Cybersecurity Experts in Austria

Provided expert consultancy services to a range of clients, supporting their compliance and security objectives across multiple domains. Key projects and responsibilities included:

• Lead consultant for successful ISO 27001 certification projects, including readiness assessments and audit support
• Conducted comprehensive risk reviews and gap analyses to identify and remediate compliance and security vulnerabilities
• Developed, and improved internal and external policies, guidelines, and procedures related to information security and data protection
• Delivered tailored training sessions to employees on security best practices and data protection obligations
• Negotiated and drafted compliance-related contractual clauses, including DPAs and security-related provisions.
• Designed consent management strategies and ensured effective technical implementation of cookie banners in compliance with regulatory requirements

• Architected and deployed a highly available, multi-tenant Kubernetes platform on Google Kubernetes Engine (GKE) for business-critical microservices.
• Designed and implemented a comprehensive Infrastructure-as-Code strategy using Terraform for managing GKE clusters, networking (VPCs, Subnets), and IAM policies.
• Engineered optimized storage solutions for stateful workloads (MongoDB) using GKE PersistentVolumes, enhancing performance and data resiliency.
• Established a full-stack observability framework using Google Cloud Monitoring, Logging, Prometheus, and Grafana.

• Main tasks and responsibilities: development, acquisition, sales, consulting, and controlling
• Area of work or industry: Software as a Service in AI compliance and consulting

Selection of client projects:

• Creation and operation of an AI governance platform, including training content on the use of AI in companies
• Design, setup, and operation of the ISO 42001 management system at PaiperOne with certification by TÜV
• Auditor according to ISO 17024 at Austrian Standards for the "AI Manager"
• AI training for staff of two Austrian publishing groups
• AI training for the management level at the State of Lower Austria
• AI strategy workshop for a municipality in Styria and a municipality in Salzburg
• AI workshops for the House of Digitalization in Tulln
• AI training for municipalities at KDZ
• Delivery of training on "Certified AI Compliance Officer" at the Academy for Internal Audit
• Organizational consulting on AI governance at ÖGK
• Project support for the "homepage chatbot" at öbv
• Certification exams at Austrian Standards

• Design, authorship and finalization of the IT PROD SEC service catalog with eight standardized security services (S-ID001–S-ID008).

• Development of consistent service components & deliverables, RACI assignments and SLA and KPI definitions for each service.

• Integration of BaFin document requirements under DORA into the service descriptions.

• Coordination with IT, compliance, risk and operations teams to validate all service descriptions.

• Specifically for governance & monitoring: definition of governance cadence, evidence delivery processes, audit support and definition of measurable KPIs and measurement methods.

• Ensuring that all services are standardized, measurable and documented in an audit-proof manner.

• Result: Approved service catalog with eight services as a binding basis for delivery, governance and audits; transparent SLAs/KPIs for each service and DORA/BAIT/MaRisk-compliant documentation with clear responsibilities and evidence trails.

• Technologies and tools: Confluence, Jira, ServiceNow, Microsoft PowerPoint, Microsoft Visio, Office 365.

• From 02/2023 to 05/2024: IT interim manager within an international construction chemicals group headquartered in Germany as Global TSA Manager in a carve-out project responsible for the IT workstream.

• From 06/2024: IT consulting in project management and IT service management areas, providing PM/PMO coaching and support.

• Revised the internal control system following a transformation
• Surveyed current processes and analyzed target processes
• Adjusted financial controls and conducted design and operational tests
• Provided strategic consulting at management level
• Outcome: updated ICS approved by audit bodies; follow-up projects resulting from the achieved results
• Focus areas: ICS, finance processes, governance, design and operational testing, executive consulting

• Pivoted the company into data-driven and AI-powered energy optimization solutions for microgrids, energy communities, and grid operators.

• Design and execution of the transformation journey of IT & digitization and enablement of the further development of the group
• Development of the global IT & digitization strategy (motto: “ahead of the wave”) based on group standards and USP-driven digital solutions
• Definition of the digital strategy as part of the company’s 2030 strategy with a focus on the value disciplines “operational excellence,” “customer intimacy,” “product leadership”
• Design and implementation of a business-focused, global IT organization, including existing shadow IT parts
• Digital product development with a focus on IoT, data science, AI, software development (DevOps), cloud architecture, and Azure cloud services
• Initiation and ramp-up of the CoE for artificial intelligence and data analytics, including several agentic AI projects
• Definition and global rollout of the enterprise, infrastructure, and application architecture
• Cloud transformation including setup and execution of the global S/4HANA rollout, introducing new capabilities and modules
• Global business process standardization, automation, and end-to-end digitization within and across divisions
• IT/OT integration (shop floor, CAx integration)
• P&L responsibility and further development of digital marketing & sales channels, SEO/SEA, online product configuration, PIM/DAM, eBusiness/eCommerce systems
• Implementation of a global intranet portal and several digital solutions like Workday, Concur, Softconcis, Tacto, xFlow
• Further development of Salesforce beyond CRM into a sales backbone
• Support of M&A and divestiture
• Cyber security excellence, data protection, and NIS2 preparation
• Ramp-up of nearshore and offshore locations (Poland, India)
• Evaluation and implementation of business-value–driven IT innovation like RPA, business process AI, and low-code
• IT budgeting and controlling, KPI reporting, and negotiation of large IT contracts
• Global recruiting, people retention, and development
• Stakeholder management with executive management and heads of divisions

• Developed Taranis AI, an advanced open-source intelligence (OSINT) tool, leveraging artificial intelligence to revolutionize information gathering and situational analysis.
• Created cybersecurity trainings and a cyber range to provide hands-on learning experiences for SOC teams and IT management.
• Designed and implemented a hybrid cloud infrastructure using OpenStack, Terraform, and Ansible, improving the scalability and performance of the infrastructure and led the migration from an on-site only infrastructure to the hybrid cloud environment.
• Some of my current work can be found on GitHub.

