Information Security Consultants in Germany

• Conducting information classification, risk management and supplier assessment workshops
• Introduction of a customer-specific information security minimum standard (based on TISAX and ISO 27001) since Apr. 2026; implementing the same standard in parallel for a second customer
• Building an ISMS according to ISO 27001 for a logistics company (approx. 160–200 MA)
• Municipal utility company (KRITIS, approx. 450 MA): independently introduced the CRISAM GRC tool and am currently expanding it to include NIS-2 areas, took over parts of the ISB support mandate, and followed up on and remediated audit findings
• Supporting customers in implementing DORA and NIS-2, including documentation for a financial institution
• Conducting and supporting audits of systems for attack detection (SzA) according to § 8a BSIG (today §§ 31, 39 BSIG)
• Creating network structure plans according to IT-SiKat
• Creating technical security concepts (logging, IAM, attack detection)

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

• Founded and lead a consulting firm specializing in ISO 27001 and integrated management systems, advising organizations on certification readiness, governance frameworks and compliance structures.
• Support technology companies in implementing ISO-based management systems and risk management frameworks to strengthen information security and regulatory compliance.

Strategic consulting for the development and strengthening of ISMS structures (ISO 27001 / BSI IT-Grundschutz), including onboarding, gap analyses, and preparation of the IT organization for DORA requirements (ICT third-party risk) and NIS2 compliance. Auditing compliance requirements in a regulated environment.

• Placed via recruiter 1st Solution with Deutsche Bahn. Supported and advised on Audit and Cyber Security matters there
• Carried out numerous CSAs (Control Self Assessments), with close exchange with application owners and development of possible remediation solutions, and entered them in DB's risk2value tool from vendor GBTEC2
• Advised on the creation of internal and external security risks

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Development and implementation of customized information security strategies

• Introduction and further development of ISMS according to ISO 27001, BSI-Grundschutz and other standards

• Risk management and preparation of security concepts

• Consulting for KRITIS, PCI DSS, TISAX and VdS 3473/10000

• Establishment and optimization of security organizations

• Creation and implementation of policies, guidelines, work instructions and process descriptions

• Audit support and certification preparation

• Delivery of training sessions, workshops and awareness campaigns

• Selection and consulting for the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls and encryption technologies

• Conducting penetration tests and vulnerability analyses

• Consulting on the selection, integration and management of security architectures in complex IT environments

• Consulting on ITSM, managed security services and SOC

• Management and coordination of complex projects to improve information security

• Process analysis, optimization and management according to ITIL, ISO 27001 and cybernetics

• Introduction and quality assurance of management, documentation and knowledge management systems

• Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)

• Development and implementation of risk analysis procedures

• Organization of initial response, forensic investigations and organizational measures in security incidents

• Design and delivery of targeted workshops on topics such as ISMS, IT risks and current threat scenarios

• Awareness campaigns to promote a security culture in companies

• Special training on ISO 27001, BSI-Grundschutz, KRITIS and other relevant standards

• Simulations and exercises to prepare for information security incidents

• Interim management for leading information security projects or IT security organizations

• Taking on the role of external CISO (Chief Information Security Officer)

• Support in developing and implementing IT security and corporate strategies

• Coaching and mentoring of managers in information security

• Establishment and management of security departments, including employee recruitment and qualification

• Temporary assumption of management responsibility in critical situations

• Coordination of the B3S and ISO 27001 implementation project, considering the upcoming KRITIS evidence procedure
• Providing consulting services in ISO 27001, B3S, KRITIS, and IT baseline protection
• Collaborating with the Information Security Officer (ISO)
• Identifying company assets for IT risk management
• Developing a zone concept for IT risk management
• Creating an action plan for B3S
• Developing a template for risk analyses

• Documenting data protection processes
• Creating a process-relevant deletion handbook
• Developing deletion concepts including critical business processes
• Reviewing the newly created data protection policy
• Setting up a deletion plan for GDPR-compliant deletion within the company
• Creating the record of processing activities
• Technology: MS Office 365, Camunda Modeler, Audatis

• Recognition of national notified bodies
• Preparation of cybersecurity competency reports
• EU Radio Equipment Directive

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures

• Implemented comprehensive NIS 2 compliance programs through detailed gap analyses against ISO 27001, Siemens policies and controls
• Developed measurable success criteria for sustainable compliance structures
• Analyzed complex supply chains for systematic assessment of third-party risks