Cybersecurity Experts in Hamburg

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
• Overall responsibility for establishing a Compliance, Governance and Risk organization
• Establishment of an integrated GRC model and executive reporting for the Management Board.

• Administration and further development of the M365 environment, including Teams, Exchange Online, Intune, and SharePoint Online
• Development of dashboards for performance monitoring with Microsoft Power BI
• Implementation of user requirements and processes with low-code/no-code technologies (Power Apps, Power Automate)
• Use of Jira and Azure DevOps to plan and implement user stories in an agile project context
• Participation in daily stand-ups, sprint planning, sprint reviews, and retrospectives as the technical point of contact
• Planning and implementation of security policies using Azure Conditional Access and multi-factor authentication
• Configuration and deployment of clients and applications via MECM (SCCM) and Baramundi

• Transition strategic business development: product before customer in <4 months instead of 10
• Transition strategic business development: development cost reduction to plan: 40% (-250 k EUR)
• Executive mentor & coach for CEO & CPO: CEO too busy to improve - portfolio, company structure and strategy
• Executive mentor & coach for CEO & CPO: PO→CPO transition to take over full product responsibility for Lohnpulse
• Interim CIO: scouting / onboarding / handover of general contractor service providers to CPO
• Interim CIO: transition from MVP to a fully operable product by the CPO

Migration from Exchange 2016 to Exchange 2019 and Exchange Online, as well as the introduction of a backup solution and an archiving solution. The goal was to securely modernize the email and archiving infrastructure in compliance with legal requirements and ensure high performance.

Responsibilities as IT PROJECT MANAGER: Overall project management and operational coordination / Ensuring compliance with budget and resource limits / Ensuring project objectives are met / Ensuring compliance with regulatory requirements and policies, including ISMS, ITIL, and data protection requirements / Preparing and presenting management reports for the project sponsor and steering committee / Coordinating cross-functional teams across Exchange, network, data protection, and IT security / Planning and carrying out the migration from Exchange 2016 to Exchange 2019 / Planning and carrying out the migration from Exchange 2019 to Exchange Online / Planning and introducing a backup solution for Exchange Online / Coordinating an EU-wide tender for an archiving solution, including market research with potential suppliers / Planning and introducing an archiving solution for Exchange Online / Coordinating and preparing the BAS notices required for the project / Coordinating and aligning with stakeholders (for example, business units, external service providers, and suppliers) to define requirements and deliver solutions

Technical environment: MS Exchange 2016, MS Exchange 2019, MS Exchange Online, MSOffice, MS Planner, MS Powerpoint, MS Project, MS Teams, CodeTwo, Hornet Security

• CIO at nutrition R&D and producer (family owned)

Strengthened IT Team, recovered IT service, reviewed and streamlined complex SAP landscape, reviewed IT security set-up, reviewed laboratory IT

Providing executive marketing leadership for multiple clients across scaling B2B technology and B2C consumer brands. Driving growth through strategic marketing leadership, owning positioning, brand and go-to-market execution while building AI-enabled operating systems and company-specific frameworks that make teams faster, preserve institutional knowledge, and scale more effectively. Leading a full repositioning for B2B cybersecurity SaaS client, rebuilt the messaging architecture, ICPs, buying groups and defined a new go-to-market strategy spanning marketing and sales, including the go-to-market brand and market-facing presence

• Implementing AI-enabled knowledge and operational systems that improve execution, cross-functional alignment, and institutional knowledge retention

• Consolidating multiple separate brands for a B2C client into a single umbrella brand, with a new go-to-market strategy and operating setup behind it

• Brand modernization and digital growth strategy for a premium consumer brand, redesigning the brand architecture, customer journey, and e-commerce experience

• Establishing scalable content, marketing, and operating systems to support long-term growth and more effective execution

• Overall responsibility for IT, including the creation and implementation of the IT roadmap/IT strategy and the resulting measures in the organizational structure, processes and systems landscape

