Information Security Officers in Germany
in minutes from 15,000 CVs with the power of AICover ISO 27001 work, risk assessments, policy design, incident response and security awareness without slowing delivery. Get fast, precise matching with vetted, available freelancers who can join remotely or on-site in Germany.
Meet FRATCH Information Security Officers in Germany
Regina Körnicke
Last position:
Data Protection Consultant at Promotional institute of a federal state (public credit institution)
Industry: Finance/Insurance
- Sparring partner for the data protection team
- Taking over tasks from the data protection backlog
- Updating data protection processes
- Updating TOMs
- Revising template documents (including DPA, data protection guidelines)
- Conducting audits (authorization concept, software development)
- Taking over tasks from day-to-day operations
- Processing data protection reports
- Conducting DPIA and TIA
- Reviewing data processing agreements
- Designing and delivering trainings
- Standard Data Protection Model
- AI and data protection
Result: Successfully supported the data protection team, worked through the data protection backlog, and delivered trainings successfully
Steffen Lotze
Last position:
Consultant for BSI baseline protection and ISO 27701 at Society for International Cooperation
- Support in building and further developing the information security management system
- Cooperation with external consultants in the certification team for the support structure
- Involvement in project planning, identification, and implementation of the necessary measures according to BSI IT baseline protection
- Professional support for in-house subject matter experts in creating the documents required for certifications
- Carrying out the work according to BSI 200-2
Alicja Wilczek
Last position:
Integrated security and emergency documentation for a 24/7 logistics company at Medium-sized logistics company
- Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
- Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
- Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
- Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability
Florian Schröder
Last position:
Information Security Officer / Designated InfoSec Officer at Oil Company
- Complete overhaul of the ISMS according to ISO 27001
- Conducted a comprehensive gap analysis
- Reduced ISMS documentation by 30% through consolidation and process optimization
- Introduced a full PDCA cycle for continuous improvement
- Established the ISMS within the company
- Implemented the necessary processes
- Managed and conducted internal and external audits
- Developed and implemented a company-wide risk management system
- Deployed an ISMS tool including process design and training
- KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
- NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
- Led a cybersecurity team of 3 members
- Conducted various internal and external audits, managed providers, introduced continuous improvement
- Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
- Redesigned the security architecture, reducing administrative efforts by 20%
- Implemented ITIL processes (e.g., change management)
- Revised service agreements with internal and external providers
- Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
- Managed a budget of one million euros
Najat Diamante
Last position:
Freelance Consultant Microsoft Purview at Bechtlee IT-Systemhaus
- Design and global rollout of sensitivity labels (confidentiality labels) for automated classification and encryption of business-critical data.
- Definition and rollout of Data Loss Prevention (DLP) policies to protect IP and personal data across endpoints, Exchange, SharePoint, Teams, and non-Microsoft clouds.
- Setup of Insider Risk Management policies to detect and contain excessive data leaks and risky user behavior.
- Implementation of GDPR and retention requirements through automated retention policies and structured records management.
- Technical support for legal teams in internal and external investigations using eDiscovery (Standard/Premium) and Content Search.
- Continuous improvement of the security and compliance level by reviewing the Microsoft Compliance Manager and closing gaps (regulations such as ISO 27001, NIS-2)
Kerstin Glawinski
Last position:
Information Security Consulting at CAS AG
Federico Leefhelm
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developed and implemented a holistic process view covering both technical and organizational aspects Ensured end-to-end control of all IAM-related technical services Established clear responsibilities and accountabilities within the IAM landscape Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security Introduced and monitored governance policies to ensure compliance and security Continuously improved IAM processes and systems through regular audits and evaluations Participated in external audits of the process as part of official ISO audits Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units Conceptually advanced the KPI system to measure process quality
Michael Fitschen
Last position:
Project Manager Implementation B3S / ISO 27001 at Health Insurance Fund
- Coordination of the B3S and ISO 27001 implementation project, considering the upcoming KRITIS evidence procedure
- Providing consulting services in ISO 27001, B3S, KRITIS, and IT baseline protection
- Collaborating with the Information Security Officer (ISO)
- Identifying company assets for IT risk management
- Developing a zone concept for IT risk management
- Creating an action plan for B3S
- Developing a template for risk analyses
Flamur Abdyli
Last position:
Fractional Chief Information Security Officer at VR Smart Guide GmbH
- Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
- Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
- Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
- Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
- Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
- Implement continuous monitoring solutions to detect and respond to threats in real time.
- Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
- Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
- Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
- Collaborate with project teams to address findings and ensure that security risks are managed effectively.
- Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
- Facilitate a culture of security awareness throughout the organization through training and regular communication.
- Lead security initiatives that align with the organization’s long-term strategic goals.
- Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
- Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.
Frank Mühlenbrock
Last position:
Freelance Security + Data Protection Consultant at Deutsche Bahn
- Placed via recruiter 1st Solution with Deutsche Bahn. Supported and advised on Audit and Cyber Security matters there
- Carried out numerous CSAs (Control Self Assessments), with close exchange with application owners and development of possible remediation solutions, and entered them in DB's risk2value tool from vendor GBTEC2
- Advised on the creation of internal and external security risks
Victor Wiedermann
Last position:
Senior IT Security Project Manager (Network, Hybrid Cloud, CMDB, Hardening) at Dormakaba International Holding GmbH
- Planning, managing, and executing IT projects in network architecture, hybrid cloud solutions, asset management/CMDB implementation, and system hardening (clients, servers, databases)
- Ensuring all projects are delivered on time, within budget, and meet quality standards
- Identifying and managing risks and proactively resolving issues
- Collaborating closely with technical and non-technical stakeholders to ensure project objectives are achieved
- Defining and tracking KPIs and progress reports for all project phases
Klaus Rheinwald
Last position:
Management Consultant Compliance/Data Protection at Telefónica Germany GmbH & Co. OHG
Consulting on compliance and data protection topics in the telecommunications environment.
Volkmar Jaekel
Last position:
Consultant at Bedia Motorentechnik GmbH & Co. KG
- Consulting on effort estimation for VDA ISA / TISAX certification
- Conducting a 2-day workshop including preparation and follow-up
- Skills: TISAX 5.1, ISO 27001:2022, auditing, information security, consulting, facilitation, presentation
Arndt Schürg
Last position:
Information Security Officer according to TISAX at Automotive Supplier
Matthias Fitzner
Last position:
Information Security Project Manager at Deutsche Bahn AG
- Introduction of a new Information Security Management System (ISMS) according to ISO/IEC 27001.
- Implementation of the cybersecurity guideline RL CySec-Rail for cross-border rail networks.
Discover over 15,000 top freelancers
Information Security Officers statistics
Aggregated from the professional profiles of matched freelancers.
Experience
26 years
Position duration
3.4 years
Positions per freelancer
14
Top business areas
Information Technology, Project Management, Legal
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Audit, Legal
Bachelor's degree or higher
87%
Master's degree or higher
61%
Doctorate
9%
Certifications per freelancer
8
Most common languages
German, English, French
Speak two or more languages
96%
Based on our profile pool as of 26 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this role in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates for Information Security Officers in Germany
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 26 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the role
Security leadership
An Information Security Officer sets the rules for how a company protects data, systems and access. The role turns security goals into clear policies, controls and operating routines that teams can actually follow.
- Define and maintain security policies, standards and procedures
- Run risk assessments and track remediation
- Support incident response and post-incident follow-up
- Align security work with legal, audit and business needs
Typical work
Freelance Information Security Officers are often brought in to close gaps fast, support a security programme, or steer a compliance project. They work across governance, awareness, supplier security and technical control reviews.
Common deliverables include:
- Security concepts and control frameworks
- Gap analyses and action plans
- Incident handling playbooks
- Audit evidence and management reports
- Security training material for staff and leaders
Skills and tools
Strong professionals combine policy thinking with practical judgment. They know how to talk to IT, legal, procurement and management without losing the detail that keeps a security plan credible.
