BSI IT-Grundschutz Experts in Cologne
matched in minutes with vetted and available freelancersHire experts who establish information security management systems, create protection needs assessments and prepare audits against BSI IT-Grundschutz requirements. Get precise, fast access to vetted freelancers who are available for your project.
Meet FRATCH Experts in Cologne, who have recently used BSI IT-Grundschutz
Nikolaus B.
Last position:
Information Security, IS-Governance & Crossfunctional Governance at Zürich Beteiligungs-AG (Deutschland)
- Conducted security assessments for supplier qualification, business unit onboarding, and ongoing reviews of service providers and partners (Ongoing Assurance).
- Assessed technical and organizational measures (TOMs) against GDPR and information security requirements.
- Handled security reviews and approval processes in the Global Approval Navigator (OneTrust).
- Advised business units and IT on information security, security requirements, and risk-appropriate measures.
- Supported the development of SOC/SIEM processes and tools as part of the ISMS in line with ISO/IEC 27001.
- Analyzed cyber threats and coordinated security objectives and measures to address Security Findings with the SOC team.
- Monitored and assessed current security advisories and security-related metrics (KPIs).
- Reviewed, assessed risks, and approved exception requests (Security Exceptions).
- Independently analyzed and handled Security Events and supported the handling of security incidents.
- Planned and supported awareness initiatives to strengthen security awareness.
- Created, implemented, and reviewed information security policies and standards.
- Conducted protection needs analyses and gap assessments to identify security gaps and risk deviations.
- Defined and reviewed technical and organizational risk treatment measures.
- Advised on Third Party Governance with consideration of DORA, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, and BCM in line with ISO 22301.
Markus B.
Last position:
Consultant, Technical Project Manager at Lanxess
- Project: ESU Windows and SQL Server Consolidation / Configuration Management in ServiceNow
- Prepared an as-is analysis of all servers worldwide
- Prepared an as-is analysis of all SQL servers worldwide
- Conducted requirements analyses for SQL and server migrations
- Coordinated requirements with partners for migrations to Hyper-V (on-premises) or Azure Cloud
- Facilitated regular status meetings (Jour Fixe)
- Developed roadmaps and solution models for server migrations
- Set up test scenarios
- Facilitated workshops for the rollout of a global admin team
- Designed data models (CMDB) in ServiceNow
- Led workshops for the CMDB data model
- Developed solution models for the CMDB
- Created end-to-end configuration documentation and work instructions for the CMDB
- Prepared reports for license management
- Defined KPIs for data quality in ServiceNow
- Created a service catalog
- Facilitated workshops to define service requests
- Acted as interface between requirements analysis and the ServiceNow development team
- Systems used: Windows 7, Windows 10, Microsoft Office 365/2010, Windows Server 20xx, SQL Server 20xx, SharePoint, Azure Cloud, Hyper-V, ServiceNow, various tools
Jens R.
Last position:
Platform Architect & Senior Developer at Direct client, industrial measurement technology, medium-sized company
- Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
- Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
- Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
- Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
- Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
- Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.
Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin
Burhan D.
Last position:
Enterprise Architect & Solution Architect at DB Netz AG
With project PRIZMA, DB will modernize its infrastructure on the one hand, and develop a fail-safe IT landscape on the other hand, which can be restored quickly and securely in case of a disaster.
- Capture current architectures of existing systems as well as methodical consulting and development of target architectures
- Deepen and maintain the building plan / target IT landscape
- Implement technical architecture concepts & architecture descriptions
- Implement migration concepts for updating and further developing the platform and information systems
- Assess submitted improvement suggestions as part of the project
- Capability management: identify capability gaps, develop target visions, and support transformation planning within the enterprise architecture.
- Create a compatibility matrix of the components in use and compare dependencies of specific versions
- Create an IT concept for extending the platform with the following topics: hardware and software requirements, security, licensing, high availability, load balancing, backup & recovery, update strategy, monitoring integration, etc.
