continuously improving and monitoring the ISMS
IT Security Consulting & Information Security Manager
Deutsche Apotheker- und Ärztebank eG
- Providing information security consulting in accordance with BSI IT-Grundschutz & ISO 27001
- Supporting and coordinating penetration tests (BAIT, MaRisk)
- Conducting gap assessments
- Comparing the bank's internal requirements with the security measures of IT service providers
- Evaluating identified vulnerabilities
- Responsible for the phishing awareness campaign and SWIFT audit
- Reporting to senior management
Security Consulting & Project Management
GEA Group AG
- Establishing and operating SOC/SIEM processes and tools in accordance with ISMS ISO/IEC 27k
- Introducing vulnerability management and threat intelligence processes/tools
- Establishing a security incident response framework and emergency management
- Business continuity management & disaster recovery in accordance with ISMS ISO/IEC 27k
- Reporting to senior management and program management
- Improving the IT landscape as part of the Global Security Program
- Advising on the further development of KRITIS measures (BSI IT-Grundschutz / §8a-BSI-Gesetz)
Cyber Security Consulting & Project Management
Deutsche Börse AG
- Creating information security documentation & risk assessments
- Conducting risk analyses of information and communication technologies (IKT)
- Asset management
- Improving and further developing in accordance with BSI IT-Grundschutz / §8a-BSI-Gesetz
- Conducting structural analyses and protection requirements analyses
- Preparing audit-relevant information for internal & external audits
Cyber Security Consulting & Project Management
Innogy SE
- Cyber Security consulting and point of contact for business units
- Project management for BSI, ISO 27k, ITIL, BCM, SOC/SIEM
- Remediation of Security Findings, Cyber Threat Analysis, and Security Objectives and Measures with the SOC team
- Introduction of MS Windows 10 Security Standard, CIS Benchmark, and security profiles
- Patch Management and Remediation
- Advice on BSI IT-Grundschutz and §8a-BSI-Gesetz
- Implementation of Endpoint Protection, Firewall, GPO, Secure Boot, Disk Encryption, Remote Access, VPN, and software distribution (SCCM)
Cyber Security Consulting & Project Management
Consors Finanz, BNP Paribas S.A. Niederlassung Deutschland
- IT Cyber Security consulting
- Project management according to NIST
- Remediation of Security Findings (F1-F5)
- Advice on resource and budget planning
- Introduction of Role-Based Access Control (RBAC), PAM/IAM
- Documentation (ISO 20022, ISO 31000, ISO 27000, GDPR, BAIT, FW-Security, JIRA, PSD2, IAM, PAM, GRC)
Project Management
Finanz Informatik Technologie Service
- Consulting and project management for highly critical trading applications (Prio 1) at LBBW
- Managing the remediation of Cyber Security Findings at LBBW
- Implementation of measures according to BSI IT-Grundschutz (§8a-BSI-Gesetz) and ISO 27001
- Managing technical teams during hardware replacement and rollout of critical trading applications, reporting to department heads & CIO
- Introduction of RBAC/Identity Access Management according to BSI IT-Grundschutz and ISO 27001
IT-Security Consultant & Multi-Project Management ISM
Admeritia GmbH
- Consulting on GRC, GDPR, EU-DSGVO for KRITIS companies and support during §8a audits
- Introduction and implementation of ISMS, risk and Business Continuity Management in critical infrastructure
- Creation of security guidelines/policies and design of security and management processes
- Conducting audits, risk analyses, and protection needs assessments
- Consulting on certification by accredited bodies
- Introduction of IAM according to ISO/IEC 27552 & ISO/IEC 27001 & 27009
- Creation of policies, procedures, implementation plans, and security concepts (access control)
Cyber Security Consulting & Project Management
Landesbank Baden-Württemberg
- Technical lead and implementation concept for restructuring the Bloomberg market data infrastructure (project "Bloomberg LBC")
- Preparation of current-state analyses and rollout plans
- Development of a role-based access control system concept (RBAC, DAC, MAC)
- Identity Management System implementation concept
- Advice on BSI IT-Grundschutz / §8a-BSI-Gesetz
- Point of contact for internal and external auditors
- Managing the remediation of security vulnerabilities and preparing action plans
- Testing and analysis of various Bloomberg connections
