BSI C5 Experts in Germany
matched in minutes from vetted, available specialists with the power of AI.Hire experts who prepare C5 control mappings, evidence packs, gap analyses, and cloud security documentation for audits and customer reviews. FRATCH matches you fast and precisely with vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used BSI C5
Frédéric Klein
Last position:
Project Manager (Enterprise Cloud Governance) at CompuGroup Medical SE & Co. KGaA
Short description: Leading a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations management while preserving the autonomy of decentralized business units within regulatory frameworks.
Tasks and activities:
Overall responsibility for designing, building, and implementing a company-wide cloud governance structure (Azure), including target picture, roadmap, and operating model.
Managing internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps), including decision and escalation management.
Planning and facilitating workshops on cloud strategy, governance principles, and the design of areas such as identity, connectivity, and platform management.
Defining, implementing, and rolling out cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).
Building a cloud governance framework based on the Azure Cloud Adoption Framework (CAF), including landing zone and guardrail concepts.
Introducing automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).
Implementing cloud security and compliance monitoring mechanisms as well as continuous improvement processes.
Establishing and operationalizing FinOps in an enterprise environment (central and decentralized FinOps teams), including cost management strategies, reporting, and guardrails.
Integrating governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).
Implementing access concepts including RBAC design and breaking-glass mechanisms (emergency access) as well as certificate automation (ACME / step-ca).
Achievements:
Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud use in a regulated environment.
Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risk.
Improved operational and decision-making capability across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).
Significantly increased workload compliance during lift-and-shift migrations.
Technologies used:
Microsoft Azure Policy, custom policies.
Terraform, OpenTofu, Terragrunt.
step-ca (ACME).
Entra ID.
Azure Firewall.
Azure Networking, hub-and-spoke architecture.
Azure vWAN (evaluation).
Azure Front Door, Azure Application Gateway.
Azure ExpressRoute.
Azure Key Vault.
NetBox.
GitLab (on-premises).
Infrastructure, concepts used:
Cloud shared responsibility model.
Hub-and-spoke connectivity / central shared services (from hub-spoke context).
Central governance with decentralized delivery (business unit autonomy with guardrails).
Methods used:
Scrum.
Stakeholder management (C-level to engineering).
Cloud governance, Azure Cloud Adoption Framework (CAF).
DevOps, CI/CD.
Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.
RBAC, breaking-glass concepts.
ACME / certificate automation.
GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.
Tobias Nawa
Last position:
Enterprise & Solutions Architect
- Building an independent enterprise IT setup — cloud strategy, network, AWS landing zone, security requirements, contract negotiations.
- Migration of all applications; avoiding high contractual penalties for the client.
- Onboarding and coordination o...
Hakan Kisa
Last position:
Senior IT Manager & Project Manager at SHE Information Technology AG
- Managing complex infrastructure initiatives (digital transformation, cloud migration from OpenStack to MS Azure, BSI C5 compliance) including cost control and optimization across multiple business units.
- Leading a strategic cloud transformation project for an end customer to ensure scalability, compliance, and business impact, including budget, schedule, and scope planning.
- Leading interdisciplinary teams in operational and project environments to deliver innovative, scalable, and secure IT infrastructures.
- Implementing agile processes and ceremonies to foster innovation, continuous improvement, and increase adaptability within the IT organization.
- Strategically planning and managing resources, budgets, and milestones, while actively communicating with clients and stakeholders.