- Coordinate with business architects as well as technical architects from the cross-functional architecture area of the PRISMA program for the topics (backup, Active Directory, monitoring, Citrix, and business applications ...)
- Status meetings and alignment of project planning with the Release Train Engineer / Project Manager
- Advise the Release Train Engineer / Project Manager in identifying project risks
- Advise the System Architect Engineers in steering the implementation of the concept
- Implement the IT concept
- Document the infrastructure
Label: MS Project, LINUX, Windows, ORACLE, Java, REST, SharePoint, Microsoft Exchange, UML, Enterprise Architect, BPMN, AZURE, AWS, V-MODEL, Micro Service, VisualStudio, SAP S/4HANA, SCRUM(SAFE), ESB (TIBCO), Python, Innovator, LeanIX (TOGAF), Ansible, Ansible Tower, Ansible Automation, ROBOT, SpringBoot
Pierre G.
Last position:
Ansible Automation, Windows Third Level Support at DB InfraGO AG
- PRISMA project
- Ansible automation
- Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019
Ralph K.
Last position:
Product Owner / Business Owner at AXIS Management Consulting GmbH
- Full product responsibility from a business perspective: requirement analysis, UX design, product strategy, and go-to-market implemented without an internal dev team using fully AI-supported development (Claude Code / Anthropic)
- Technical differentiation: KRITIS-compliant air-gapped deployment (Windows/NSIS), GDT interface for PVS integration, DATEV-LODAS export for payroll
- Managed pilot operation with initial external client (Dormagen medical practice): structured requirement gathering, test support, error analysis, and release management
- Developed rollout and sales strategy for market entry in the segment of private practices and small medical centers
- Human-in-the-Loop development principle: business decision → AI implementation → manual review → approval → release – each sprint documented in Jira (TIME project), every change traceable via co-authored commits
- Product outcome: Tauri/Rust desktop app with GDT watcher, multi-tier model (Starter/Professional/Enterprise), cloud mirror on Hetzner/Traefik, complete ISMS framework based on ISO 27001 and BSI basic protection as product foundation
- Direct method validation for the test manager role: hands-on experience with quality assurance of AI-generated products from a user perspective, review gate discipline, release approval under GDPR and the EU AI Act
Valeri M.
Last position:
Associate Partner - Information Security Consulting at Insentis GmbH
- Improvement of the Information Security Management System (ISMS) based on ISO 27001, NIS2, DORA, B3S, TISAX and BSI IT Baseline Protection
- Conducting comprehensive gap analyses to identify gaps and derive action plans according to the above standards and regulations; management and KPIs
- Data Loss Prevention strategy and implementation using MS Purview
- Vulnerability and patch management, security monitoring
- Risk analysis and threat modeling using the STRIDE methodology
- Development of vendor risk assessments, implementation of risk classifications, conducting supplier assessments and implementing technical monitoring solutions (e.g. Security ScoreCard)
- Securing cloud environments (AWS and Azure); expertise in CSPM/CNAPP (Wiz), cloud migration, secure CI/CD pipelines, container security and best practices in AWS, Azure and Office 365
- Application security: penetration testing, DevSecOps, OWASP, pre-commit hooks, key and secret management, IDE plugins, static source code analysis, dependency checks, container scanning, vulnerability management, CIS benchmarks and compliance
- Security assessment and hardening according to CIS benchmarks and cloud conformity in AWS, Office 365 and Azure
Thomas U.
Last position:
Senior Consultant / PM Infrastructure Services & Workplace Migration at Freelance
- All Windows clients are managed in a hybrid, central AD
- Client standardization
- Implementation of information security policy requirements
- Development of new infrastructure services delivered as a managed service by a new provider
- New IT platform is a central and secure directory service
- M365 Azure AD
- MS terminal services
- Zscaler
- M365 cloud for workplace management
- PaaS / SaaS is procured through a new provider
Christian Michael M.
