Cybersecurity Experts in Vienna

• Consulting and interim management at the intersection of IT operations and regulation
• Impact assessment and implementation planning for NISG 2026 and the EU AI Act, including risk management and reporting and evidence processes
• Training for governing bodies and employees on regulatory obligations
• Teaching assignments in Data & Information Management and Human-Machine Interaction at Hochschule Burgenland, since 2023
• Supervision of Master's theses and participation on examination boards
• Industry talks for businesses and educational institutions
• Design and development of data and AI products, platforms and pipelines
• Privacy-first architectures and Zero-Knowledge encryption, cloud-native on EU infrastructure
• Integration with bank account systems using SEPA direct debit mandates and message formats under ISO 20022 (pain.008, camt.053)
• MLOps and AIOps in live operations
• Own applications under my own brand: shared codebase, separate deployment for each target device
• AI-assisted software development (vibe-coding), complete agentic pipelines, code generation, implementation, automated testing, CI/CD and release cycles
• Professional publications on the EU AI Act, NIS2, DORA, CRA and CER as an integrated governance system
• Professional publications on data sovereignty, cloud economics and industrial image processing
• AI governance / compliance: data quality, Responsible AI, EU AI Act readiness, risk classification, AI ethics

• From 02/2023 to 05/2024: IT interim manager within an international construction chemicals group headquartered in Germany as Global TSA Manager in a carve-out project responsible for the IT workstream.

• End-to-end management of an international IT carve-out and TSA program, including transition of five service providers, governance and operating structures, service continuity, provider performance, SLA/KPI and cost management, SIAM and supplier management, security services, operational readiness, and transition into stable operations.

• From 06/2024: IT consulting in project management and IT service management areas, providing PM/PMO coaching and support.

Cyber Trust Austria Silver Certification

• Led application and implementation of the Cyber Trust Austria Silver label (KSV1870 Cyber Risk A-Rating; 25 validated controls)
• Mapped and fulfilled requirements covering risk management, incident response, access control, vulnerability and penetration testing, BCM, and supply-chain security, aligned with ISO/IEC 27001/27002 control themes and NIS 2 / NISG 2026 expectations
• Coordinated stakeholders, compiled audit evidence, and completed KSV1870 validation

Refactoring and improving core APIs; implementing client change requests. Setting up metrics, traces, and logs monitoring infrastructure to support operations. Designing GitOps deployment and infrastructure as code. Applications and systems configuration in ArgoCD and Openshift. Confluence documentation of design, approach, and solution. Tech Stack: Java 8 & 21, Spring framework, JSP, JavaScript, Bash scripts, SQL, Grafana Stack, OpenTelemetry, Docker, DB2, Maven, Kubernetes Kompose.

Owned the end-to-end architecture and the transition for the fourth licence period of the UK National Lottery: a complete technology stack replacement delivered against a hard regulatory deadline. Produced the end-to-end high-level architecture that served as the delivery baseline for the replacement of all major IT service components including infrastructure

Target architecture across two geo-redundant UK data centres: multiple VMware ESX clusters, OpenShift, MS SQL Server clusters, Oracle Exadata, integrated with AWS-hosted components and a retailer WAN over VSAT, DSL and LTE

Business continuity concept and geo-redundant high availability design

Review and approval authority over all low-level designs, application and infrastructure: network security, Oracle RAC, VMware, OpenShift, SQL clustering, geo-redundancy

Designed and implemented full hardware and network separation between test environments and staging/production

SME for third-party security audits against CIS benchmarks and NIST standards: preparation, execution, findings analysis, remediation prioritisation

Delivered software deployment to 45,000 retail terminals with minimal downtime, plus data migration from the incumbent end-to-end landscape to the new architecture

Transitioned 45,000 POS terminals and 19 million online players on time with no critical incidents

Owned the integrated transition plan for the full replacement of the lottery technology stack: work packages, milestones, dependencies and critical path across parallel technical sub-projects

Central organisational interface between internal IT leads, technical workstream leads, multiple external vendors and client executive stakeholders

Planned and led migration and cutover of live, regulated national infrastructure, including 80+ bare metal servers running VMware ESX, Microsoft VMs across several Active Directory domains, Linux VMs, OpenShift on Linux, 2 SANs, 2 Oracle Exadata systems, AWS components and a retailer WAN

Ran 4 full cutover dress rehearsals ahead of the 2 major go-live releases

Governed all changes through the ITIL change process and CAB; ran risk, issue and escalation management with regular status reporting to the Program Director and client's CTO

Onboarded the internal cyber security team and acted as architecture SME in pre-deployment security audits for client and internal security teams, including prioritisation and remediation of findings

Joined the programme as Enterprise Architecture Lead from May to September 2022, gaining detailed knowledge of the target infrastructure before taking overall delivery responsibility; after go-live, supported the delivery teams through the warranty phase

• NIS2/IT-OT infrastructure project for network and firewall: PoC, roll-out, and blueprint
• Coordination of IT, OT/operations, information security, business units, and external suppliers
• Risk and escalation management
• Direct evidence of security, multi-vendor delivery, and operational context.

