BSI IT-Grundschutz Experts in Cologne
matched in minutes with vetted, available freelancersHire experts who establish information security management systems, conduct structural analyses and prepare organisations for BSI audits. FRATCH connects you with precisely matched, vetted and available freelancers for remote or on-site work in Cologne.
Meet FRATCH Experts in Cologne, who have recently used BSI IT-Grundschutz
Jens R.
Last position:
Platform Architect & Senior Developer at Direct client, industrial measurement technology, medium-sized company
- Technical leadership across hardware, firmware, and software teams; scope: hardware/firmware team (4 people) and leadership group (5 people)
- Consolidated and documented a product family that had grown over more than 15 years and aligned it with CRA compliance — from the bare-metal I/O module to the cloud interface.
- Provided the most important customer product with the essential requirements and architecture documentation within two months — for a firmware landscape that had grown over more than 15 years. It now supports the customer’s modernization strategy.
- Established a monthly reporting line to the supervisory board and executive board within three months: nine meetings since 12/2025. The report itself is versioned and built from the CI pipeline; it is based on automatically collected activity and release data instead of assessments.
- Built a container-based CI/CD infrastructure from scratch: cross-compilation, host tests, and documentation builds in one continuous pipeline.
- Introduced declarative QA gates for DevOps and development artifacts — from the start using lefthook instead of pre-commit, executed in a dedicated container image.
Technologies used: arc42, req42, tpo42, docToolchain, PlantUML, ArchiMate, C4 model, ADR, C, C++ (GTest), CMake, Bare Metal (ARM Cortex-M3/M7), OCI containers, Jenkins, lefthook, Prometheus, Grafana, SBOM, CRA, OPC, SCADA, PLC integration, IPv6 migration, Zero Trust, Sociocracy 3.0, Cynefin
Burhan D.
Last position:
Enterprise Architect & Solution Architect at DB Netz AG
With project PRIZMA, DB will modernize its infrastructure on the one hand, and develop a fail-safe IT landscape on the other hand, which can be restored quickly and securely in case of a disaster.
- Capture current architectures of existing systems as well as methodical consulting and development of target architectures
- Deepen and maintain the building plan / target IT landscape
- Implement technical architecture concepts & architecture descriptions
- Implement migration concepts for updating and further developing the platform and information systems
- Assess submitted improvement suggestions as part of the project
- Capability management: identify capability gaps, develop target visions, and support transformation planning within the enterprise architecture.
- Create a compatibility matrix of the components in use and compare dependencies of specific versions
- Create an IT concept for extending the platform with the following topics: hardware and software requirements, security, licensing, high availability, load balancing, backup & recovery, update strategy, monitoring integration, etc.
- Coordinate with business architects as well as technical architects from the cross-functional architecture area of the PRISMA program for the topics (backup, Active Directory, monitoring, Citrix, and business applications ...)
- Status meetings and alignment of project planning with the Release Train Engineer / Project Manager
- Advise the Release Train Engineer / Project Manager in identifying project risks
- Advise the System Architect Engineers in steering the implementation of the concept
- Implement the IT concept
- Document the infrastructure
Label: MS Project, LINUX, Windows, ORACLE, Java, REST, SharePoint, Microsoft Exchange, UML, Enterprise Architect, BPMN, AZURE, AWS, V-MODEL, Micro Service, VisualStudio, SAP S/4HANA, SCRUM(SAFE), ESB (TIBCO), Python, Innovator, LeanIX (TOGAF), Ansible, Ansible Tower, Ansible Automation, ROBOT, SpringBoot
Markus B.
Last position:
Consultant, Technical Project Manager at Lanxess
- Project: ESU Windows and SQL Server consolidation / Configuration Management in ServiceNow
- Creation of an as-is analysis of all servers worldwide
- Creation of an as-is analysis of all SQL servers worldwide
- Creation of requirements analyses for SQL and server migrations
- Coordination of requirements with partners for migrations to Hyper-V (on-premises) or Azure Cloud
- Moderation of jour fixe meetings
- Creation of roadmaps and solution models for server migrations
- Setup of test scenarios
- Moderation of workshops for the introduction of a Global Admin Team
- Creation of data models (CMDB) in ServiceNow
- Conducting workshops for the CMDB data model
- Creation of solution models for the CMDB
- Creation of seamless configuration and work documentation for the CMDB
- Creation of reports for license management
- Creation of KPIs for data quality in ServiceNow
- Creation of a service catalog
- Moderation of workshops for creating service requests
- Interface between needs analysis and ServiceNow development team
- Systems used: Windows 7, Windows 10, Microsoft Office 365/2010, Windows Server 20xx, SQL Server 20xx, SharePoint, Azure Cloud, Hyper-V, ServiceNow, various tools
Pierre G.
