Information Security Consultants in Germany
vetted and available with the power of AI from over 15,000 CVs.Secure your digital assets, establish robust risk frameworks, and achieve compliance with ISO 27001 or TISAX. We connect you with vetted, available freelance cybersecurity experts matched precisely to your business requirements in minutes.
Meet FRATCH Information Security Consultants in Germany
Andreas Rühl
Last position:
Freelance Consultant for Information Security at A-R-C Andreas Rühl Consulting
Development and implementation of tailored information security strategies
Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards
Risk management and creation of security concepts
Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000
Building and improving security organizations
Creation and implementation of guidelines, policies, work instructions, and process descriptions
Audit support and certification preparation
Conducting trainings, workshops, and awareness campaigns
Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies
Conducting penetration tests and vulnerability analyses
Consulting on the selection, integration, and management of security architectures in complex IT environments
Consulting on ITSM and managed security services and SOC
Leading and managing complex projects to improve information security
Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics
Introduction and quality assurance of management, documentation, and knowledge management systems
Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)
Development and implementation of risk analysis procedures
Organizing initial response, forensic investigations, and organizational measures in the event of security incidents
Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios
Awareness campaigns to promote security culture in companies
Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards
Simulations and exercises to prepare for information security incidents
Interim management for leading information security projects or IT security organizations
Taking on the role of an external CISO (Chief Information Security Officer)
Support in developing and implementing IT security and corporate strategies
Coaching and mentoring of managers in the field of information security
Building and leading security departments as well as recruiting and qualifying employees
Temporary assumption of management responsibility in critical situations
Dirk Peter
Last position:
Freelance Cyber Defense Lead & KRITIS/NIS2 Consultant | AI Security Architect at Self-Employed
Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.
Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.
Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.
Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.
Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.
Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.
Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.
Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.
Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.
Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.
Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.
Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.
Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.
Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.
Result: >99.5% uptime over 20+ years and zero compromises.
Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.
Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.
Steffen Lotze
Last position:
Consultant for BSI baseline protection and ISO 27701 at Society for International Cooperation
- Support in building and further developing the information security management system
- Cooperation with external consultants in the certification team for the support structure
- Involvement in project planning, identification, and implementation of the necessary measures according to BSI IT baseline protection
- Professional support for in-house subject matter experts in creating the documents required for certifications
- Carrying out the work according to BSI 200-2
Peter Konrad
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Florian Schröder
Last position:
Information Security Officer / Designated InfoSec Officer at Oil Company
- Complete overhaul of the ISMS according to ISO 27001
- Conducted a comprehensive gap analysis
- Reduced ISMS documentation by 30% through consolidation and process optimization
- Introduced a full PDCA cycle for continuous improvement
- Established the ISMS within the company
- Implemented the necessary processes
- Managed and conducted internal and external audits
- Developed and implemented a company-wide risk management system
- Deployed an ISMS tool including process design and training
- KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
- NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
- Led a cybersecurity team of 3 members
- Conducted various internal and external audits, managed providers, introduced continuous improvement
- Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
- Redesigned the security architecture, reducing administrative efforts by 20%
- Implemented ITIL processes (e.g., change management)
- Revised service agreements with internal and external providers
- Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
- Managed a budget of one million euros
Najat Diamante
Last position:
Freelance Consultant Microsoft Purview at Bechtlee IT-Systemhaus
- Design and global rollout of sensitivity labels (confidentiality labels) for automated classification and encryption of business-critical data.
- Definition and rollout of Data Loss Prevention (DLP) policies to protect IP and personal data across endpoints, Exchange, SharePoint, Teams, and non-Microsoft clouds.
- Setup of Insider Risk Management policies to detect and contain excessive data leaks and risky user behavior.
- Implementation of GDPR and retention requirements through automated retention policies and structured records management.
- Technical support for legal teams in internal and external investigations using eDiscovery (Standard/Premium) and Content Search.