Federico Leefhelm
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developed and implemented a holistic process view covering both technical and organizational aspects Ensured end-to-end control of all IAM-related technical services Established clear responsibilities and accountabilities within the IAM landscape Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security Introduced and monitored governance policies to ensure compliance and security Continuously improved IAM processes and systems through regular audits and evaluations Participated in external audits of the process as part of official ISO audits Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units Conceptually advanced the KPI system to measure process quality
André Beran
Last position:
External Attack Surface Assessment & Cybersecurity Readiness Checks at Graydaxe Cybersecurity GmbH
- Conducting cybersecurity readiness checks based on an in-house assessment methodology
- Analyzing the external attack surface using the Graydaxe EASM platform
- Assessing maturity levels and deriving prioritized recommendations for action
Yannick Tessa
Last position:
Cloud Architect at Anonymous
- Implementation of Infrastructure as Code (IaC) with Terraform to ensure a scalable, repeatable, and secure Azure infrastructure
- Implementation and optimization of CI/CD pipelines with Azure DevOps
- Management of container and server environments and AKS
Kai Sieveke
Last position:
Demand Manager, Analyst, Process Consultant
- Integrating system architecture, business analysis, requirements engineering, and process consulting
- Managing business unit needs toward IT and implementation
- Capturing requirements in JIRA and breaking them down into epics
- Overseeing internal projects and programs, including stakeholder management and reporting
- Handling requirements from traditional IT developments to IoT integrations and SAP subsystem replacements
- Implementing current legal regulations (MAKO, EnWG, EEG, GWG, StromGVV, GasGVV, StromNEV, GasNEV)
- Applying agile methods (Agile, SAFe, ITIL, Scrum, Kanban, DDD, IaC, CI/CD, DevOps, automation, ETL, OOA, OOD, MDA, BPMN, BPM, UML, marketing automation, data science, ML, AI, GenAI, LLMs)
- Using tools like JIRA, SharePoint, MS Office, MS Project, MS Dyn CRM, VMware ESX/ESXi, BSI IT-Grundschutz, BSI C5, NIST, MS Azure, Typo3, mail automation, Docker, Kubernetes, OpenStack, OpenShift, Terraform, Ansible, SQL, REST, SOAP, Git, GitLab, LoRaWAN, SAP IS-U, S/4HANA, USU, KUGU, AbSys, sensors, MQTT
Bernhard Bowitz
Last position:
Senior Security Architect at Intermediate Beratung
- Consulting on an ongoing IT security architecture project
- Documenting past progress and planning next steps
- Applying and implementing the BSI IT baseline protection
- Building and maintaining security management systems
- Applying the ISO 27001 standard series
- Integrating ITIL processes into security architectures
- Collaborating with public clients, regulatory authorities and internal and external service providers
Mike Barthel
Last position:
System and Endpoint Hardening at CLAAS
- Evaluating and assessing the current state
- Preparing and conducting security audits
- Vulnerability characterization and risk analysis
- Assessing, coordinating and transforming identified vulnerabilities into target states
- Coordinating stakeholder interests
- Developing and implementing IT security strategy for OT and IoT (continuous risk assessment and risk management, awareness, multi-layered security solutions, regular security audits, access restrictions)
- Organizational and technical documentation, presentations and workshops
- Skills: Qualys, Splunk, Nessus, QRadar, National Vulnerability Database (NVD / NIST), Open Worldwide Application Security Project (OWASP), OT, CERT/CC, BSI IT-Grundschutz catalogs, ISO 27001, MITRE ATT&CK, Center for Internet Security (CIS), GitHub, Active Directory, PowerShell, Symantec Endpoint Protection, Microsoft Azure and Office365 App Security, ITSM
Carsten Weinmann
Last position:
Managing Consultant - IT Outsourcing-Services (IT, Voice, Data) at Bank / insurance group (Savings Banks Group)
- Transforming complex AI use cases into practical solutions
- Analyzing IT/telecom end-to-end business processes from requirements to order (RACI), modeling with IBO Prometheus
- Risk management
- Assessing digitalization potential, AI, and strategic supplier analysis against the IT target picture
- Optimizing offer and cost calculation bases in strategic and operational IT procurement
- Optimizing supplier strategy (DSGV and financial institutions)
- Exploring various approaches to cost optimization and simplifying supplier management
- Optimizing contracts and licensing management (e.g., SAP, Microsoft, IBM, Cisco, BMC, etc.)
- Desk and field expediting with external partners
- Possible outsourcing and consolidation of services with fewer suppliers
- On-time handover of work packages within agreed time and budget
Daniel Jüntgen
Last position:
Information Security Consultant
- Enhanced quality assurance of documents, processes and required evidence in preparation for the upcoming KRITIS audit 2025.
- Reviewing and commenting on all relevant documents.
- Advising authors and document owners on inquiries and during the creation process.
- Supporting departments with IT security inquiries.
- Used tools/Frameworks MS Office, SharePoint, Jira, Confluence, ISO27001+, NIS-2 (EU 2022/2555), B3S (Statutory Health & Private Health Insurance), BSIG / IT-SIG 2.0, BSI-KritisV, BSI-C5, BSI Baseline Protection (200-2, 200-4), ServiceNow, RCE (EU 2022/2557), SGB, GDPR
Hauke Wollentin
Last position:
Process Automation Engineer at German Edge Cloud / WIIT AG
- Re-designing and implementing the incident management process into Jira
- Implementing the business impact analysis in Jira
- Developing Slack and StatusPage integration in ScriptRunner for Jira
- Mapping of business processes into Jira
- Implementing the service catalogue in Jira, based on Assets as "database" and Jira tickets + SR behaviours as UI for users
- Helping teams with automations, workflows and screens to save time and nerves while using Jira
- Helping teams to perform agile transformations
- Creating a Jira and Confluence based foundation for compliance frameworks and HauckeretifiBcrautinoonsWlikeolIlSeAnEti3n402 and BSI C5
- Atlassian Stack administration
Markus Willems
Last position:
KRITIS Consultant at Oil Company
- Preparing an oil company for KRITIS auditing
- KRITIS consulting
- Creating necessary policies, processes, and guidelines in line with KRITIS requirements
- Tools and methodologies used: ISO/IEC 27001, BSI IT Baseline Protection, KRITIS-V
Discover over 15,000 top freelancers
Statistics of experts using BSI C5
Aggregated from the professional profiles of matched freelancers.
