DORA Experts

• Founder of CheironX: AI-supported GRC management (ISO 27001, BSI IT-Grundschutz, TISAX, DORA)
• Strategic focus on Agentic AI and GenAI for modern IT Governance, Risk & Compliance Management
• IT interim management and strategic consulting

Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as Support, Finance, Developers, and Security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA topics and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.

Tools/Frameworks: FIDO, Yubikey, Veridium, BSI Grundschutz, NIST

• Engaged within the Information and Security Management division for a Proof of Concept (PoC) project focused on developing a Client Security Portal.
• Managed project resources across the UK, India, and Germany.
• Architected and deployed the PoC solution leveraging a modern Java stack, Google Cloud Platform (GCP) with Kubernetes, and Active Directory (Entra ID) for authentication.
• Implemented OAuth 2.0 for authorization.
• Ensured DORA alignment according to Deutsche Bank security rules and regulatory preparation.

• Established a cyber resilience framework for AI-accelerated threats in the Frontier AI Threat Endurance (FATE) program: capability assessments, maturity assessments and gap analyses covering cyber security, operational resilience, incident response, recovery and governance, followed by target concepts and improvement measures
• Supported action owners from specification through implementation: implementation roadmaps, decision papers, management presentations and governance reporting, as well as audit- and supervision-ready documentation; managed stakeholders from IT, Information Security, Risk Management, Operational Resilience, Business Continuity and the business units

• Developed a market entry strategy for the claims division of an insurance services provider.
• Analyzed and optimized existing claims processes.
• Defined management metrics and KPIs to improve performance and efficiency.
• Advised management on market positioning and process digitalization.
• Led an IT team of 13 employees as part of an interim vacancy cover.
• Ensured stable IT operations and managed external IT service providers.
• Led regulatory projects, particularly the implementation of the DORA regulation.
• Prepared and supported an IT security audit.
• Change management and conflict moderation in a challenging transformation environment (FI migration).

• Private Equity owned precision grinding machines for Auto, Military & Aerospace – 1200 Employees
• Acting as Interim Group CIO / CISO consolidating Global IT back to Europe – M&A consolidation
• Managed major Security event and post event cleanup – Reporting to regulators
• Performed Vendor & Contract Management – full assessment of capabilities
• Guided Infrastructure refresh & Security Hygiene assessments

As Germany’s only large integrated energy company, EnBW covers the entire value chain—from energy generation and distribution to serving customers. The company is expanding its renewable energy sources, working toward a socially responsible coal phase-out, and advancing key technologies such as the use of green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW.  Developing and implementing an end-to-end process view that takes both technical and organizational aspects into account  Ensuring end-to-end control of all IAM-related technical services  Establishing clear responsibilities and accountabilities across the IAM landscape  Working with various departments to identify and optimize an end-to-end architecture and act as the Single Point of Contact (SPoC) for Information Security  Introducing and monitoring governance policies to ensure compliance and security  Continuously improving IAM processes and systems through regular audits and service reviews  Taking part in external process audits as part of official audits against ISO standards  Further developing the policy that sets administrative requirements and procedures, and aligning it with administrative departments  Conceptually developing the KPI system for measuring process quality

Carve-out and post-merger integration of two automotive engineering companies under Accursia Capital, 6 locations in Germany and Spain, 250+ employees after the carve-out. Reporting directly to the investor, with overall IT responsibility for both companies.

• Consolidation of the ERP landscape into one instance (replacement of SAP legacy)
• TISAX certification
• M365, identity and data center migration
• Replacement of end-of-life infrastructure
• Weekly investor reporting

Results:

• Critical infrastructure risk eliminated, backup and platform stabilized
• One IT organization established for both companies
• Weekly investor reporting successfully established

• Requirements management, process planning, interface function, ISMS setup, and documentation
• Setup and establishment of an ISMS according to ISO 27001 and establishment of emergency management / ITSCM
• Coordination of the circumstances with the public-sector IT service provider
• Consideration of KRITIS relevance within the scope and implementation of a B3S
• Development of requirements for document control and the continuous improvement process
• Preparation of relevant project documents
• Analysis of existing processes and preparation of guidelines
• Requirements gathering for ISMS and ITSCM and coordination with the IT service provider, including definition of interfaces
• Analysis of communication processes and escalation paths
• Review of documents for risk management, ISMS, emergency preparedness, and emergency response
• Redesign of the complete documentation and preparation of new relevant documents
• Development of necessary rules, policies, and concepts
• Interface between customer and service provider to ensure document quality
• Coordination of protection needs with specialist departments, particularly regarding KRITIS relevance, and planning of resulting measures
• Development of preventive measures to minimize the risk of data center outages in scenarios such as pandemics or ransomware attacks
• Definition of the test strategy for IT emergency exercises
• Initiation of necessary awareness training measures for specialist departments
• External Information Security Officer
• Introduction of document control

• Built a scalable nearshore IT developer hub (Croatia, Czech Republic, Poland) as an independent company through a BOT model (Build – Operate – Transfer)
• Identified, selected, and managed full-service agencies; introduced management and control mechanisms, including KPIs, SLAs, and regular service reviews
• Prepared and reviewed data processing agreements and framework contracts in coordination with Legal & Compliance; integrated regulatory requirements (including KRITIS) into process design
• Advised on cloud vs. on-premise strategies, data storage, and authorization concepts; supported Procurement with tendering and service provider evaluations
• Managed change and process harmonization between internal teams and nearshore partners; reported to executive management, CFO, and CIO

Result: Scalable IT developer hub with an audit-ready governance model, reduced operating costs, and accelerated product development.

• Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
• Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
• Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
• Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
• Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
• Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
• Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

Stabilization of an Azure/.NET landscape in live operation.

• Architecture, DevOps, and operational readiness; technical decisions under time pressure
• Azure DevOps, monitoring, ETL/ELT, cloud security, FinOps, and data-mesh-related topics

Technologies: Azure DevOps, .NET, CI/CD, monitoring, FinOps

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
• Overall responsibility for establishing a Compliance, Governance and Risk organization
• Establishment of an integrated GRC model and executive reporting for the Management Board.