BAIT Experts in Frankfurt

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

2nd LoD/Change the Bank (CtB)

• CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).

• Management and optimization of a portfolio of about 100 projects (launches, in-field solutions, data & analytics, digital solutions, digital products)
• Optimization of the existing project standard (playbook) and alignment with the European and global organization (USA)
• Coaching project managers on setup, planning, cooperation with business, GDPR, GxP, data security and launches
• Preparing projects for works council information and project closeout communication
• Optimization of resource management (tracking, allocation, prioritization)
• Taking over individual project leads (off-/transboarding, event management, checking whether WhatsApp is allowed on a business smartphone)
• Supporting the hiring of external project managers
• Optimization of meeting structure, project controlling (KPIs), change and demand management
• Optimization of risk, issue, dependency and quality management and support during internal audits (GxP)
• Optimization of the portfolio steering tool (Smartsheet) on national, European and global level
• Design and implementation of a Business Value Complexity Scoring
• Building a strategic PMO with a sister department and optimizing cross-functional teams
• Reporting, communication and escalation at management level
• Leadership coaching for several future leaders (short-time assignment)
• Development of the concepts "PPM as a Service" and "Internal Customer Approach"
• Development and review of a concept "AI Data Governance" including roles and processes
• Selection and onboarding of the successor

• Devised a new Domain-Driven Design architecture for a core system: reverse-engineered a central component, refactored the data-access layer to minimise database round-trips (improving scalability) and migrated processing to async.
• Decomposed the platform into independent .NET Core microservices (database-per-service) with RabbitMQ pub/sub using the Outbox Pattern + Saga choreography, behind an Ocelot API Gateway (JWT, rate limiting, CORS, health checks).
• Delivered on .NET Core / Angular / SQL Server / EF Core with Docker and Azure DevOps CI/CD; implemented health checks and CORS; contributes technical designs for stories in agile Scrum.
• Sole ADR owner; mentored 3 engineers and presented architecture decisions directly to the Director of Corporate IT.

• Design and global rollout of sensitivity labels (confidentiality labels) for automated classification and encryption of business-critical data.
• Definition and rollout of Data Loss Prevention (DLP) policies to protect IP and personal data across endpoints, Exchange, SharePoint, Teams, and non-Microsoft clouds.
• Setup of Insider Risk Management policies to detect and contain excessive data leaks and risky user behavior.
• Implementation of GDPR and retention requirements through automated retention policies and structured records management.
• Technical support for legal teams in internal and external investigations using eDiscovery (Standard/Premium) and Content Search.
• Continuous improvement of the security and compliance level by reviewing the Microsoft Compliance Manager and closing gaps (regulations such as ISO 27001, NIS-2)

• Delivery of ICT / DORA management training under DORA Article 5(4) at various banking institutions

• Teaching the key content of DORA requirements with a focus on ICT risks, third-party risk management, incident and problem management, and the information register

• Deriving implementation measures and recommendations for management and business units

• Supported the International Web Presence project of the Federal Employment Agency (IntWeb) in quality management, taking on responsibility for the quality of processes and project deliverables while adhering to BA standards. The project's main goals are to give professionals abroad a quick overview of their chances to move to Germany and to enable them to take the necessary steps in a consistently digital way.

• Set the fundamental guidelines using the QA handbook

• Summarized test results in QA reports for PLA

• Analyzed project outcomes for improvement opportunities

• Quality management of requirements analysis (especially processes, methods and tools)

• Ensured compliance with SERA guidelines

• Created a cross-project test concept

• Agreed on sprint completion reports

• Conducted formal reviews of deliverables according to guidelines and/or project plan

• Acted as contact person for internal audit and external audits by auditors or the Federal Audit Office (BRH)

• Technologies: JIRA, Confluence, MS Office, GitLab, Kubernetes

• Managing TPA Manager and a team of 10 Claims Operation Assistants.

• Designing and implementing processes and workstreams using Guidewire from the ground up with European claims teams across all lines of business.

• Establishing service level agreements (SLAs) and detailed key performance indicators (KPIs) with new business intelligence (BI) reporting, payment and performance analysis.

• Developing, steering and analysing 50+ strategic, operational and IT initiatives, driving digital change and AI automation in payments while meeting DORA, GDPR, ACM and BAIT MaRisk regulatory compliance.

• Increasing customer satisfaction scores by 80%.

• Attracting and mentoring market-leading operational and TPA talent.

• Demonstrating strong stakeholder leadership and swift decisional influence.