• Member of the Management Board

• Organizational development

• Development of the corporate strategy

• Introduction of a new SteerCo process for Germany in coordination with the Dutch group

• Restructuring and optimization of incident, problem and change management

• Moderation and execution of software and partner selection processes for the introduction of new systems/applications

• Initiation and negotiation of business relationships with external service providers and suppliers, including contract design

• Ensuring IT security and data protection in accordance with legal requirements and best practices

• Expansion of internal data centers and infrastructure to ensure SLAs for internal operations, including cloud services and cybersecurity

• Budget planning and control as well as resource management for the area of responsibility

• Gathering, evaluating, and prioritizing strategic demands from the Electronics and Power Systems business units
• Supporting the digitalization of business processes for Electronics and Power Systems
• Process digitalization and IT architecture planning, including network infrastructure
• Reviewing demands with regard to existing solutions in coordination with IT and business departments
• Designing and implementing possible business architectures
• Planning implementation projects, in particular supporting import control through the introduction of SAP GTS
• Acting as the interface between business departments and IT
• Creating and implementing concepts for IT security, compliance, data protection, and the protection of classified information
• Conducting workshops, process analyses, and training sessions
• Stakeholder management and change management
• Technologies used: SAP GTS, SAP MM, SAP SD, MS Office 2016, MS SharePoint, ServiceNow, SharePoint

• Privacy by Design and by Default
• Working with OneTrust: creating and managing records for requesters
• Interface role: mediation and communication between the DPO and the specialist departments, including clarifying data protection questions
• Handling data protection incidents: analysis, documentation, and coordination of measures
• General advice on data protection topics: support with data protection-related questions
• Process optimization: identifying room for improvement in processes and implementing changes
• Documentation & reporting: creating reports on data protection incidents or general data protection topics for the DPO and weekly reports for the line manager for presentation in the performance board
• Risk assessment & compliance: support in assessing data protection risks in new projects or processes
• Distribution and independent handling of email requests or requests from the DPO: all incoming tickets are divided among team members, with no specialization in the tasks. Tickets are created and tracked in Jira.

Approach/Methods:

• Stakeholder management
• Communication at C-level
• Timeline and implementation plan

• Technical consulting to meet regulatory MiCA requirements for a digital trading platform
• Design and development of backend components and APIs to comply with transparency and auditability requirements
• Optimization of core functions in order execution and market data delivery with a focus on performance and reliability under high load
• Conducting job interviews and structured onboarding of new developers
• Successful and timely implementation of the regulatory MiCA requirements, ensuring uninterrupted operations
• Reduction of user issues and common support requests by fixing complex backend problems
• Strengthening the development team through effective onboarding, mentoring, and knowledge sharing

• Goal: further development of existing end-to-end data distribution, from development partners to dealers and remotely into vehicles; design and implementation of future data distribution in a globally distributed cloud
• Budget / scope undisclosed (approx. 47 external employees)
• Result: The project is running and is on time, in scope, and on budget.
• Responsibility: As part of the management team in a leading role for planning and carrying out project management tasks; scope and time management (from mind map to network plan to project plan); interface to the group finance department, recruiting, budget acquisition (e.g. from model series management, production, IT budgets, etc.), demand management.

• Responsible for the configuration, maintenance, monitoring, troubleshooting, and optimization of the IT infrastructure, including Extreme Networks, SD-WAN, and Fortinet security solutions, at all international company locations in Europe and North America
• Development of a comprehensive strategic roadmap to optimize the network architecture, including VLANS, NAC, QoS, firewall configurations, VPNs, DPI, NGFW, threat intelligence, and SSL/TLS inspection
• Implementation of the OneIT strategy through the introduction of new technologies such as Cisco DNA Center, ExtremeCloud IQ, FortiOS, FortiManager, and FortiAnalyzer, which increased employee skills and the efficiency of the IT systems
• Integration of IT and OT systems to optimize the network and security architecture and improve operational efficiency

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.