Compliance Consultant in Germany

• Designed and moderated a NIS2 preparation workshop for RAS Reinhardt Maschinenbau GmbH and its IT service provider Catuno GmbH. Together with executive management and IT leadership, the current status was assessed, an initial GAP analysis was conducted and areas for action were prioritized based on ISO 27001.
• Developed an ISO-27001-based regulatory framework (ISMS) for NIS2 compliance, including a structured current/target GAP analysis, targeted improvement of the security maturity level and preparation of the organization for NIS2 audit readiness.

• Advising companies in the areas of energy management, environmental protection and occupational health and safety – from gap analysis through to implementation.
• Supporting the introduction and auditing of ISO management systems (ISO 50001 / 14001 / 45001) and compliance with legal requirements.

Conducting a GAP analysis to assess existing security measures → identifying critical vulnerabilities

Developing an action plan that takes risk and cost-effectiveness into account

Introducing an IT maturity model based on BSI guidelines

Advising management on compliance, governance, and security strategy

Establishing internal processes for a sustainable security organization

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, Vulnerability Management Policy, Business Resilience Programme, Risk Governance Plan
• Consolidation into an integrated emergency manual (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table and a formal approval structure
• Review and documentation of the applicability of NIS2 and HinSchG, including the legal reasoning for non-applicability
• Processing of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with a documented compensating control

Technology company

• Analysis of CRA requirements
• Management workshop
• Development of recommendations

Result: Prioritized CRA readiness plan for compliance.

• Risk analysis
• Performing control activities
• Transaction Monitoring

• Designing processes for implementing regulatory IT requirements (VAIT, BAIT, DORA, MaGo) and establishing them within the IT organization
• Monitoring the execution of these processes, quality assurance and adaptation to new requirements
• Support and coordination of the annual audit regarding regulatory IT requirements (PwC)
• ITK governance
• Software lifecycle management
• Documentation and control of the IDV development process
• Process support and policy creation when setting up test management with regard to DORA and VAIT
• Policy creation for IAM processes
• Tools/Applications: ServiceNow, Confluence, Jira, M365, Loop, Connect, Omada

• Active network of freelancers and self-employed professionals in the areas of interim management, Fractional Leadership, consulting and coaching.
• Interim management of IT projects
• Support in developing and implementing business strategies
• Change management
• Optimization of business processes

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

• Designed and implemented the concept for assessing physical climate risks and mapping risks in accordance with LkSG
• Effective communication

• Played a key role in developing and implementing internal compliance processes aligned with corporate and regulatory standards.
• Supported the implementation of the Compliance Management System (CMS) and internal policies, ensuring adherence to global compliance frameworks.
• Conducted export classifications under the Harmonized Tariff System (HTS), including Dual-Use and U.S. Export Administration Regulations (EAR), ensuring accurate and compliant trade documentation.
• Acted as customs coordinator, overseeing export compliance and customs processes to maintain smooth and legally compliant international transactions.
• Assisted with GDPR-related data protection requirements, internal risk assessments, and compliance reporting obligations.
• Contributed to internal audits, regulatory reporting, and employee training, promoting a strong compliance culture across the organization.
• Led a project to facilitate compliant remote working abroad, enhancing operational flexibility while mitigating compliance risks.
• Collaborated with cross-functional teams (legal, operations, IT, HR) to ensure alignment with corporate governance and regulatory requirements.

Leading Jefferies’ DORA-driven operational resilience programme by strengthening ICT risk governance, control design, and regulatory readiness across key technology and outsourcing domains. Partnering with senior stakeholders to translate regulatory requirements into pragmatic governance, reporting, and assurance processes suitable for a global investment banking environment.

• Developed the Enterprise Register of Information (DORA Art. 28.3) to align with regulatory requirements.
• Defined and embedded ICT Risk Appetite and tolerance levels aligned to the Global Operational Risk Framework, strengthening decision-making and risk acceptance governance.
• Drove audit readiness by reviewing and re-drafting 50+ IT & Information Security policies, improving clarity, ownership, and control alignment.
• Oversaw the Operational Resilience Testing Programme (including penetration testing) and tracked remediation to closure, strengthening control assurance and reducing open findings.
• Aligned 10+ intra-group agreements with DORA regulatory standards.
• Enhanced executive-level decision-making with an enterprise ICT Risk Dashboard featuring KPIs/KRIs.

• Implemented comprehensive NIS 2 compliance programs through detailed gap analyses against ISO 27001, Siemens policies and controls
• Developed measurable success criteria for sustainable compliance structures
• Analyzed complex supply chains for systematic assessment of third-party risks

• Consulting on effort estimation for VDA ISA / TISAX certification
• Conducting a 2-day workshop including preparation and follow-up
• Skills: TISAX 5.1, ISO 27001:2022, auditing, information security, consulting, facilitation, presentation