Last position:
Sponsor & Project Lead at WAITS Software- und Prozessberatungsgesellschaft mbH
- Sponsor of two spin-off products based on the AI and BPM tool BPMaaS, called “kionera” and “myATHENA”
- Defined project goals and developed product strategy
- Designed and built the kionera platform on shared or dedicated GPU servers using Docker and open-source LLMs
- Provided the API for custom applications
- Developed and designed managed services based on the BOC Group’s ADONIS BPM system
- Supported feature definition and planning of ADONIS/BPMN training
- Created a WordPress website with a subscription payment gateway
Tobias P.
Last position:
IT Consultant & Support at International asset management company
- Consulting on regulatory requirements in IT governance, IT security, KAIT, KAMaRisk & KAGB, ITIL, COBIT
- Development of emergency manuals and a BCM concept according to KAIT requirements, based on the BSI IT-Grundschutz standard 200-4
- Preparation of documents for the PwC audit
- Redesign of access management and risk management according to KAIT
- Administration, user management and setup of RE-VC
- Vendor management
- Establishment of filing structure and naming convention
- Change management including communication plan
Christian G.
Last position:
Deputy Chief Information Security Officer at Gothaer Solutions GmbH
- Deputy lead of the 10-member information security management team in a highly regulated environment (DORA, VAIT, BAIT)
- Direct reporting lines to the CIO of the Gothaer Group and the management board of Gothaer Solutions
- Regular member of the Group Risk Committee and the Compliance Committee
- Managing and coordinating information security processes within the company and with IT service providers
- Leading task forces for handling information security incidents
- Contributing to IT emergency and business continuity management
Klaus-Dieter K.
Last position:
Executive Partner at iAP-Independent Audit Professionals GmbH
Discover over 15,000 top freelancers
Statistics of experts using BSI IT-Grundschutz
Aggregated from the professional profiles of matched freelancers.
Experience
23 years (Germany: 24 years)
Position duration
2.7 years (Germany: 2.5 years)
Positions per freelancer
21 (Germany: 17)
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Healthcare, Banking and Finance
Certification focus areas
Information Technology, Quality Assurance, Project Management
Bachelor's degree or higher
71% (Germany: 85%)
Master's degree or higher
29% (Germany: 54%)
Doctorate
14% (Germany: 8%)
Certifications per freelancer
13 (Germany: 8)
Most common languages
German, English, Spanish
Speak two or more languages
92% (Germany: 94%)
Based on our profile pool as of 29 Oct 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology in Cologne are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates of experts in Cologne using BSI IT-Grundschutz
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 29 Oct 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
BSI IT-Grundschutz experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (83%)
- Healthcare (67%)
- Banking and Finance (58%)
- Insurance (58%)
- Manufacturing (58%)
- Government and Administration (50%)
- Telecommunication (50%)
- Aerospace and Defense (42%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
Framework and purpose
BSI IT-Grundschutz is the methodology of Germany’s Federal Office for Information Security for building and operating an information security management system. It combines organisational, personnel, technical and infrastructural safeguards with a structured risk-based approach. The method supports reliable protection of information, processes and critical services.
Standards and methodology
The framework is closely associated with the BSI Standards 200-1, 200-2 and 200-3. Specialists use these standards to establish an ISMS, perform a structured security analysis and assess risks where standard safeguards do not provide enough protection. The IT-Grundschutz Compendium translates the method into practical requirements for information domains and processes.
Typical deliverables
- Security concepts, policies and an information security organisation
- Structural analyses, modelling and protection needs assessments
- IT-Grundschutz checks, audit evidence and certification preparation
- Risk treatment plans, security reports and remediation roadmaps
- Business continuity, incident response and supplier security documentation
Ecosystem and adjacent skills
Effective work with IT-Grundschutz requires more than document production. Experts connect the methodology with identity and access management, network security, cloud controls, asset management, data protection and business continuity. They may also work with ISO 27001, NIS2 requirements, critical infrastructure expectations and established governance, risk and compliance processes.
