Find the best Heads of IT Security in Germany matched in minutes from over 15,000 CVs with the power of AI
Cover IT security strategy, ISO 27001 work, risk management, incident response, IAM and security awareness with vetted, available freelancers who can step in fast and fit your setup.
About the role
Security leadership A Head of IT Security sets the direction for security across systems, users and data. In many companies this role sits close to the CISO, IT Security Manager or Information Security Manager title. The work is about turning risk into clear priorities, not just writing policies.
What they deliver
- Security strategy and roadmap
- Risk assessments and control gaps
- Incident response playbooks
- Policies for access, devices and data
- Reporting for management and audit teams
- Security awareness plans for staff
Core skills Strong candidates combine technical depth with clear judgment. They understand network security, IAM, endpoint protection, logging, SIEM, cloud security and vulnerability management. They can work with engineering, infrastructure, legal, compliance and leadership without losing sight of business needs.
Tools and methods A freelance Head of IT Security often works with existing stacks rather than replacing them. Common work includes reviewing Microsoft 365 security, Azure or AWS controls, firewall rules, EDR, DLP, identity governance and ticketing workflows. In Germany, this role often supports regulated industries, industrial firms and mid-sized companies that need structured security leadership without a permanent hire.
When companies bring them in Companies hire this role when security has grown faster than governance, when an audit exposed gaps, or when a new platform, merger or cloud move changed the risk profile. They also bring in a freelance Head of IT Security to cover parental leave, fill an interim leadership gap, or guide a security team through a major incident. Remote work is often enough for planning and reporting, while on-site time helps with workshops, stakeholder interviews and critical decisions.
What strong professionals stand out on
- They explain trade-offs in plain language.
- They build controls that teams actually follow.
- They know how to balance speed and protection.
- They can lead audits, remediation and incident handling.
- They adapt to the company’s size, sector and maturity.
- They leave behind structure, not only urgent fixes.
Meet FRATCH Heads of IT Security
Flamur Abdyli
Fractional Chief Information Security Officer
Last position:
Fractional Chief Information Security Officer at VR Smart Guide GmbH
- Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
- Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
- Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
- Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
- Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
- Implement continuous monitoring solutions to detect and respond to threats in real time.
- Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
- Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
- Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
- Collaborate with project teams to address findings and ensure that security risks are managed effectively.
- Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
- Facilitate a culture of security awareness throughout the organization through training and regular communication.
- Lead security initiatives that align with the organization’s long-term strategic goals.
- Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
- Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.
Sergey Komarov
Managing Director Cybersecurity
Last position:
Managing Director Cybersecurity at CBA-Cybersecurity and Business Advisory GmbH
- Development of comprehensive services in cybersecurity, IT governance, and AI
- Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
- Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
- Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
- Responsible for company growth, client relations, and strategic partnerships
Konstantin Simonow
Head of Cyber Defense Unit
Last position:
Head of Cyber Defense Unit at Simonow Consulting GmbH
- Established the Cyber Defense Unit following a major cybersecurity incident
- Recruited a team of Cybersecurity Architects, Engineers and Senior Security Analysts
- Managed the team’s resources and activities in defining and implementing a target cybersecurity architecture, monitoring the IT landscape, detecting and responding to security events and incidents, and consulting other IT stakeholders in their efforts to improve the organization’s cybersecurity posture (comparable to Technical CISO role)
- Led the separation of Information Security (governance, risk, compliance) and Cyberdefense Unit (technical cybersecurity), in close collaboration with the CISO
- Led the selection and onboarding of external Security Operations Center (MSSP)
Peter Weileder
Program and Project Manager / Internal Auditor / CISO
Last position:
ISO 27001 Auditor for health insurance archive system at Health insurance company
The replacement of the existing archive system (document management system – DMS) on a host-based platform is well advanced.
The internal audit is meant to ensure the company's quality standards.
GDPR
ISO 27001 ff.
BSI
DORA
Patient data regulations
Host / Cloud / S3 / Container / highly scalable / Nuxeo
Budget: 50,000
Team: 1
Simone Amoroso
Head of Technology & CISO
Last position:
Head of Technology & CISO at AI Quality and Testing Hub
- Lead developer of Prof. Valmed, the first LLM-powered medical device (utilising RAG on a medical corpus of 2.5M+ documents) to receive a CE certification.
- Designed and implemented cloud-native MLOps infrastructure for ENBW’s energy trading analytics division, enabling scalable deployment and monitoring of predictive models.
- Architected end-to-end testing and validation frameworks for AI/ML systems, ensuring quality, compliance, and robustness in critical and regulated applications.
- Conducted professional training on AI testing, EU regulatory frameworks, and quality assurance for production AI systems.
Ransford Annan
IT System & Security Engineer
Last position:
Volunteer IT & Cybersecurity Team Lead at Farm House Organic
- Led remote IT and cybersecurity operations, including secure device provisioning, app deployment, compliance monitoring, and endpoint security with Microsoft Intune and Defender for Endpoint.
- Managed Identity and Access Management (IAM) with Microsoft Entra ID, including implementing role-based access control, conditional access, VPN configuration, and multi-factor authentication (MFA).