Last position:
Ansible Automation, Windows Third Level Support at DB InfraGO AG
- PRISMA project
- Ansible automation
- Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019
Hüseyin A.
Last position:
Business Analyst at Niedersächsisches Ministerium für Inneres, Sport und Digitalisierung
- Responsibility, also as rollout manager, for the successful transition of a basic OZG platform into the client's standard operations by planning and implementing measures along Service Transition and Service Operation according to ITIL, including workshops in a SAFe environment with more than 40 operational stakeholders
- Building and maintaining cross-organizational stakeholder relationships by organizing and running various information sessions on technical configurations and user guides (platform and EfA services)
- Designing and improving various operational and project documents such as the ITIL operations manual, OLA, SLA, service support concept and rollout instructions
- Modeling project-based processes according to BPMN 2.0, EPK and UML related to OZG services with the goal of integrating them into the operational e-government process landscape (SOA)
- Coordinating operational stakeholders and KPI reporting to the project management team using agile methods according to SAFe
- Tech stack / tools: Microsoft 365 (SharePoint, OneNote, Outlook, Teams), Skype for Business, Cisco Webex, ADONIS, MindManager, Jira, Confluence
Ralph K.
Last position:
Product Owner / Business Owner at AXIS Management Consulting GmbH
- Full product responsibility from a business perspective: requirement analysis, UX design, product strategy, and go-to-market implemented without an internal dev team using fully AI-supported development (Claude Code / Anthropic)
- Technical differentiation: KRITIS-compliant air-gapped deployment (Windows/NSIS), GDT interface for PVS integration, DATEV-LODAS export for payroll
- Managed pilot operation with initial external client (Dormagen medical practice): structured requirement gathering, test support, error analysis, and release management
- Developed rollout and sales strategy for market entry in the segment of private practices and small medical centers
- Human-in-the-Loop development principle: business decision → AI implementation → manual review → approval → release – each sprint documented in Jira (TIME project), every change traceable via co-authored commits
- Product outcome: Tauri/Rust desktop app with GDT watcher, multi-tier model (Starter/Professional/Enterprise), cloud mirror on Hetzner/Traefik, complete ISMS framework based on ISO 27001 and BSI basic protection as product foundation
- Direct method validation for the test manager role: hands-on experience with quality assurance of AI-generated products from a user perspective, review gate discipline, release approval under GDPR and the EU AI Act
Valeri M.
Last position:
Associate Partner - Information Security Consulting at Insentis GmbH
- Improvement of the Information Security Management System (ISMS) based on ISO 27001, NIS2, DORA, B3S, TISAX and BSI IT Baseline Protection
- Conducting comprehensive gap analyses to identify gaps and derive action plans according to the above standards and regulations; management and KPIs
- Data Loss Prevention strategy and implementation using MS Purview
- Vulnerability and patch management, security monitoring
- Risk analysis and threat modeling using the STRIDE methodology
- Development of vendor risk assessments, implementation of risk classifications, conducting supplier assessments and implementing technical monitoring solutions (e.g. Security ScoreCard)
- Securing cloud environments (AWS and Azure); expertise in CSPM/CNAPP (Wiz), cloud migration, secure CI/CD pipelines, container security and best practices in AWS, Azure and Office 365
- Application security: penetration testing, DevSecOps, OWASP, pre-commit hooks, key and secret management, IDE plugins, static source code analysis, dependency checks, container scanning, vulnerability management, CIS benchmarks and compliance
- Security assessment and hardening according to CIS benchmarks and cloud conformity in AWS, Office 365 and Azure
Thomas U.
Last position:
Senior Consultant / PM Infrastructure Services & Workplace Migration at Freelance
- All Windows clients are managed in a hybrid, central AD
- Client standardization
- Implementation of information security policy requirements
- Development of new infrastructure services delivered as a managed service by a new provider
- New IT platform is a central and secure directory service
- M365 Azure AD
- MS terminal services
- Zscaler
- M365 cloud for workplace management
- PaaS / SaaS is procured through a new provider
Tobias P.