Interim Senior Application & Project Management
IB.SH - Investitionsbank Schleswig-Holstein
- Interim Senior Application Management for Treasury & Risk Management (Front, Middle, Back Office)
- Project lead for the Bloomberg Professional implementation
- Application support for ATAQ Risk, Reuters, Moosmüller & Knauf
- Consulting on BSI IT-Grundschutz & §8a-BSI-Gesetz, as well as IAM according to ITIL V3
- Incident, Problem, Request, Release, Security & Change Management (Remedy) according to ISO 27001
- Weekly meetings with business departments
Senior Application & Project Management, Team Lead
EON Global Commodities
- Senior Application Management & Trading Floor Support
- Team Lead, Change Management
- Service Delivery Manager & Project Manager, E.ON Ruhrgas Transition (1400 employees)
- IT Security Management, BCM, DR, KPI reporting
- Deputy Team Lead (approx. 40 employees)
- Responsible for the risk management system, including evaluation and reporting
- Software integration, configuration, release & incident lifecycle management
- Single point of contact for internal and external auditors
IT Consultant & Project Management
Commerzbank
- Created a service catalog
- Planned strategy for the Open Source & Engineering department after consultation with 19 employees
IT Security & Application Support
HSH Nordbank
- Designed access permissions in the Kondor+ application area
- Application support for the Operational Stability & IT Security project
- Developed an Identity & Access Management concept according to ITIL V3
- Created user guides
IT Consultant & Application Support
CACEIS Bank Deutschland GmbH
- Integrated WebSphere Application Server, MQ Series and Process Server
- QA testing, software and regression testing, defect management with Quality Center
- Production support for Treasury Enrichment System (TESYS) and IAM according to ITIL V3
- Supported EAI operations (IBM WBI ICS)
- Extended Unix shell scripts in the MQ context
IT Consultant & Application Support
HVB Information Services
- Integration of WebSphere Application Server, MQ Series and Process Server
- Support for Unix applications, packaging, staging, scripting, Citrix management and batch processing
- QA testing, regression testing and SPS production assurance
- Defect management with Mercury Quality Center
- Migration from CVS to PVCS and Subversion
- IAM, change management & incident management according to ITIL V3
IT Consultant & Application Support
Landesbank Baden-Württemberg
- System and application support for Financial Markets (Calypso, Kondor+, Sophis Risque)
- Windows & Unix system support, software packaging and scripting
- IAM according to ITIL V3 as well as project, change and incident management
- Advising business departments on system-related matters
IT Consultant & Application Support
HypoVereinsbank Corp. & Markets
- Integration and 3rd-level support for the trading floor and VIP support
- Software programming, packaging and distribution (MS-SMS under Windows, Solaris)
- Reporting, overnight, scenario & batch processing
- QA testing and regression testing as well as change control management
- Support for RTD/RTS, EUREX, Xetra, Reuters and Sophis Risque
IT Consultant & Application Support
Barclays Capital
- Planning, implementation and support for Front Office & Back Office
- Support for the global network infrastructure and telecommunications equipment
- VIP support and on-site interoffice visit support in Zurich, Paris and London
IT Consultant & Application Support
Landesbank Hessen Thüringen
- Planning, implementation, administration and support for the entire trading platform
- Support for Windows, Reuters, Bloomberg, MS Office, Murex, Salamis, Ziris, Niku, Bond Pricing, SAP and other applications
- IAM as well as coordination of internal and external partners
IT Security Consultant & Project Manager
GE Frankona Re
- Responsible for distributed infrastructure in Europe (70+ servers, 2000 users)
- IT Security Officer for Europe
- Compliance with Six Sigma processes
- Security Awareness Education
- Problem Manager for the IT outsourcing project "Helpdesk ERC-India"
- Managed the Disaster Recovery Center in Ireland (BCM, budget $3 million per year)
Industry experience
See where this freelancer has spent most of their professional time.
Experienced in Banking and Finance, Energy, Insurance, Government and Administration, Healthcare, and Manufacturing.
Business area experience
See which departments and functions this freelancer has contributed to most.
