Compliance Consultant in Germany

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

Compliance department setup & DORA operationalization

• Setup of a complete compliance organization according to DORA
• Development and operationalization of SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, news feeds)
• Setup of a decentralized risk and action register
• Creation of gap analyses and derivation of actions
• Setup and maintenance of the outsourcing information register
• Use of own TPRM frameworks, checklists and process models

Compliance department setup & DORA operationalization

• Setup of a complete compliance organization according to DORA
• Development and operationalization of SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, news feeds)
• Setup of a decentralized risk and action register
• Creation of gap analyses and derivation of actions
• Setup and maintenance of the outsourcing information register
• Use of own TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of achieved project goals within management reporting.

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
• Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
• Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
• Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability

• Design and implementation of a concept for assessing physical climate risks and mapping risks under the Supply Chain Act (LkSG)
• Effective communication

• Designing processes for implementing regulatory IT requirements (VAIT, BAIT, DORA, MaGo) and establishing them within the IT organization
• Monitoring the execution of these processes, quality assurance and adaptation to new requirements
• Support and coordination of the annual audit regarding regulatory IT requirements (PwC)
• ITK governance
• Software lifecycle management
• Documentation and control of the IDV development process
• Process support and policy creation when setting up test management with regard to DORA and VAIT
• Policy creation for IAM processes
• Tools/Applications: ServiceNow, Confluence, Jira, M365, Loop, Connect, Omada

• Developed and managed content across diverse platforms, adapting tone, structure, and style to meet audience expectations and editorial standards
• Conducted in-depth research to ensure content accuracy, relevance, and alignment with client objectives and subject-matter requirements
• Edited and refined client manuscripts and drafts to improve clarity, narrative flow, coherence, and reader engagement
• Managed multiple concurrent content projects, prioritizing tasks and meeting tight deadlines while upholding high-quality standards
• Provided uncredited editing support for various publications, ensuring polished, consistent, and publication-ready final manuscripts

Leading Jefferies’ DORA-driven operational resilience programme by strengthening ICT risk governance, control design, and regulatory readiness across key technology and outsourcing domains. Partnering with senior stakeholders to translate regulatory requirements into pragmatic governance, reporting, and assurance processes suitable for a global investment banking environment.

• Developed the Enterprise Register of Information (DORA Art. 28.3) to align with regulatory requirements.
• Defined and embedded ICT Risk Appetite and tolerance levels aligned to the Global Operational Risk Framework, strengthening decision-making and risk acceptance governance.
• Drove audit readiness by reviewing and re-drafting 50+ IT & Information Security policies, improving clarity, ownership, and control alignment.
• Oversaw the Operational Resilience Testing Programme (including penetration testing) and tracked remediation to closure, strengthening control assurance and reducing open findings.
• Aligned 10+ intra-group agreements with DORA regulatory standards.
• Enhanced executive-level decision-making with an enterprise ICT Risk Dashboard featuring KPIs/KRIs.

Conducting a gap analysis to assess existing security measures → identifying critical vulnerabilities

Developing a catalog of measures considering risk and cost-effectiveness

Implementing an IT maturity model according to BSI guidelines

Advising management on compliance, governance, and security strategy

Establishing internal processes for a sustainable security organization

• Implemented comprehensive NIS 2 compliance programs through detailed gap analyses against ISO 27001, Siemens policies and controls
• Developed measurable success criteria for sustainable compliance structures
• Analyzed complex supply chains for systematic assessment of third-party risks

• Consulting on effort estimation for VDA ISA / TISAX certification
• Conducting a 2-day workshop including preparation and follow-up
• Skills: TISAX 5.1, ISO 27001:2022, auditing, information security, consulting, facilitation, presentation

• Baseline compliance verification against MAS audit findings
• Building technical architecture concept for 30 technologies to build hardening standard artifacts
• Identifying and building automation possibilities for given technologies based on CIS
• Building the standard baseline configuration based on internal security standard
• Responsible for building Cloud Native Application Protection Platform (CNAPP) architecture artifacts based on Azure cloud platform
• Responsible for RFQ and RFP for different CNAPP solutions (Qualys Total Cloud, CrowdStrike, Azure Security Center)
• Supporting compliance verification and validation via automated scripts for a sample population of IT devices and instances
• Responsible for complete vulnerability management lifecycle using Nexpose, remediation, reporting and integration of results with Splunk, HPSM and Tableau
• Audit support for MAS

• Implementation of guideline monitoring systems, migration projects, analysis and implementation of contractual and regulatory investment guidelines.

• Migrate funds from MIG21 to SimCorp Dimension, designing, testing, and implementing templates in FundDesigner and SimCorp.

• Utilize the AI-driven Dakota program in FundDesigner to analyze documents and implement client-specific changes.

• Actively collaborate with cross-functional, international teams to support ongoing projects and initiatives.

• Design, test, and refine AI prompts based on client requirements to optimize accuracy and consistency of regulatory and investment guideline outputs.

• Analyze client-provided prompts and source documents, translating complex requirements into effective prompt structures and reusable templates.

• Work with multiple large language models hosted on AWS, evaluating model behavior and output quality for compliance-related use cases.

• Coordinate with international teams to support cross-border investment compliance initiatives.

• Lead program risk manager in the global IT cybersecurity initiative
• Strategic advice on the department's alignment 'Digital Compliance Management'
• Revision of portfolio management (demands & projects) within the area
• Facilitating requirements discussions and leading digital compliance and risk assessment projects

• Risk analysis
• Performing control activities
• Transaction Monitoring