Information Security Consultants in Germany
vetted and available with the power of AI from over 15,000 CVs.Secure your digital assets, establish robust risk frameworks, and achieve compliance with ISO 27001 or TISAX. We connect you with vetted, available freelance cybersecurity experts matched precisely to your business requirements in minutes.
Meet FRATCH Information Security Consultants in Germany
Matthias K.
Last position:
Business Owner at AKM
Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as support, financial accounting, developers, and security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.
Tools/Frameworks: FIDO, YubiKey, Veridium, BSI IT-Grundschutz, NIST
Peter D.
Last position:
Security Consultant at Public-law institution of the city administration
- Requirements management, process planning, interface function, ISMS setup, and documentation
- Setup and establishment of an ISMS according to ISO 27001 and establishment of emergency management / ITSCM
- Coordination of the circumstances with the public-sector IT service provider
- Consideration of KRITIS relevance within the scope and implementation of a B3S
- Development of requirements for document control and the continuous improvement process
- Preparation of relevant project documents
- Analysis of existing processes and preparation of guidelines
- Requirements gathering for ISMS and ITSCM and coordination with the IT service provider, including definition of interfaces
- Analysis of communication processes and escalation paths
- Review of documents for risk management, ISMS, emergency preparedness, and emergency response
- Redesign of the complete documentation and preparation of new relevant documents
- Development of necessary rules, policies, and concepts
- Interface between customer and service provider to ensure document quality
- Coordination of protection needs with specialist departments, particularly regarding KRITIS relevance, and planning of resulting measures
- Development of preventive measures to minimize the risk of data center outages in scenarios such as pandemics or ransomware attacks
- Definition of the test strategy for IT emergency exercises
- Initiation of necessary awareness training measures for specialist departments
- External Information Security Officer
- Introduction of document control
Andreas R.
Last position:
Freelance Consultant for Information Security at A-R-C Andreas Rühl Consulting
Development and implementation of tailored information security strategies
Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards
Risk management and creation of security concepts
Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000
Building and improving security organizations
Creation and implementation of guidelines, policies, work instructions, and process descriptions
Audit support and certification preparation
Conducting trainings, workshops, and awareness campaigns
Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies
Conducting penetration tests and vulnerability analyses
Consulting on the selection, integration, and management of security architectures in complex IT environments
Consulting on ITSM and managed security services and SOC
Leading and managing complex projects to improve information security
Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics
Introduction and quality assurance of management, documentation, and knowledge management systems
Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)
Development and implementation of risk analysis procedures
Organizing initial response, forensic investigations, and organizational measures in the event of security incidents
Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios
Awareness campaigns to promote security culture in companies
Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards
Simulations and exercises to prepare for information security incidents
Interim management for leading information security projects or IT security organizations
Taking on the role of an external CISO (Chief Information Security Officer)
Support in developing and implementing IT security and corporate strategies
Coaching and mentoring of managers in the field of information security
Building and leading security departments as well as recruiting and qualifying employees
Temporary assumption of management responsibility in critical situations
Jens B.
Last position:
Senior Cyber Security Consultant at Brennscheidt IT Consulting
KEY PROJECTS
Since 05/2023 | Bank | Senior Cyber Security Consultant (external)
- Advising and guiding the system owners in creating and further developing IT security concepts
- Coordinating and tracking the remediation of findings from reviews and audits
- Advising on the implementation of regulatory requirements for information security
10/2023 – 02/2024 | Fintech | Project Manager (external)
- Project management to close various audit gaps in the field of information security
- Conceptual design and implementation of an information security management system based on ISO/IEC 27001
- Creation and further development of ISMS documents and processes
Günther E.
Last position:
IT Security & Governance Consulting (DORA & NIS2): at Freelance Assignment
Strategic consulting for the development and strengthening of ISMS structures (ISO 27001 / BSI IT-Grundschutz), including onboarding, gap analyses, and preparation of the IT organization for DORA requirements (ICT third-party risk) and NIS2 compliance. Auditing compliance requirements in a regulated environment.
Dirk P.
Last position:
Freelance Cyber Defense Lead & KRITIS/NIS2 Consultant | AI Security Architect at Self-Employed
Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.
Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.
Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.
Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.
Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.
Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.
Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.
Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.
Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.
Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.
Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.
Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.
Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.
Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.