Experienced in Information Technology, Project Management, Quality Assurance, and Audit.
Summary
I am a freelance Senior Consultant for information security, Governance, Risk & Compliance (GRC), and ICT risk management, with IT and project experience dating back to 1996. My industry focus is on banks, insurance companies, energy companies, and industrial and pharmaceutical companies in the DACH region.
I support clients in establishing and developing ISMS in line with ISO/IEC 27001, managing information security risks in line with ISO/IEC 27005, and Business Continuity Management in line with ISO 22301. Other areas of focus include implementing DORA requirements, third-party risk management, and audit preparation. I also have knowledge of AI management systems (AIMS) in line with ISO/IEC 42001 and work with the requirements of the EU AI Act and the Cyber Resilience Act (CRA).
I combine technical understanding with structured documentation and clear coordination between business units, IT, and external service providers. I am looking for consulting engagements and project or subproject leadership roles where I can assess risks, guide the implementation of effective measures, and further develop information security and operational resilience.
Skills
- Cybersecurity
- Isms
- Nist
- Bsi It-Grundschutz
- §8a-Bsi Act
- Iso/Iec 2700x
- Ai/Ki Iso/Iec 42001
- Cis
- Gdpr
- Grc
- Application Risk Assessments
- Bcm Iso 22301
- Tisax ® Vda/Isa 5/6
- Devsecops-Sldc
- Nis2
- Dora
- Diga
- Bfarm
- Itsm
- Itil
- It-Pm
- Support For The §8a Audit
- Security Awareness
- Penetration Testing
- Vulnerability Management
- Threat Analysis
- Security Objectives
- Security Measures
- Security Policies
- Security Concepts
- Security Standards & Guidelines
- Isms Iso 27001 Lead Implementer
- Senior Application Management (Itsm, Itil)
- Business Continuity
- Disaster Recovery
- It Operations
- It Security
- Auditing
- It Project Management
- Team Lead - Change Management
- Team Lead - Service Delivery Manager
- Team Lead - Application Management
- Agile Methods (Scrum)
- Secure Cloud Infrastructure (Sldc – Shift-Left, Secdev Policy & Secdev Guidelines)
- Azure
- Ms365
- Cloud Tooling
- Sast
- Dast
- Iast
- Iac
- Owasp
- Mitre
- Cert
- Secure Coding
- Configuration Management
- Release Management
- Quality Management
Core Competencies:
- Establishing And Developing Isms In Line With Iso/Iec 27001, And Preparing For Audits And Assessments
- Governance, Risk & Compliance (Grc), Audit-Ready Documentation, And Management Reporting
- Professional Leadership Of Project Teams And Service Providers, And Coordination With Business Units And Management
- Ict Risk Management And Implementation Of Regulatory Requirements, Especially Dora, Eu Act, Marisk, Eba-Gls, Bait, Cra
- Assessing Information Security And Third-Party Risks, And Planning And Tracking Measures
- Analyzing And Developing Security Concepts, Policies, And Information Security Processes
- Defining Roles, Responsibilities, Resource Models, And Escalation Paths
- Organizational Integration Of Internal And External Soc Services And Coordination Of Soc/Siem Interfaces
- Developing Implementation, Transition, And Operating Plans, And Supporting The Handover To Business-As-Usual Operations
Industry Focus:
- Banks & Financial Services Providers
- Insurance Companies
- Energy Providers & Grid Operators
- Industry & Pharmaceuticals
Soft Skills:
- Highly Structured Approach With A Strong Focus On Documentation
- Clear Understanding Of Organizational Relationships
- Strong Communication, Reliable, And Solution-Oriented
- Strong Execution Skills And Sense Of Responsibility
Languages
Education
Mastery University
Mastery University Graduate · Personal Development and Self-Leadership
Professional development program focused on personal growth, with an emphasis on self-reflection, goal setting, and understanding personal thought and behavior patterns. Explored personal values, motivation, and interpersonal relationships, as well as methods for consciously shaping change processes.
