Head of Information Security in Germany

• CIO at nutrition R&D and producer (family owned)

Strengthened IT Team, recovered IT service, reviewed and streamlined complex SAP landscape, reviewed IT security set-up, reviewed laboratory IT

• Implementation of a full-stack application with Angular as the frontend framework and Java as the backend language
• Use of the Swagger OpenAPI specification for REST communication between the frontend and backend applications
• Control of a card printer via the Nexus Card SDK framework
• Design and implementation of card management software with a web interface and a JavaFX module for printer monitoring
• Use of Cucumber tests for test automation and creation of test artifacts to test outside the development environment
• Use of Wireshark for network investigations to analyze the API of a third-party product and to monitor the REST API of the self-developed software

• Coordination of the B3S and ISO 27001 implementation project, considering the upcoming KRITIS evidence procedure
• Providing consulting services in ISO 27001, B3S, KRITIS, and IT baseline protection
• Collaborating with the Information Security Officer (ISO)
• Identifying company assets for IT risk management
• Developing a zone concept for IT risk management
• Creating an action plan for B3S
• Developing a template for risk analyses

• Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
• Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
• Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
• Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
• Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
• Implement continuous monitoring solutions to detect and respond to threats in real time.
• Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
• Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
• Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
• Collaborate with project teams to address findings and ensure that security risks are managed effectively.
• Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
• Facilitate a culture of security awareness throughout the organization through training and regular communication.
• Lead security initiatives that align with the organization’s long-term strategic goals.
• Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
• Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

• Placed via recruiter 1st Solution with Deutsche Bahn. Supported and advised on Audit and Cyber Security matters there
• Carried out numerous CSAs (Control Self Assessments), with close exchange with application owners and development of possible remediation solutions, and entered them in DB's risk2value tool from vendor GBTEC2
• Advised on the creation of internal and external security risks

• Development of comprehensive services in cybersecurity, IT governance, and AI
• Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
• Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
• Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
• Responsible for company growth, client relations, and strategic partnerships

Consulting on compliance and data protection topics in the telecommunications environment.

• The replacement of the existing archive system (document management system – DMS) on a host-based platform is well advanced.

• The internal audit is meant to ensure the company's quality standards.

• GDPR

• ISO 27001 ff.

• BSI

• DORA

• Patient data regulations

• Host / Cloud / S3 / Container / highly scalable / Nuxeo

• Budget: 50,000

• Team: 1

• Complete overhaul of the ISMS according to ISO 27001
• Conducted a comprehensive gap analysis
• Reduced ISMS documentation by 30% through consolidation and process optimization
• Introduced a full PDCA cycle for continuous improvement
• Established the ISMS within the company
• Implemented the necessary processes
• Managed and conducted internal and external audits
• Developed and implemented a company-wide risk management system
• Deployed an ISMS tool including process design and training
• KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
• NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
• Led a cybersecurity team of 3 members
• Conducted various internal and external audits, managed providers, introduced continuous improvement
• Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
• Redesigned the security architecture, reducing administrative efforts by 20%
• Implemented ITIL processes (e.g., change management)
• Revised service agreements with internal and external providers
• Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
• Managed a budget of one million euros

• Responsibility for Computer Software Validation (CSV) of the IT infrastructure
• Support in the operation and maintenance of the Integrated Management System (IMS)
• Work as interim Information Security Officer (ISMR) for two companies in the medical technology sector
• Ensuring ISO 27001 compliance within the organization
• Participation in implementing cybersecurity requirements for health software and connected medical devices according to ISO 81001-1

• Clients: SMEs and public organizations

• Security analysis of alerts
• Further development of the security operations center
• Development of processes and workflows in the security environment
• Implementation of SOC solutions
• Forensic expertise
• Conducting hunts
• Vulnerability scans and proof of concepts
• Risk assessments and risk analyses
• Maintenance and further development of the Tenable.sc ScanCenter environment

• Lead developer of Prof. Valmed, the first LLM-powered medical device (utilising RAG on a medical corpus of 2.5M+ documents) to receive a CE certification.
• Designed and implemented cloud-native MLOps infrastructure for ENBW’s energy trading analytics division, enabling scalable deployment and monitoring of predictive models.
• Architected end-to-end testing and validation frameworks for AI/ML systems, ensuring quality, compliance, and robustness in critical and regulated applications.
• Conducted professional training on AI testing, EU regulatory frameworks, and quality assurance for production AI systems.