Result: >99.5% uptime over 20+ years and zero compromises.
Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.
Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.
Steffen L.
Last position:
Consultant for BSI baseline protection and ISO 27701 at Society for International Cooperation
- Support in building and further developing the information security management system
- Cooperation with external consultants in the certification team for the support structure
- Involvement in project planning, identification, and implementation of the necessary measures according to BSI IT baseline protection
- Professional support for in-house subject matter experts in creating the documents required for certifications
- Carrying out the work according to BSI 200-2
Peter K.
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Najat D.
Last position:
Freelance Consultant Microsoft Purview at Bechtlee IT-Systemhaus
- Design and global rollout of sensitivity labels (confidentiality labels) for automated classification and encryption of business-critical data.
- Definition and rollout of Data Loss Prevention (DLP) policies to protect IP and personal data across endpoints, Exchange, SharePoint, Teams, and non-Microsoft clouds.
- Setup of Insider Risk Management policies to detect and contain excessive data leaks and risky user behavior.
- Implementation of GDPR and retention requirements through automated retention policies and structured records management.
- Technical support for legal teams in internal and external investigations using eDiscovery (Standard/Premium) and Content Search.
- Continuous improvement of the security and compliance level by reviewing the Microsoft Compliance Manager and closing gaps (regulations such as ISO 27001, NIS-2)
Kerstin G.
Last position:
Information Security Consulting at CAS AG
Federico L.
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developed and implemented a holistic process view covering both technical and organizational aspects Ensured end-to-end control of all IAM-related technical services Established clear responsibilities and accountabilities within the IAM landscape Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security Introduced and monitored governance policies to ensure compliance and security Continuously improved IAM processes and systems through regular audits and evaluations Participated in external audits of the process as part of official ISO audits Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units Conceptually advanced the KPI system to measure process quality
Michael F.
Last position:
Project Manager Implementation B3S / ISO 27001 at Health Insurance Fund
- Coordination of the B3S and ISO 27001 implementation project, considering the upcoming KRITIS evidence procedure
- Providing consulting services in ISO 27001, B3S, KRITIS, and IT baseline protection
- Collaborating with the Information Security Officer (ISO)
- Identifying company assets for IT risk management
- Developing a zone concept for IT risk management
- Creating an action plan for B3S
- Developing a template for risk analyses
Andreas I.
Last position:
Cybersecurity Specialist Assessor at Bundesnetzagentur
- Recognition of national notified bodies
- Preparation of cybersecurity competency reports
- EU Radio Equipment Directive
Robert V.
Last position:
Freelance Consultant Information Security and Business Continuity at Freelance business consulting
- Provide consulting services nationwide in both private and public sectors
- Advise on information security management systems, IT-Grundschutz, KRITIS compliance, TISAX, business continuity and crisis management
- Support the introduction of policies, risk management methods, asset registers and supplier management
- Conduct internal audits, training workshops and support audit preparations
Frank M.
Last position:
Freelance Security + Data Protection Consultant at Deutsche Bahn
- Placed via recruiter 1st Solution with Deutsche Bahn. Supported and advised on Audit and Cyber Security matters there
- Carried out numerous CSAs (Control Self Assessments), with close exchange with application owners and development of possible remediation solutions, and entered them in DB's risk2value tool from vendor GBTEC2
- Advised on the creation of internal and external security risks
Discover over 15,000 top freelancers
Information Security Consultants statistics
Aggregated from the professional profiles of matched freelancers.
Experience
24 years
Position duration
2.7 years
Positions per freelancer
17
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Audit, Quality Assurance
Bachelor's degree or higher
83%
Master's degree or higher
43%
Doctorate
7%
Certifications per freelancer
10
Most common languages
German, English, French
Speak two or more languages
95%
Based on our profile pool as of 16 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this role in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates for Information Security Consultants in Germany
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 16 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
Information Security Consultants experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (95%)
- Professional Services (71%)
- Banking and Finance (55%)
- Automotive (53%)
- Insurance (42%)
- Transportation (42%)
- Manufacturing (39%)
- Government and Administration (37%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the role
Securing German Business Infrastructure
Modern enterprises in Germany operate under strict regulatory environments where protecting intellectual property and customer data is paramount. Freelance cybersecurity professionals help companies establish robust defense systems that align with both local and international expectations. They guide organizations through complex technical architectures, ensuring that supply chains, cloud environments, and internal networks remain resilient against evolving digital threats.