Last position:
IT Consultant & Support at International asset management company
- Consulting on regulatory requirements in IT governance, IT security, KAIT, KAMaRisk & KAGB, ITIL, COBIT
- Development of emergency manuals and a BCM concept according to KAIT requirements, based on the BSI IT-Grundschutz standard 200-4
- Preparation of documents for the PwC audit
- Redesign of access management and risk management according to KAIT
- Administration, user management and setup of RE-VC
- Vendor management
- Establishment of filing structure and naming convention
- Change management including communication plan
Christian Michael M.
Last position:
Sponsor & Project Lead at WAITS Software- und Prozessberatungsgesellschaft mbH
- Sponsor of two spin-off products of the AI and BPM tool BPMaaS called „kionera“ and „myATHENA“
- Definition of project goals and strategic development of the products
- Design and build-up of the kionera platform on shared or dedicated GPU servers with Docker and open-source LLMs
- Provision of the API for internal applications
- Development and design of managed services based on the ADONIS BPM system from BOC Group
- Support with feature definition and planning of ADONIS/BPMN trainings
- Creation of a WordPress website including a subscription payment gateway
Nikolaus B.
Last position:
ICT Risk Management and Information Security at B. Metzler seel. Sohn & Co. AG
- Independently develop policies, guidelines, and frameworks for ICT risk management and information security
- Advise business units on ICT risk management and information security
- Further develop the ICT risk management framework that governs the identification, assessment, and control of ICT risks
- Evaluate the Information Security Management System (ISMS) and adjust it for new challenges
- Conduct risk analyses to identify and assess potential ICT risks and information security risks for the Metzler Group
- Advise on defining and implementing measures to reduce risks and improve the resilience of ICT systems
- Advise on ensuring compliance with relevant internal and external regulatory requirements (MaRisk, DORA, BAIT, BSI IT baseline protection, ISMS, ISO 27001, ISO 42001, ISO 27005, BCM ISO 22301)
- Advise on internal and cross-functional projects (SAP DORA compliance, Target2, Section 8a BSI Act)
Christian G.
Last position:
Deputy Chief Information Security Officer at Gothaer Solutions GmbH
- Deputy lead of the 10-member information security management team in a highly regulated environment (DORA, VAIT, BAIT)
- Direct reporting lines to the CIO of the Gothaer Group and the management board of Gothaer Solutions
- Regular member of the Group Risk Committee and the Compliance Committee
- Managing and coordinating information security processes within the company and with IT service providers
- Leading task forces for handling information security incidents
- Contributing to IT emergency and business continuity management
Klaus-Dieter K.
Last position:
Executive Partner at iAP-Independent Audit Professionals GmbH
Discover over 15,000 top freelancers
Statistics of experts using BSI IT-Grundschutz
Aggregated from the professional profiles of matched freelancers.
Experience
22 years (Germany: 23 years)
Position duration
2.5 years (Germany: 2.6 years)
Positions per freelancer
21 (Germany: 17)
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Healthcare, Banking and Finance
Certification focus areas
Information Technology, Project Management, Quality Assurance
Bachelor's degree or higher
71% (Germany: 85%)
Master's degree or higher
43% (Germany: 54%)
Doctorate
14% (Germany: 9%)
Certifications per freelancer
9 (Germany: 8)
Most common languages
German, English, Spanish
Speak two or more languages
92% (Germany: 94%)
Based on our profile pool as of 19 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Cologne are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Cologne using BSI IT-Grundschutz
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 19 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
BSI IT-Grundschutz experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (85%)
- Healthcare (69%)
- Banking and Finance (62%)
- Insurance (54%)
- Manufacturing (54%)
- Government and Administration (54%)
- Aerospace and Defense (46%)
- Energy (46%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
What IT-Grundschutz covers
BSI IT-Grundschutz is the German Federal Office for Information Security methodology for establishing, operating and improving an information security management system. It combines the BSI Standards 200-1, 200-2 and 200-3 with the IT-Grundschutz Compendium. Companies use it to protect processes, information, buildings, applications, networks and technical systems through a structured risk-based approach.
Standards and method
The methodology begins with an information network, a structural analysis and a protection requirements assessment. Experts then model the target security level, compare existing safeguards with the requirements and document gaps in a security concept. The approach supports basic, standard and core security processes, depending on the organisation’s scope and risk profile.