- ISO 27001, risk management and control design
- Identity and access management, logging and backup basics
- Cloud, endpoint and supplier security review
- Clear documentation and stakeholder communication
They often work with security frameworks, ticketing tools, GRC systems, SIEM platforms and common cloud environments. In Germany, companies also value confident communication in English and, where needed, German for workshops and audits.
When freelancers help
A freelancer makes sense when the need is urgent, the scope is specific, or the internal team lacks senior security capacity. This is common during audits, post-incident hardening, new system rollouts, mergers or supplier reviews.
You may need an Information Security Officer if:
- Security tasks keep slipping between IT, compliance and management
- An audit or certification project needs structure
- A new platform, cloud setup or outsourcing project raises risk
- You need interim coverage before a permanent hire
What good looks like
A strong Information Security Officer is not only policy-driven. They are calm in incidents, precise in documentation and realistic about what the business can implement.
They ask for evidence, spot weak ownership and close the loop on actions. They also know when to escalate, when to simplify, and when to challenge technical teams on control gaps.
In Germany
In Germany, freelance support is often used by mid-sized industrial firms, software companies, regulated service providers and international teams with local operations. The best fit can work remotely for most tasks and come on-site for workshops, audits or crisis coordination.
Searchers may also use titles such as Information Security Manager, IT Security Officer or ISB. The scope is usually similar when the work covers governance, risk and incident preparedness rather than pure network security.
Frequently asked questions
Curious about Information Security Officers? Here are the answers that come up again and again.
A Information Security Officer sets up and runs the core security governance work for the company. That usually includes policies, risk reviews, incident handling, security awareness and audit support. On a freelance assignment, the focus is often on a clear outcome such as closing gaps, preparing an audit or stabilising the security programme.
A strong candidate needs practical knowledge of ISO 27001, risk management, access controls and incident processes. They should also write clearly, document decisions well and work with IT, legal and management without friction. If the role touches cloud or supplier security, they should be comfortable reviewing those environments too.
Not always, but the titles can overlap. A Information Security Officer often handles the operational and governance side of security, while a CISO usually has broader executive ownership and budget responsibility. In smaller companies, one person may do both sets of work.
A freelancer makes sense when the need is immediate, project-based or tied to a temporary gap. That is common for audits, certification work, incident recovery, cloud migrations or while a permanent search is still open. It is also useful when you need senior guidance without adding a full-time role yet.
Typical outputs include security policies, risk registers, action plans, incident playbooks and management reports. A Information Security Officer may also prepare audit evidence, run awareness sessions and document controls for internal stakeholders. The best freelancers leave behind materials your team can keep using.
Most of the work can be done remotely, especially policy drafting, risk reviews and reporting. On-site time in Germany becomes useful for workshops, interviews, incident coordination or audit days. A good freelancer can switch between both depending on the client setup.
Look for clear thinking, structured documentation and a track record of turning security topics into workable actions. A strong Information Security Officer does not only list risks; they explain priorities, owners and next steps. Ask for examples of audits, incidents or programmes they improved, and check how they handled stakeholder pushback.
An Information Security Officer usually covers governance, policy, risk and coordination across the business. An IT security specialist is often more technical and focused on systems, networks or tools. Many projects need both profiles, but they solve different parts of the problem.
The average hourly rate for Information Security Officers in Germany is 111 €, which corresponds to a daily rate of about 890 € based on an 8-hour working day.
Of the freelancers working as Information Security Officers in Germany, 87% hold at least a Bachelor's degree, 61% hold at least a Master's degree, and 9% hold a doctorate.
On average, freelancers working as Information Security Officers in Germany have 26 years of professional experience, with a single engagement typically lasting around 3.4 years.
The most common languages among freelancers working as Information Security Officers in Germany are German (100%), English (96%), and French (25%).
The most common industries among freelancers working as Information Security Officers in Germany are Information Technology (89%), Professional Services (75%), and Banking and Finance (54%).
The most common business areas among freelancers working as Information Security Officers in Germany are Information Technology (100%), Project Management (93%), and Legal (71%).
FRATCH Information Security Officers main locations
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