Key Responsibilities and Deliverables
- Designing and implementing Information Security Management Systems aligned with ISO 27001 standards.
- Preparing automotive suppliers for TISAX assessments to secure partnerships with major manufacturers.
- Conducting comprehensive risk analyses, threat modeling, and vulnerability assessments across corporate IT infrastructures.
- Developing incident response plans and coordinating disaster recovery drills to minimize potential downtime.
- Aligning internal data processing procedures with GDPR and local data protection regulations.
Bridge the Cyber Security Talent Gap
Building an internal security team takes time that many fast-growing companies and medium-sized enterprises do not have. External advisors step in immediately to assess current vulnerabilities, draft emergency policies, and train staff on security awareness. Their objective perspective allows them to identify internal blind spots and implement pragmatic security controls without the overhead of a permanent hire.
Essential Skills and Toolsets
A qualified security expert combines deep technical knowledge with strong communication skills to bridge the gap between IT departments and executive boards. They are proficient in threat intelligence tools, security information and event management systems, and cloud security architectures. Their expertise extends beyond technical configurations to encompass governance, policy writing, and conducting internal audits that verify compliance across all organizational levels.
Frequently asked questions
The facts hiring teams ask for most often when it comes to Information Security Consultants.
An Information Security Consultant analyzes an organization's existing security posture, identifies vulnerabilities, and designs strategies to protect digital assets. They develop security policies, guide compliance initiatives, and establish frameworks to mitigate cyber risks. Their goal is to align technical security measures with overall business objectives.
While a penetration tester focuses on actively attacking systems to find technical vulnerabilities, an IT security consultant takes a broader strategic view. They design the overall security governance, write policies, ensure regulatory compliance, and manage risk frameworks. They address the organizational, human, and administrative aspects of security alongside the technical controls.
A freelance security consultant brings specialized knowledge for specific project phases, such as preparing for an upcoming audit or implementing a new security standard. This approach saves recruitment time and avoids long-term overhead costs. Additionally, independent experts offer an unbiased, objective evaluation of your current IT infrastructure.
In Germany, projects often require familiarity with BSI IT-Grundschutz, which is the national standard defined by the Federal Office for Information Security. For companies in the automotive supply chain, achieving compliance with TISAX is highly critical. A professional InfoSec consultant working in this region will also ensure strict adherence to GDPR guidelines.
Many tasks of an information security advisor can be performed effectively from a remote location, including policy drafting, risk assessments, and virtual audits. However, complex infrastructure reviews or initial stakeholder workshops often benefit from occasional on-site visits. Hybrid models are the most common approach for successful project delivery.
A top-tier external security advisor is recognized by recognized industry certifications such as CISSP, CISM, or CRISC. Their track record should include successfully completed projects in similar industries and concrete experience with the specific standards you target. Strong communication skills are equally important, as they must translate complex technical risks into clear business terms.
While technical documentation and international standards are usually in English, a cyber security consultant working in Germany often needs fluent German. This is especially true when conducting workshops with local staff, drafting internal corporate policies, or dealing with local public authorities and compliance auditors.
An Information Security Consultant acts as the architect of the certification process, conducting a initial gap analysis to see what is missing. They then design the required policies, set up risk management processes, and train your team to run the system. Finally, they accompany your organization through the internal and external audits required for certification.
The average hourly rate for Information Security Consultants in Germany is 117 €, which corresponds to a daily rate of about 932 € based on an 8-hour working day.
Of the freelancers working as Information Security Consultants in Germany, 83% hold at least a Bachelor's degree, 43% hold at least a Master's degree, and 7% hold a doctorate.
On average, freelancers working as Information Security Consultants in Germany have 24 years of professional experience, with a single engagement typically lasting around 2.7 years.
The most common languages among freelancers working as Information Security Consultants in Germany are German (100%), English (95%), and French (18%).
The most common industries among freelancers working as Information Security Consultants in Germany are Information Technology (95%), Professional Services (71%), and Banking and Finance (55%).
The most common business areas among freelancers working as Information Security Consultants in Germany are Information Technology (100%), Project Management (92%), and Quality Assurance (79%).
FRATCH Information Security Consultants main locations
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