• Recognition of national notified bodies
• Preparation of cybersecurity competency reports
• EU Radio Equipment Directive

• Project management
• Coordination of the rollout of 148 firewalls (Palo Alto) for 74 buildings at more than 14 locations in EMEA
• Management of the team (8 employees)
• Communication with senior management (local) and site managers (EMEA)
• Ensuring work packages were completed on time and according to requirements, including formal acceptance
• Extensive use of the relevant Microsoft tools
• Wrike (project management)

• Project manager controlling the update to ISO 27001:2022 (certification from ISO 27002:2013 to ISO 27002:2022) including gap analysis, project planning, preparation of internal and external audits, and creation and maintenance of required documentation.
• Coordination of adjusting existing measures and implementing new measures according to the new standard’s requirements, as well as continuous monitoring and adjustment of these measures.
• Regular reporting to management on progress and risks.
• Senior consultant supporting audit reviews with a focus on critical infrastructures (KRITIS), including resolving findings, creating and updating evidence documents, and amending provider contracts.
• Senior consultant reviewing all deliverables and responsibilities of the IT provider according to the existing contract: identification of over 1500 deliverables & obligations (D&O), setup of a D&O tracker (claim register), and joint expert review with service owners for various service descriptions (e.g. IT service management, workplace and print services, application and desktop services, endpoint management, email including archiving, file services, software packaging, certification, distribution).
• Senior consultant adjusting service scopes in existing service descriptions to enable end-to-end service responsibility of the provider, including identification and analysis of use cases, process analysis and optimization (incident, problem, change), as well as recording and documenting all software products in LeanIX and documenting the contract change.
• Focused services: managed software service, application and desktop service, workplace and print services, web server service, container service, M365, SAP/Oscare, output management systems (OMS), telephony and omnichannel management service.
• Project manager steering a benchmark based on the existing IT contract, including coordination of the entire benchmark process between the benchmarker, IT provider and client, review of benchmark results, and preparation and conduct of price negotiations with the IT provider.

• General CTO responsibilities (architectural design, operational setup, external runtime product evaluation, investor buy-in, regulatory compliance).
• Software development oversight (implementation on deep-dive-in) plus workflow design.
• Product co-ownership.
• Tech/tools/frameworks: proprietary software (Java, JavaScript), Kubernetes, Postgres, MiniIO, Ollama (internal), several xAI API (external), OpenTofu (Terraform), Keycloak, Kafka, Prometheus, ELK Stack, GitHub, GitHub Workflows, Argo CD, ISO 27001, BSI-ISM, EU AI Act.

• The replacement of the existing archive system (document management system – DMS) on a host-based platform is well advanced.

• The internal audit is meant to ensure the company's quality standards.

• GDPR

• ISO 27001 ff.

• BSI

• DORA

• Patient data regulations

• Host / Cloud / S3 / Container / highly scalable / Nuxeo

• Budget: 50,000

• Team: 1

• Business analysis of payments for the introduction of Wero EPI in Germany.
• Analysis and optimization of merchant processes in the context of acquiring and issuing.
• Analysis of interfaces for instant payments.
• Analysis of SCT-Inst processes, settlement mechanisms and reporting processes.
• Identification and clarification of gaps in merchant processes.
• Analysis and documentation of clearing and settlement processes.
• OSPlus process analysis and documentation.
• Coordination and alignment with scheme management as well as various payment service providers and financial institutions on merchant processes.
• Preparation and follow-up as well as active participation in EPI meetings on technical coordination and regulatory topics in payments, including content familiarization and prioritization.
• Preparation and documentation of project and steering committees in the EPI environment.
• Creation of status reports for the subproject.
• Maintenance and structuring of Confluence pages for project documentation.
• Coordination and alignment with the issuing teams on individual customer processes as well as aligning with bank processes and acquirer processes in the Wero environment.
• Communication with payment service providers regarding merchant and bank processes in the Wero environment.
• Organizational support for project management in special tasks in the EPI and Wero environment.
• Digital filing and documentation in Confluence and Microsoft Teams.
• Planning, implementation and tracking of work packages and steps.
• Quality assurance and project control.
• Consulting on IT strategy, IT architecture and interface management in the EPI and Wero environment.
• Technical environment: Jira, Confluence, XML, JSON, MS Office (Word, Excel, Teams, PowerPoint), SharePoint, Draw.io, Innovator, 3rd-level support, ITIL, creation and updating of software documentation, interface management, OSPlus, Scrum, KYC, payment, European Payments Initiative (EPI), Wero, Microsoft Loop, Instant Payments, SCT-Inst.