Ecosystem and tooling
Professionals work with the BSI Standards, the IT-Grundschutz Compendium and tools for asset inventories, protection requirements, risk registers, evidence and corrective actions. Adjacent capabilities often include:
- Information security management systems aligned with BSI Standard 200-1
- Structural analysis and modelling under BSI Standard 200-2
- Risk analysis using BSI Standard 200-3
- ISO 27001 mapping, audit preparation and control documentation
Where companies use it
Public authorities, healthcare organisations, financial services, industrial companies and critical service providers use IT-Grundschutz to organise security controls and demonstrate due diligence. In Cologne, specialists may support regulated organisations, distributed sites and suppliers that need consistent documentation across local and remote teams. The work can cover an initial implementation, a remediation programme or continuous improvement.
When freelance expertise helps
Companies often bring in an external professional when internal teams lack capacity, a security programme has stalled or an audit is approaching. Typical signs include:
- No complete information network or asset register
- Unclear protection requirements and responsibilities
- Safeguards exist but lack evidence or ownership
- A gap assessment is needed before certification or review
A freelancer can provide an independent view, establish a practical delivery plan and transfer knowledge to permanent teams.
What strong professionals deliver
Strong IT-Grundschutz specialists translate BSI requirements into controls that teams can operate and prove. They distinguish policy gaps from technical weaknesses, write usable security concepts and keep risks, measures, exceptions and evidence traceable. Look for clear communication with management, IT, compliance and process owners, plus experience coordinating workshops and remote or on-site stakeholders in Cologne.
Frequently asked questions
The facts hiring teams ask for most often when it comes to BSI IT-Grundschutz.
BSI IT-Grundschutz is used to build and operate a structured information security management system. It helps organisations identify assets and processes, assess protection requirements, select safeguards and document evidence for audits or regulatory reviews.
IT-Grundschutz provides a detailed German methodology, with BSI Standards and the IT-Grundschutz Compendium describing processes and safeguards. ISO 27001 focuses on certifying an information security management system against an international standard, so organisations may use either approach or map one to the other.
A strong BSI IT-Grundschutz specialist should understand information security management, risk analysis, audit preparation and control testing. Useful adjacent skills include ISO 27001, data protection, business continuity, incident response, supplier security and technical documentation.
The right level depends on the scope, maturity and protection requirements of the organisation. IT-Grundschutz work for a complete information network or a certification preparation usually requires someone who can lead workshops, structure evidence and coordinate management, process owners and technical teams.
Much of BSI IT-Grundschutz work can be completed remotely through interviews, document reviews, risk workshops and digital evidence management. On-site visits can still help with physical security, facility reviews and stakeholder workshops, especially when sites or teams are distributed across Cologne and the surrounding area.
Companies often engage an IT-Grundschutz freelancer when an implementation lacks structure, internal capacity is limited or an audit exposes unresolved gaps. External expertise is also useful for independent assessments, remediation planning and temporary programme leadership.
Ask how the professional would scope the information network, set protection requirements and connect safeguards to evidence. A capable BSI IT-Grundschutz specialist explains trade-offs clearly, references the relevant BSI Standards and produces documentation that operational teams can maintain.
A BSI IT-Grundschutz freelancer working with Cologne organisations should be comfortable with German security terminology, formal documentation and collaboration across compliance, management and technical teams. Remote delivery is common, but the assignment may also require on-site workshops, facility reviews or communication in German.
The average hourly rate of freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects is 132 €, which corresponds to a daily rate of about 1,057 € based on an 8-hour working day.
Of the freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects, 71% hold at least a Bachelor's degree, 43% hold at least a Master's degree, and 14% hold a doctorate.
On average, freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects have 22 years of professional experience, with a single engagement typically lasting around 2.5 years.
The most common languages among freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects are German (100%), English (92%), and Spanish (15%).
The most common industries among freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects are Information Technology (85%), Healthcare (69%), and Banking and Finance (62%).
The most common business areas among freelancers in Cologne, Germany who have used BSI IT-Grundschutz in their recent projects are Information Technology (100%), Project Management (100%), and Quality Assurance (85%).
Main locations of FRATCH Experts, who have recently used BSI IT-Grundschutz
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich 
Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Berlin 
Munich 
Frankfurt 
Dusseldorf Countries:
Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