• Main tasks and responsibilities: development, acquisition, sales, consulting, and controlling
• Area of work or industry: Software as a Service in AI compliance and consulting

Selection of client projects:

• Creation and operation of an AI governance platform, including training content on the use of AI in companies
• Design, setup, and operation of the ISO 42001 management system at PaiperOne with certification by TÜV
• Auditor according to ISO 17024 at Austrian Standards for the "AI Manager"
• AI training for staff of two Austrian publishing groups
• AI training for the management level at the State of Lower Austria
• AI strategy workshop for a municipality in Styria and a municipality in Salzburg
• AI workshops for the House of Digitalization in Tulln
• AI training for municipalities at KDZ
• Delivery of training on "Certified AI Compliance Officer" at the Academy for Internal Audit
• Organizational consulting on AI governance at ÖGK
• Project support for the "homepage chatbot" at öbv
• Certification exams at Austrian Standards

• Design, authorship and finalization of the IT PROD SEC service catalog with eight standardized security services (S-ID001–S-ID008).

• Development of consistent service components & deliverables, RACI assignments and SLA and KPI definitions for each service.

• Integration of BaFin document requirements under DORA into the service descriptions.

• Coordination with IT, compliance, risk and operations teams to validate all service descriptions.

• Specifically for governance & monitoring: definition of governance cadence, evidence delivery processes, audit support and definition of measurable KPIs and measurement methods.

• Ensuring that all services are standardized, measurable and documented in an audit-proof manner.

• Result: Approved service catalog with eight services as a binding basis for delivery, governance and audits; transparent SLAs/KPIs for each service and DORA/BAIT/MaRisk-compliant documentation with clear responsibilities and evidence trails.

• Technologies and tools: Confluence, Jira, ServiceNow, Microsoft PowerPoint, Microsoft Visio, Office 365.

• Architected and deployed a highly available, multi-tenant Kubernetes platform on Google Kubernetes Engine (GKE) for business-critical microservices.
• Designed and implemented a comprehensive Infrastructure-as-Code strategy using Terraform for managing GKE clusters, networking (VPCs, Subnets), and IAM policies.
• Engineered optimized storage solutions for stateful workloads (MongoDB) using GKE PersistentVolumes, enhancing performance and data resiliency.
• Established a full-stack observability framework using Google Cloud Monitoring, Logging, Prometheus, and Grafana.

• Conducting a feasibility study on introducing an in-house DWH as a central data source
• Conducting workshops for current state analysis (processes, reports, KPIs) together with the clients
• Gathering and detailing business requirements including a target concept for an in-house DWH
• Coordinating and clarifying data deliveries and interfaces in meetings with stakeholders and data providers
• Developing initial data models as a basis for data quality and later implementation
• Drafting solution variants including architecture and operation options and decision basis
• Creating the business case including effort estimates, cost-benefit analysis, and decision report

• Pivoted the company into data-driven and AI-powered energy optimization solutions for microgrids, energy communities, and grid operators.

• Built the company’s entire security function from zero to ISO-aligned, audit-ready operation (ISO 27001, GDPR, NIS2).
• Delivered enterprise-grade security posture enabling regulated customer onboarding and due-diligence success.
• Embedded automated security controls (SAST, DAST, secrets, vuln scanning) into CI/CD for a growing SaaS engineering team, removing security as a deployment bottleneck.
• Cut third-party risk exposure by ~70% by replacing manual vendor reviews with an automated, LLM-driven risk scoring and approval pipeline.
• Led board-level security, customer audits, and live incident response.

• Development of a planning system (planning of planning) for the entire company.
• Development and implementation of a digital, AI-supported strategic and operational control system for the entire company.

• Overall responsibility for IT, software development, and digital services of the company for brands such as Rosenberger, Rosehill, Burger King Austria (approx. 70 companies)
• Built the holding's lakehouse and data analytics platform
• Established and led the software development and IT department
• Established and led the operation (cloud-native AWS) of the B2B platform
• Connected IoT systems and developed models for predictive maintenance and production planning, data lake/lakehouse, and BI
• Preparation for ISO 27001 information security certification
• Technologies: Cloud, AWS, Java, Cypress, Angular, Python, Go