Experience
24 years
Position duration
1.3 years
Positions per freelancer
23
Top business areas
Information Technology, Project Management, Product Development
Top industries
Information Technology, Banking and Finance, Manufacturing
Certification focus areas
Information Technology, Audit, Project Management
Bachelor's degree or higher
80%
Master's degree or higher
60%
Doctorate
20%
Certifications per freelancer
13
Most common languages
German, English, French
Speak two or more languages
100%
Based on our profile pool as of 30 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Germany using BSI C5
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 30 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the technology
What C5 covers
BSI C5 is the German cloud security catalog from the Federal Office for Information Security. It helps companies assess how a cloud service handles security, availability, data protection, and operational controls. Work with it when you need clear evidence for customers, auditors, or internal risk teams.
Where it is used
- Cloud vendor security reviews and due diligence
- Audit preparation for C5 reports and control evidence
- Security questionnaires for enterprise sales
- Mapping controls to ISO 27001, SOC 2, and internal policies
- Documentation for regulated buyers in Germany
Skills that matter
Strong BSI C5 specialists know cloud architectures, control design, and audit evidence. They can translate technical settings into clear statements, map responsibilities between provider and customer, and spot missing artifacts before review cycles start. They also work well with security, legal, and compliance teams.
What good delivery looks like
A solid engagement usually produces gap analyses, control matrices, policy updates, and evidence packs. For BSI C5, that also means clean traceability from the control requirement to the implemented process or system setting. The best professionals write in precise language and keep the review path simple.
When to bring in freelance help
Companies bring in freelance expertise when an internal team is busy, a sales deal needs cloud security proof, or a provider wants to formalize its C5 posture. In Germany, this is common for SaaS, hosting, and managed cloud services that face customer security questions. Remote work often fits well, with on-site sessions reserved for workshops and evidence collection.
How to evaluate specialists
Look for people who have worked with the C5 catalog itself, not just general cloud security. Ask for examples of control mapping, evidence handling, and how they resolved gaps across AWS, Azure, Google Cloud, or private cloud setups. Clear documentation, structured thinking, and calm coordination matter more than jargon.
Frequently asked questions
The facts hiring teams ask for most often when it comes to BSI C5.
BSI C5 is used to assess cloud security controls in a structured way. Companies use it to support vendor reviews, audit preparation, and customer due diligence when cloud services store or process sensitive data.
C5 focuses on cloud-specific control requirements, while ISO 27001 is a broader information security management standard and SOC 2 is a report format often used for trust assessments. Many companies use C5 alongside those frameworks to show cloud buyers a more direct control mapping.
A strong BSI C5 freelancer understands cloud architecture, security controls, and evidence collection. They should be able to map technical settings to catalog requirements and explain the result in language that security, audit, and legal teams can use.
BSI C5 work often goes together with ISO 27001, cloud security architecture, privacy documentation, and risk management. Familiarity with AWS, Azure, Google Cloud, or private cloud environments helps because the controls must be tied to real services and settings.
A BSI C5 project needs someone who has handled real control reviews, not just read the catalog. Smaller gap assessments can be done with a focused specialist, while provider-side preparation usually needs someone who can coordinate several teams and document evidence carefully.
Most C5 work can be done remotely because the key tasks are interviews, document review, and control mapping. On-site sessions in Germany can still help when teams need workshops, system walkthroughs, or faster access to internal evidence.
Ask how the BSI C5 freelancer handles gap analysis, evidence requests, and control ownership. It also helps to ask which cloud environments they have reviewed and how they keep documentation usable for both security and commercial teams.
Good C5 output is specific, traceable, and easy to review. The best deliverables show each control, the evidence behind it, the remaining gaps, and the next step without vague wording or extra noise.
The average hourly rate of freelancers in Germany who have used BSI C5 in their recent projects is 115 €, which corresponds to a daily rate of about 921 € based on an 8-hour working day.
Of the freelancers in Germany who have used BSI C5 in their recent projects, 80% hold at least a Bachelor's degree, 60% hold at least a Master's degree, and 20% hold a doctorate.
On average, freelancers in Germany who have used BSI C5 in their recent projects have 24 years of professional experience, with a single engagement typically lasting around 1.3 years.
The most common languages among freelancers in Germany who have used BSI C5 in their recent projects are German (100%), English (92%), and French (31%).
The most common industries among freelancers in Germany who have used BSI C5 in their recent projects are Information Technology (100%), Banking and Finance (69%), and Manufacturing (69%).
The most common business areas among freelancers in Germany who have used BSI C5 in their recent projects are Information Technology (100%), Project Management (100%), and Product Development (92%).
Main locations of FRATCH Experts, who have recently used BSI C5
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