- Continuous improvement of the security and compliance level by reviewing the Microsoft Compliance Manager and closing gaps (regulations such as ISO 27001, NIS-2)
Kerstin Glawinski
Last position:
Information Security Consulting at CAS AG
Peter Dittkuhn
Last position:
Security Consultant at Public Institution of the City Administration
- Requirements management, process planning, interface role, ISMS implementation and documentation
- Implementation and establishment of an ISMS according to ISO 27001 as well as setup of emergency management / ITSCM
- Coordination of conditions with the authority-affiliated IT service provider
- Consideration of KRITIS relevance in the scope and implementation of a B3S
- Development of guidelines for document control and the continuous improvement process (KVP)
- Creation of relevant project documents
- Analysis of existing processes and development of guidelines
- Collection of requirements for ISMS and ITSCM and coordination with the IT service provider including definition of interfaces
- Analysis of communication processes and escalation paths
- Review of documents for risk management, ISMS, emergency preparedness and emergency response
- Development of a complete rebuild of all documentation and creation of new relevant documents
- Development of necessary rules, policies and concepts
- Interface function between customer and service provider to ensure document quality
- Coordination of protection needs with departments, especially regarding KRITIS relevance, and planning resulting measures
- Development of preventive measures to minimize data center outages for various scenarios such as pandemics or ransomware attacks
- Defining the test strategy for IT emergency exercises
- Initiation of necessary training measures for raising awareness in departments
- External Information Security Officer (ISB)
- Introduction of document control
Federico Leefhelm
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developed and implemented a holistic process view covering both technical and organizational aspects Ensured end-to-end control of all IAM-related technical services Established clear responsibilities and accountabilities within the IAM landscape Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security Introduced and monitored governance policies to ensure compliance and security Continuously improved IAM processes and systems through regular audits and evaluations Participated in external audits of the process as part of official ISO audits Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units Conceptually advanced the KPI system to measure process quality
Michael Fitschen
Last position:
Project Manager Implementation B3S / ISO 27001 at Health Insurance Fund
- Coordination of the B3S and ISO 27001 implementation project, considering the upcoming KRITIS evidence procedure
- Providing consulting services in ISO 27001, B3S, KRITIS, and IT baseline protection
- Collaborating with the Information Security Officer (ISO)
- Identifying company assets for IT risk management
- Developing a zone concept for IT risk management
- Creating an action plan for B3S
- Developing a template for risk analyses
Robert Vattig
Last position:
Freelance Consultant Information Security and Business Continuity at Freelance business consulting
- Provide consulting services nationwide in both private and public sectors
- Advise on information security management systems, IT-Grundschutz, KRITIS compliance, TISAX, business continuity and crisis management
- Support the introduction of policies, risk management methods, asset registers and supplier management
- Conduct internal audits, training workshops and support audit preparations
Andreas Ilias
Last position:
Cybersecurity Specialist Assessor at Bundesnetzagentur
- Recognition of national notified bodies
- Preparation of cybersecurity competency reports
- EU Radio Equipment Directive
Frank Mühlenbrock
Last position:
Freelance Security + Data Protection Consultant at Deutsche Bahn
- Placed via recruiter 1st Solution with Deutsche Bahn. Supported and advised on Audit and Cyber Security matters there
- Carried out numerous CSAs (Control Self Assessments), with close exchange with application owners and development of possible remediation solutions, and entered them in DB's risk2value tool from vendor GBTEC2
- Advised on the creation of internal and external security risks
Valeri Milke
Last position:
Associate Partner - Information Security Consulting at Insentis GmbH
- Improvement of the Information Security Management System (ISMS) based on ISO 27001, NIS2, DORA, B3S, TISAX and BSI IT Baseline Protection
- Conducting comprehensive gap analyses to identify gaps and derive action plans according to the above standards and regulations; management and KPIs
- Data Loss Prevention strategy and implementation using MS Purview
- Vulnerability and patch management, security monitoring
- Risk analysis and threat modeling using the STRIDE methodology
- Development of vendor risk assessments, implementation of risk classifications, conducting supplier assessments and implementing technical monitoring solutions (e.g. Security ScoreCard)
- Securing cloud environments (AWS and Azure); expertise in CSPM/CNAPP (Wiz), cloud migration, secure CI/CD pipelines, container security and best practices in AWS, Azure and Office 365
- Application security: penetration testing, DevSecOps, OWASP, pre-commit hooks, key and secret management, IDE plugins, static source code analysis, dependency checks, container scanning, vulnerability management, CIS benchmarks and compliance
- Security assessment and hardening according to CIS benchmarks and cloud conformity in AWS, Office 365 and Azure
Isabel Mundet
Last position:
NIS 2 Compliance Expert at SIEMENS Digital Industries Software
- Implemented comprehensive NIS 2 compliance programs through detailed gap analyses against ISO 27001, Siemens policies and controls
- Developed measurable success criteria for sustainable compliance structures
- Analyzed complex supply chains for systematic assessment of third-party risks
Discover over 15,000 top freelancers
Information Security Consultants statistics
Aggregated from the professional profiles of matched freelancers.