When companies need specialists
Companies often bring in freelance expertise when an ISMS is being introduced, a certification project is approaching or an internal security team lacks capacity. External specialists are also useful after a major cloud migration, organisational change, security incident or scope expansion. In Cologne, projects may involve close coordination with regional industrial, logistics, healthcare, public-sector or financial organisations, while much of the evidence work can be completed remotely.
What strong professionals deliver
Strong specialists turn the BSI method into clear decisions and usable controls. They define an appropriate scope, document assumptions, involve process owners and distinguish mandatory safeguards from sensible risk treatments. Quality is visible in traceable evidence, realistic measures, consistent terminology and findings that teams can actually resolve. Cologne-based collaboration can add value when workshops, interviews or audit preparation require German-language communication and occasional on-site work.
Frequently asked questions
The facts hiring teams ask for most often when it comes to BSI IT-Grundschutz.
BSI IT-Grundschutz is used to establish, operate and improve an information security management system. It helps organisations identify important information and processes, assess their protection needs and implement suitable organisational and technical safeguards. The methodology can also support preparation for an IT-Grundschutz certification.
BSI IT-Grundschutz provides a detailed German methodology with practical building blocks, modelling guidance and defined safeguards. ISO 27001 focuses on the requirements for an ISMS and is widely recognised internationally. Organisations often combine both approaches: IT-Grundschutz supplies operational depth, while ISO 27001 can support international recognition.
BSI IT-Grundschutz work benefits from knowledge of ISO 27001, risk management, data protection, cloud security, identity management and business continuity. Familiarity with the BSI Standards 200-1, 200-2 and 200-3 is important. Experience with audit evidence, supplier assessments and security governance can be equally valuable.
For a narrow policy review, a professional familiar with BSI IT-Grundschutz may be sufficient. A new ISMS, certification preparation or complex scope requires someone who has led modelling, protection needs assessments, risk treatment and evidence collection. Ask for comparable deliverables and references to the type of organisation involved.
BSI IT-Grundschutz projects are often suitable for remote collaboration because much of the work involves interviews, documentation, analysis and review sessions. On-site workshops can still help with facility assessments, process mapping and stakeholder alignment. In Cologne, clarify the expected balance of remote work, travel and German-language communication before the project starts.
A strong BSI IT-Grundschutz professional creates a clear scope, links safeguards to real assets and processes, and records evidence that an independent reviewer can follow. The documentation should distinguish gaps, risks, owners and remediation priorities. Vague policy text without operational proof is a warning sign.
BSI IT-Grundschutz can be applied to cloud and hybrid environments when responsibilities between the organisation and service providers are documented clearly. The assessment should cover identities, interfaces, configurations, logging, resilience, data locations and supplier controls. A specialist should connect cloud evidence with the organisation’s wider ISMS rather than treating the provider report as complete proof.
Before starting BSI IT-Grundschutz work, clarify the target scope, current ISMS maturity, desired outcome and available internal contacts. Confirm whether the assignment covers implementation, audit preparation, certification support or remediation. It is also useful to agree on evidence standards, collaboration routines, access requirements and the expected role in stakeholder workshops.
The average hourly rate of freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects is 135 €, which corresponds to a daily rate of about 1,078 € based on an 8-hour working day.
Of the freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects, 71% hold at least a Bachelor's degree, 29% hold at least a Master's degree, and 14% hold a doctorate.
On average, freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects have 23 years of professional experience, with a single engagement typically lasting around 2.7 years.
The most common languages among freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects are German (100%), English (92%), and Spanish (8%).
The most common industries among freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects are Information Technology (83%), Healthcare (67%), and Banking and Finance (58%).
The most common business areas among freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects are Information Technology (100%), Project Management (100%), and Quality Assurance (83%).
Main locations of FRATCH Experts, who have recently used BSI IT-Grundschutz
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich 
Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Berlin 
Munich 
Frankfurt 
Dusseldorf 
Essen Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
