Audit Management Experts in Germany

• Develop custom AI agents delivering 90%+ reduction in manual workload and significant efficiency gains
• Provide end-to-end AI strategy consulting: from digital assessment to implementation and change management
• Design and deliver tailored training programs and workshops on AI adoption, prompt engineering, and automation
• Support clients in implementing scalable AI solutions integrated with existing technology stacks
• Focus areas: AI strategy, automation, workflow optimization, and capability building

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Developed backend for Audit Management Tool using Node.js/Express with Workday API integration.
• Built secure file handling (PDF, PPT, CSV) with AWS S3 and database support via PostgreSQL, Prisma, and MongoDB.
• Implemented validation, role-based access, and audit trails for compliance and data integrity.

• Complete overhaul of the ISMS according to ISO 27001
• Conducted a comprehensive gap analysis
• Reduced ISMS documentation by 30% through consolidation and process optimization
• Introduced a full PDCA cycle for continuous improvement
• Established the ISMS within the company
• Implemented the necessary processes
• Managed and conducted internal and external audits
• Developed and implemented a company-wide risk management system
• Deployed an ISMS tool including process design and training
• KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
• NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
• Led a cybersecurity team of 3 members
• Conducted various internal and external audits, managed providers, introduced continuous improvement
• Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
• Redesigned the security architecture, reducing administrative efforts by 20%
• Implemented ITIL processes (e.g., change management)
• Revised service agreements with internal and external providers
• Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
• Managed a budget of one million euros

• Responsibility for 47 franchise partners in Europe and the USA
• Management of operational processes, budgeting and audits
• Network expansion and strategic development
• Direct collaboration with executive management
• Leadership of organizational units with up to 578 employees

As part of the preparation and operational support of a business succession:

• Company analysis: Analysis of the overall economic, organizational and structural situation (current state, strengths/weaknesses, risk potentials)
• Process analysis: Recording and documentation of all relevant business processes (BPMN, UML) in the areas of management, finance, procurement, sales and operations
• Process optimization: Identification of weaknesses and inefficiencies, development and operational implementation of improvement measures
• Stakeholder management: Identification and analysis of all relevant internal and external stakeholders; structured communication and coordination with previous and future owners, shareholders and employees
• Change management: Supporting the workforce and management through the handover process; building acceptance and trust among all participants
• Governance & documentation: Creation and handover of structured operation manuals, process documentation and organizational handbook for the new business owner
• Risk & vulnerability analysis: Assessment of operational and strategic risks in the handover process and development of recommended actions
• Operational support: Interim takeover of leadership tasks; ensuring business continuity during the transition phase

• responsibility for product, process & service quality: APQP, PPAP, FMEA, MSA, SPC, PLP including change management as well as NC & CAPA management.

• expanded QM system scope to include service; systematic review of all production control plans regarding reliability.

• logistics process optimization using Lean Six Sigma; concept development, rollout, and training of all responsible stakeholders.

• optimization of the complaint process with RMA, FA, and 8D process; reporting of quality performance.

• introduction & coordination of Standardized Supplier Quality Assessment (SSQA) for maturity assessment and further development.

• implementation of Brooks Process Certification with PQP, 5S, Safety, audits, and annual audit plan including follow-up actions.

• achievements: improved product & refurbishment reliability by 25%; reduced turnaround time for failure analysis by 60% and complaints by 55%; improved the SSQA maturity score by 2.8 points.

• Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
• Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
• Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
• Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
• Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
• Implement continuous monitoring solutions to detect and respond to threats in real time.
• Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
• Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
• Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
• Collaborate with project teams to address findings and ensure that security risks are managed effectively.
• Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
• Facilitate a culture of security awareness throughout the organization through training and regular communication.
• Lead security initiatives that align with the organization’s long-term strategic goals.
• Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
• Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

• Recognition of national notified bodies
• Preparation of cybersecurity competency reports
• EU Radio Equipment Directive

• Functioned as a Fractional CIO for the GCC's largest gaming distributor, leading a complete IT transformation infrastructure upgrade and outsourcing of IT services and ERP applications
• Oversaw the development and rollout of two CEO-sponsored business systems with a $40 million budget, including the implementation of a comprehensive Hydrocarbon Accounting System (Tieto) and a Supply Chain Management System integrating seven multi-vendor applications across Qatargas, Rasgas, and Qatar Petroleum
• Led Schlumberger's global outsourcing, securing a $350 million deal over five years with a 15% cost reduction, managing a global team of over 30 and implementing operational models and frameworks for chargeback, procurement, and IT management
• Navigated technically intricate and organizationally demanding projects for prestigious companies worldwide across more than 30 countries, leading diverse teams and driving strategic innovation

• AI forensics
• AI output audits
• Concept decoding
• Narrative reframing
• Hypothesis stress testing
• AI behavior and bias analysis
• Integrating artificial intelligence as a living collaborator inside real workflows to turn raw potential into applied intelligence
• Combining human judgment with machine capability to make work clearer, faster, and wiser

• Prepared and reviewed finished product and raw material specifications as per USP, BP, EP, IP, and in-house standards.
• Developed and reviewed SOPs, analytical method validation and transfer, and comparative dissolution studies.
• Reviewed stability, DMF, and cleaning validation documents; resolved regulatory queries.
• Supported QA and RA departments to ensure compliance with GMP and site audit readiness.

• Leading and building integrated management systems (IMS) for quality (QMS), data protection and information security (ISMS), risk (GRC), and artificial intelligence (AI) in accordance with ISO 9001, ISO 27001, ISO 42001, ISO 21500, ISO 21502, ISO 37301, ISO 31000
• Governance, project, and transformation management nationally and internationally incl. enterprise and project governance
• Process development, optimization, and business process reengineering according to BPMN 2.0, Kaizen, IATF 16949, VDA, BPMN 2.0
• Compliance and risk management in the company and project context as well as connection to internal control systems (ICS) and Group Risk Compliance (GRC)
• Carrying out and leading internal audits and lead audits according to ISO 19011; audit management and test equipment / special equipment management
• Methodical and systemic coaching (IFS, Hakomi) as well as conflict moderation and change management
• Designing and delivering AI trainings, prompt engineering, and AI literacy workshops
• Advising on data protection impact assessments (DPIA), implementing EU GDPR, BDSG, and IT-SiG as well as NIS-2 and DORA
• Building and leading Program Management Offices (PMO) and introducing Project Management Office structures
• Contract management, clause-by-clause analyses, and project controlling according to PMI® standards incl. Earned Value Management
• Building knowledge, document, and content management systems (Confluence, SharePoint, EY iManage)

• Perform validation or qualification tests on new or existing processes, IT modules, equipment, Clinical trial software in compliance with internal norms or external standards.
• Resourceful in reviewing various documents, including VMP, URS, System Requirement Specification (SRS) and/or Functional/Technical Specification, Design Qualification (DQ), Risk Assessment (RA) with ALCOA CCEA, IQ, OQ, PQ, Traceability Matrix (TM), Compliance Report (CR), and Validation Summary Report (VSR), in accordance with regulatory requirements and quality management systems.
• Perform testing activities with Microfocus ALM and handle faults and deviations.
• Familiar with regulatory standards (such as FDA/GxP, records management, and disaster recovery).
• Proven expertise in risk management, FMEA, audit management, and periodic compliance reviews.
• Proficiency in change management and control procedures, deviation management, incident management, and CAPA escalation.
• Implementing a Quality System to meet GxP standards and ensure regulatory compliance through inspections, data review, and training.
• Conduct internal audits on processes and systems, prepare for external audits, and verify compliance with internal standards and SOPs.
• Develop and review SOPs and papers in accordance with regulatory norms.
• Organized and reviewed cGMP training records.