- Maintained and secured Cloud PCs, provided technical remote support, and optimized performance within the Microsoft 365 Business environment.
Kevin Engelhardt
CISO as a Service
Last position:
CISO as a Service at Joint Venture International Insurance
- Leading security operations and governance, ensuring continuous ISO 27001 conformity
- Enabling the secure integration of SaaS and AI tools across the organisation
- Driving AI strategy and governance to ensure responsible and compliant adoption
Joachim Fox
Director System Safety & Product Cybersecurity/Product Governance, Global R&D
Last position:
Director System Safety & Product Cybersecurity/Product Governance, Global R&D at ZF
- Lead global safety and cybersecurity strategy for ZF’s full product portfolio, including audits, assessments, release recommendations, processes, field monitoring, and incident response.
- Serve as Governance, Risk & Compliance manager for ZF’s R&D.
- Since January 1, 2025, took on additional responsibilities in AI, data privacy, and Automotive SPICE.
- Pioneered a data-based safety and security culture powered by a company-wide digital platform and currently integrating agentic AI for continuous compliance measurement and incident response.
- Oversee a team of approximately 50 employees across 10 global locations; oversee safety and cybersecurity for hundreds of product developments and over 5000 system and software engineers impacting all ZF product lines.
Robert Fox
Senior / Executive Interim CIO / CTO & CISO
Last position:
Technology & Security Executive
Transformational leadership at the intersection of business strategy and technology innovation
Managed technology transformations with budgets up to €150M (OPEX & CAPEX)
Led multinational teams of 50-150 professionals across various industries
Directed enterprise-wide security programs and digital transformation initiatives
Orchestrated successful M&A integrations, carve-outs and crisis management
Executed large-scale transition programs for global organizations
Security excellence: advanced implementation of ISO27001, NIS2, TISAX, DORA, ISMS frameworks, among others
Digital innovation: cloud transformation, AI security integration, IoT/Industry 4.0
Infrastructure expertise: enterprise architecture, network security, data center optimization
Program management: PMI, PRINCE2, ITIL, ITSM methodologies
Risk management: cyber resilience, compliance, business continuity
Strategic vision: translating complex technical challenges into business opportunities
Change leadership: guiding organizations through digital evolution and security transformation
Crisis management: rapid response and recovery in high-pressure situations
Stakeholder engagement: building consensus across the C-suite, boards and global teams
Innovative mindset: quick adaptation to emerging technologies and market demands
Global perspective: extensive international experience and multicultural sensitivity
Talent development: mentoring and building high-performance technical teams
Knowledge transfer: effective communication of complex concepts at all levels
Solution focus: pragmatic problem solving with strategic long-term vision
Relationship building: strong stakeholder management and executive presence
Bilingual: English (native), German (business level)
Strategic thinking combined with meticulous attention to detail
Results-driven with a service-oriented approach
Analytical mindset with creative problem-solving skills
Diplomatic leadership style enriched by strategic humor
Industry experience: financial services, banking & insurance, energy & utilities, automotive & engineering, healthcare & life sciences, technology & telecommunications
Ralf Lembke
Chief Information Security Officer
Last position:
Chief Information Security Officer at Stadtwerke Krefeld Holding AG
- Building an information security management system for the entire group
- Supporting 2 KRITIS subsidiaries
Volker Jung
Interim CISO (Germany, Austria, US, APAC), Auditor
Last position:
Interim CISO (Germany, Austria, US, APAC), Auditor at Vetter Pharma-Fertigung GmbH & Co. KG
- Planned and initiated BIA/BCM assessment to identify risk mitigation measures and process optimization, and provide risk transparency to the general management
- Evaluated KRITIS/NIS-2 status and implemented requirements
- Created comprehensive digital roadmap and ISO 27001/NIS-2/Data Privacy KRITIS roadmap
- Enhanced crisis management process and documentation
- Integrated information security clauses into customer and supplier contracts to ensure compliance with internal and regulatory requirements
- Ensured organizational readiness for audits by the Landesbehörde für Aufsicht (LBA) and supported audit processes
- Improved asset management processes and classification of sensitive data to strengthen overall security
- Planned and ordered regular penetration tests (internal, external) to identify vulnerabilities and improve security measures
- Performed compliance checks against EU CER requirements and reporting
- Created management status and risk reports to ensure transparent communication of risks and security posture
- Managed registration with the German Federal Office for Information Security (BSI) and provided ongoing status updates
- Conducted risk assessment of supply chain, enhanced evaluation and reporting processes
- Improved IT/OT network segmentation to enhance security and reduce potential audit risks
- Strengthened cyber resilience by proactive measures and enhanced security frameworks and KPI reporting
- Onboarded SIEM/SOC/EDR to improve cybersecurity monitoring and response
- Planned and conducted awareness trainings for employees, administrators, and management
- Enhanced incident reporting processes to ensure timely and accurate reporting of cybersecurity events
- Created AI policy in cooperation with the Legal department to secure use and governance of Artificial Intelligence within the organization
- Scoped and implemented ISO 27001:2022 requirements as part of the Information Security Management System
- Served as interim InfoSec team lead
- Introduced information security to global KAM and Sales organization
- Improved admission and access management including privileged access
- Conducted internal audits in collaboration with internal audit department
Christian Gebhardt