Experience
24 years
Position duration
2.7 years
Positions per freelancer
18
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Professional Services, Automotive
Certification focus areas
Information Technology, Audit, Quality Assurance
Bachelor's degree or higher
88%
Master's degree or higher
46%
Doctorate
8%
Certifications per freelancer
11
Most common languages
German, English, French
Speak two or more languages
94%
Based on our profile pool as of 27 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this role in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates for Information Security Consultants in Germany
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 27 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the role
Securing German Business Infrastructure
Modern enterprises in Germany operate under strict regulatory environments where protecting intellectual property and customer data is paramount. Freelance cybersecurity professionals help companies establish robust defense systems that align with both local and international expectations. They guide organizations through complex technical architectures, ensuring that supply chains, cloud environments, and internal networks remain resilient against evolving digital threats.
Key Responsibilities and Deliverables
- Designing and implementing Information Security Management Systems aligned with ISO 27001 standards.
- Preparing automotive suppliers for TISAX assessments to secure partnerships with major manufacturers.
- Conducting comprehensive risk analyses, threat modeling, and vulnerability assessments across corporate IT infrastructures.
- Developing incident response plans and coordinating disaster recovery drills to minimize potential downtime.
- Aligning internal data processing procedures with GDPR and local data protection regulations.
Bridge the Cyber Security Talent Gap
Building an internal security team takes time that many fast-growing companies and medium-sized enterprises do not have. External advisors step in immediately to assess current vulnerabilities, draft emergency policies, and train staff on security awareness. Their objective perspective allows them to identify internal blind spots and implement pragmatic security controls without the overhead of a permanent hire.
Essential Skills and Toolsets
A qualified security expert combines deep technical knowledge with strong communication skills to bridge the gap between IT departments and executive boards. They are proficient in threat intelligence tools, security information and event management systems, and cloud security architectures. Their expertise extends beyond technical configurations to encompass governance, policy writing, and conducting internal audits that verify compliance across all organizational levels.
Frequently asked questions
The facts hiring teams ask for most often when it comes to Information Security Consultants.
An Information Security Consultant analyzes an organization's existing security posture, identifies vulnerabilities, and designs strategies to protect digital assets. They develop security policies, guide compliance initiatives, and establish frameworks to mitigate cyber risks. Their goal is to align technical security measures with overall business objectives.
While a penetration tester focuses on actively attacking systems to find technical vulnerabilities, an IT security consultant takes a broader strategic view. They design the overall security governance, write policies, ensure regulatory compliance, and manage risk frameworks. They address the organizational, human, and administrative aspects of security alongside the technical controls.
A freelance security consultant brings specialized knowledge for specific project phases, such as preparing for an upcoming audit or implementing a new security standard. This approach saves recruitment time and avoids long-term overhead costs. Additionally, independent experts offer an unbiased, objective evaluation of your current IT infrastructure.
In Germany, projects often require familiarity with BSI IT-Grundschutz, which is the national standard defined by the Federal Office for Information Security. For companies in the automotive supply chain, achieving compliance with TISAX is highly critical. A professional InfoSec consultant working in this region will also ensure strict adherence to GDPR guidelines.
Many tasks of an information security advisor can be performed effectively from a remote location, including policy drafting, risk assessments, and virtual audits. However, complex infrastructure reviews or initial stakeholder workshops often benefit from occasional on-site visits. Hybrid models are the most common approach for successful project delivery.
A top-tier external security advisor is recognized by recognized industry certifications such as CISSP, CISM, or CRISC. Their track record should include successfully completed projects in similar industries and concrete experience with the specific standards you target. Strong communication skills are equally important, as they must translate complex technical risks into clear business terms.
While technical documentation and international standards are usually in English, a cyber security consultant working in Germany often needs fluent German. This is especially true when conducting workshops with local staff, drafting internal corporate policies, or dealing with local public authorities and compliance auditors.
An Information Security Consultant acts as the architect of the certification process, conducting a initial gap analysis to see what is missing. They then design the required policies, set up risk management processes, and train your team to run the system. Finally, they accompany your organization through the internal and external audits required for certification.
The average hourly rate for Information Security Consultants in Germany is 117 €, which corresponds to a daily rate of about 938 € based on an 8-hour working day.
Of the freelancers working as Information Security Consultants in Germany, 88% hold at least a Bachelor's degree, 46% hold at least a Master's degree, and 8% hold a doctorate.
On average, freelancers working as Information Security Consultants in Germany have 24 years of professional experience, with a single engagement typically lasting around 2.7 years.
The most common languages among freelancers working as Information Security Consultants in Germany are German (100%), English (94%), and French (18%).
The most common industries among freelancers working as Information Security Consultants in Germany are Information Technology (94%), Professional Services (76%), and Automotive (53%).
The most common business areas among freelancers working as Information Security Consultants in Germany are Information Technology (100%), Project Management (94%), and Quality Assurance (76%).
FRATCH Information Security Consultants main locations
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