Fachhochschuhle
Electrical Engineering Training
Certifications & licenses
AIX Advanced System Administration RS/6000
ATAQ Treasury & Risk Management
Apple Macintosh Solution Provider Training
Consulting & optimization of all common network topologies and tools, routers, firewalls & gateways, web servers, SSL connections, WLAN
Operating systems and databases, MS Windows up to V10, Unix derivatives, Sybase, Oracle, SWL Java, XML
Bloomberg Administrator Training
Business English Training
Certified CSP - Cyber Security Practitioner
Certified IT Project Management
Cloud Computing, SaaS, PaaS, IaaS, Amazon, MS Azure
DECnet/PCSA Technical Overview & Support
DORA-compliant ICT Risk Management
Database Administration of Oracle for SAP R/3
DecLanworks for Apple Macintosh
Digital Ultrix Basic Knowledge
Digital Ultrix System Administration
Essentials of Energy Trading & Hedging
Good software, hardware, & IT security knowledge
IT Project Management Training
Intercultural Training – Present effectively to US-Americans
Java Foundation
Microsoft Windows Support for Engineers
Novell Networking Technologies
PC Technician Training & IT Basics
Pacer-Networking Training
Pathworks Application Integration
Pathworks V5 Inst., Config., Planning & Migration
Pathworks for Macintosh V1.0 Inst. & Configuration
Programming Databases with Oracle PL/SQL
Reuters Triarch Administrator - Reuters AG
Reuters AG
Risk Management
Software Development & Database Query Languages
Sybase – System & Database Admin. ASE 15.0
TCP/IP Network Management
Team Solution Implementation and Support
Team Leadership and Moderation Techniques
Teamroute/All-in-1: Management & Customization
Technical Network Training
Tivoli Distributed Monitoring
Tivoli Management Framework
Tivoli Software Distribution 4.0
Tivoli Storage Manager Advanced Administration
VMS System Management I & II
Vax Cluster System Management
WebSphere - Basic Knowledge
Securities Training & Commodity Training
Windows 2000 Workshop
Statistics
Experience
Global experience
Expertise
Qualifications
Frequently asked questions
Have questions? Find more information here.
Nikolaus is based in Langenfeld, Germany and can operate in on-site, hybrid, and remote work models.
Nikolaus speaks the following languages: German (Native), English (Advanced), Portuguese (Intermediate).
Nikolaus has at least 26 years of experience. During this time, Nikolaus has worked in at least 17 different roles and for 25 different companies. The average length of individual experience is 1 year. Note that Nikolaus may not have shared all experience and actually has more experience.
Based on recent experience, Nikolaus would be well-suited for roles such as: Information Security, IS-Governance & Crossfunctional Governance, ICT Risk Management and Information Security, Information Security Subproject Lead.
Nikolaus's most recent position is Information Security, IS-Governance & Crossfunctional Governance at Zürich Beteiligungs-AG (Deutschland).
In recent years, Nikolaus has worked for Zürich Beteiligungs-AG (Deutschland), Toyota Kreditbank GmbH (TKG), B. Metzler seel. Sohn & Co. AG, Die Autobahn GmbH des Bundes, and Bürgschaftsbank NRW GmbH.
Nikolaus is most experienced in industries like Banking and Finance, Energy, and Insurance. Nikolaus also has some experience in Healthcare, Government and Administration, and Manufacturing.
Nikolaus is most experienced in business areas like Information Technology, Project Management, and Quality Assurance. Nikolaus also has some experience in Audit and Strategy.
Nikolaus has recently worked in industries like Banking and Finance, Insurance, and Energy.
Nikolaus has recently worked in business areas like Information Technology, Audit, and Project Management.
Nikolaus attended Mastery University for Personal Development and Self-Leadership.
Nikolaus has 57 certificates. Among them, these include: AIX Advanced System Administration RS/6000, ATAQ Treasury & Risk Management, and Apple Macintosh Solution Provider Training.
Nikolaus is immediately available full-time for suitable projects.
Daily rate distribution
The rates shown represent the typical market range for freelancers in this position based on recent contracts on our platform.
Average rates for similar positions
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 10 Nov 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Similar freelancers
Discover other experts with similar qualifications and experience
Experts recently working on similar projects
Freelancers with hands-on experience in comparable project as a Information Security, IS-Governance & Crossfunctional Governance
Nearby freelancers
Professionals working in or nearby Langenfeld, Germany