Deputy Chief Information Security Officer
Last position:
Deputy Chief Information Security Officer at Gothaer Solutions GmbH
- Deputy lead of the 10-member information security management team in a highly regulated environment (DORA, VAIT, BAIT)
- Direct reporting lines to the CIO of the Gothaer Group and the management board of Gothaer Solutions
- Regular member of the Group Risk Committee and the Compliance Committee
- Managing and coordinating information security processes within the company and with IT service providers
- Leading task forces for handling information security incidents
- Contributing to IT emergency and business continuity management
Patrick Günther
Information Security Manager
Last position:
Information Security Manager at IT-Freelancer
- Responsible for computer software validation (CSV) of the IT infrastructure
- Supported the operation and maintenance of the Integrated Management System (IMS)
- Served as interim information security officer (ISMR) for two companies in the medtech industry
- Ensured ISO 27001 compliance within the organization
- Contributed to implementing cybersecurity requirements for health software and networked medical devices according to ISO 81001-1
Alexander Sonntag
Senior Contract Manager in the Cyber Security Field
Last position:
Senior Contract Manager in the Cyber Security Field at Water IT Security GmbH
- Senior Contract Manager in the Cyber Security Field
- Responsible for the SIEM/SOC of the Water IT Security group
- Data Protection Officer for the Water IT Security group (officially registered with authorities)
- Artificial Intelligence Officer for the Water IT Security group
- Member of the compliance team of the Water IT Security group
Discover over 15,000 top freelancers
Heads of IT Security statistics
Aggregated from the professional profiles of matched freelancers.
Experience
16 years
Position duration
3 years
Positions per freelancer
9
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Banking and Finance, Energy
Certification focus areas
Information Technology, Quality Assurance, Audit
Bachelor's degree or higher
80%
Master's degree or higher
40%
Doctorate
20%
Certifications per freelancer
7
Most common languages
English, German, French
Speak two or more languages
100%
Daily Rate Distribution
The chart shows how the daily rates of freelancers in this role are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Average rates for Heads of IT Security & Seniority distribution
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Frequently Asked Questions
Do you have questions? Here you can find further information about FRATCH
A Head of IT Security sets priorities, reviews risks and guides the security roadmap. The work often includes policy updates, incident response planning, access control reviews, audit preparation and coordination with IT, compliance and management. In a freelance setup, the focus is usually on fast structure and clear decisions.
A security engineer usually works on technical implementation. A Head of IT Security owns the direction, makes trade-offs and aligns security with business goals. If the company needs governance, leadership, stakeholder management and a clear security plan, this role is the better fit.
Look for someone who understands risk management, IAM, endpoint protection, logging, vulnerability management and incident handling. A good IT Security Manager or Head of IT Security also communicates well with non-technical leaders and can turn findings into action. Experience with audits, policies and team coordination matters as much as technical depth.
Yes. This role is often brought in when the permanent lead is absent, the team is being rebuilt or security leadership is needed during a transition. A freelancer can keep the program moving, support the team and hand over a clean structure to the next permanent hire.
That depends on the project and the company’s setup. Strategy work, policy writing and reporting can often be done remotely, while workshops, audits and crisis coordination may benefit from on-site presence. In Germany, many companies also expect the freelancer to work smoothly in English and, where needed, with German-speaking stakeholders.
The titles are sometimes used interchangeably, but they are not always the same. A CISO usually sits at a broader executive level and may own enterprise risk and board reporting, while a Head of IT Security often focuses more directly on IT controls, operations and delivery. The exact scope depends on the company size and structure.
Ask for examples of security programs they have led, not just tools they have used. A strong candidate can explain how they handled risk acceptance, incident response, audit findings and remediation without hiding behind jargon. Good references, clear communication and a practical plan for the first weeks are strong signals.
This role is common in manufacturing, financial services, healthcare, SaaS and other companies with sensitive data or complex IT landscapes. In Germany, it is especially useful where security must align with internal audit, works councils, cloud adoption or industrial operations. The best candidate adapts to the industry’s risk profile, not the other way around.
The average hourly rate for Heads of IT Security in Germany is 137 €, which corresponds to a daily rate of about 1,093 € based on an 8-hour working day.
Of the freelancers working as Heads of IT Security in Germany, 80% hold at least a Bachelor's degree, 40% hold at least a Master's degree, and 20% hold a doctorate.
On average, freelancers working as Heads of IT Security in Germany have 16 years of professional experience, with a single engagement typically lasting around 3 years.
The most common languages among freelancers working as Heads of IT Security in Germany are English (100%), German (93%), and French (29%).
The most common industries among freelancers working as Heads of IT Security in Germany are Information Technology (86%), Banking and Finance (57%), and Energy (50%).
The most common business areas among freelancers working as Heads of IT Security in Germany are Information Technology (100%), Project Management (79%), and Quality Assurance (64%).
FRATCH Heads of IT Security main locations
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a Free Demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