• Heading up the Oracle Fusion transformation program
• Identification, impact analysis, recommendation & flawless initialization of IT restructuring with 60% headcount reduction covering organization, processes, technology
• Recommendation on change management approach
• Oracle Fusion migration rescue

• Overall management of ICT infrastructure and services at the St. Pölten University Hospital

• Ensuring a highly available, secure, and high-performance IT environment

• Planning, controlling, and continuously optimizing IT processes

• Adapting and evolving the IT strategy in line with clinical requirements

• Main point of contact for alignment between ICT, hospital management, and clinical departments

• Interface between the regional health agency and local management

• Ensuring efficient cross-department collaboration

• Building, maintaining, and developing relationships with internal and external stakeholders

• Representing the ICT department in interdisciplinary committees and projects

• Leading digitization, innovation, and infrastructure projects

• Managing IT projects with regard to cost, time, and quality

• Ensuring compliance with data protection, security, and compliance requirements (e.g. NIS/NIS2)

• Implementing and monitoring security measures to minimize risks

• Analyzing, optimizing, and automating IT-supported workflows

• Introducing innovative solutions to increase efficiency

• Planning, controlling, and monitoring IT budgets and resources

• Efficient allocation of personnel and financial resources

• Developing and implementing long-term ICT strategies at the hospital

• Identifying and integrating new technologies to improve patient care

• Leading, motivating, and developing a high-performing ICT team

• Promoting an innovation-friendly and collaborative work culture

• Advising clinical and administrative departments on technology solutions

• Supporting digital transformation and the introduction of new IT services

• Founder & creator of a cutting-edge Governance, Risk & Compliance SaaS solution.
• Developing and executing business development strategies to identify new opportunities and expand market presence.
• Providing information security consulting services.
• Specializing in governance, risk, and compliance (GRC) topics such as risk management, ISO 27005, ISO 27001, NIS 2, DORA, PCI DSS, EU-GDPR, and more.
• Past projects:
• Kyndryl Austria GmbH: delivered IAM blueprint, conducted risk assessments, developed transformation strategy and roadmap for client projects, and provided support in pre-sales activities to align solutions with client needs.
• Cashpoint Sportwetten GmbH: conducted ISO 27001:2022 gap analysis, enhanced ISMS processes, updated security training, aligned with ISO 27001:2022 standards, and improved vulnerability management practices through regular assessments and remediation planning.
• Hornbach Baumarkt AG: supported the CISO in achieving ISO 27001 compliance, implementing a secure software development lifecycle (SDLC), strengthening vulnerability management practices, and enhancing risk management frameworks.
• MHP Management- und IT-Beratung GmbH: created and reviewed security concepts aligned with ISO 27001 standards.
• Stromnetz Berlin GmbH: developed a comprehensive security concept based on ISO 27001 requirements.
• dmTech GmbH: conducted IT security training for employees, fostering awareness and adherence to security best practices.
• Finanz Informatik GmbH: managed PCI DSS-related tasks, including compliance assessments and control implementations.
• TIPS Messtechnik GmbH: conducted NIS2 gap analysis, developed a comprehensive compliance roadmap, and provided supportive actions to address identified gaps and ensure alignment with regulatory requirements.

• Built the company’s entire security function from zero to ISO-aligned, audit-ready operation (ISO 27001, GDPR, NIS2).
• Delivered enterprise-grade security posture enabling regulated customer onboarding and due-diligence success.
• Embedded automated security controls (SAST, DAST, secrets, vuln scanning) into CI/CD for a growing SaaS engineering team, removing security as a deployment bottleneck.
• Cut third-party risk exposure by ~70% by replacing manual vendor reviews with an automated, LLM-driven risk scoring and approval pipeline.
• Led board-level security, customer audits, and live incident response.

• Directed IT operations across 13 sites in China, Romania, Poland, Hungary, Germany, Ukraine, and Austria.
• Built and led a new IT team with personnel based in Poland, Hungary, Romania, and Germany.
• Upgraded outdated IT infrastructure at sites in Austria, Germany, Romania, and Poland, enhancing clients, printers, networks, servers, storage, firewalls, and backups.
• Retired the legacy phone system and transitioned to Teams.
• Established and deployed AI tools, including Copilot and Zapier.
• Implemented NIS II readiness and achieved ISO 27001 certification.
• Eliminated inefficient business applications to enhance operational efficiency.
• Developed and executed new processes for operations technology, business process outsourcing, purchasing, human resources, and IT.
• Launched a new SAP Warehouse System.
• Established IT standards across all sites.
• Engaged effectively with internal and external stakeholders.
• Defined and monitored security KPIs, ensuring targets were met.
• Managed budgeting processes, achieving a 15% reduction in operational expenditure.