DORA Experts in Berlin

• Creating guidelines
• Conducting Business Impact Analyses (BIA), assessing risks, and identifying time-critical business processes
• Process management
• Creating emergency plans and crisis management plans, including cyber response and IT emergency plans with special consideration of a cyberattack
• Conducting awareness trainings
• Planning and carrying out tests and exercises
• Developing tailor-made solutions to reduce risks and ensure business continuity

Industry: Publishing, media Project management for the concept of a RAG-based archive access solution: a secure on-prem or hybrid compute architecture for LLM and embedding operations, pipeline for transcription and automatic tagging, semantic search across audio and video archives. Use case evaluation and make-or-buy together with editorial team, archive, and legal department, taking into account copyright, broadcasting law, and the AI Act. Differentiator: practical LLM infrastructure experience from two own productive platforms combined with C-level program management in regulated industries.

• Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
• Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
• Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
• Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
• Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
• Implement continuous monitoring solutions to detect and respond to threats in real time.
• Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
• Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
• Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
• Collaborate with project teams to address findings and ensure that security risks are managed effectively.
• Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
• Facilitate a culture of security awareness throughout the organization through training and regular communication.
• Lead security initiatives that align with the organization’s long-term strategic goals.
• Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
• Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

• full-service marketing agency for global technology companies

• Advisory for Bank-Verlag GmbH on establishing a risk management and compliance function by defining the DORA strategy, conducting a DORA gap analysis and developing all DORA-relevant policies, supporting the design and roll out of the risk management framework, and providing overall PMO support for all DORA-relevant streams
• Ensured the conceptual and operational setup of a Cyber Defence Center for Vienna Insurance Group AG, including the implementation of regulatory requirements, development of the organizational, tax, and financial structure, including up- & downstream cost allocation model, DORA compliance, outsourcing, data protection, and works council requirements, gap analysis for contracts with regard to DORA, EIOPA, Solvency II and best practices and creation of policies in line with DORA
• Definition of an IT security target operating model for Oldenburgische Landesbank, including definition of processes, responsibilities and interfaces for a new, DORA-compliant IT security operations area that can be integrated into the existing IT organization and that is to be established or expanded
• Implementation of a service management readiness and maturity analysis according to ITIL for Ottobock Group, definition of an ITSM target operating model including processes, organization and governance, and derivation of measures to close identified gaps
• Developed an overarching cloud strategy for the corporate segment of ThyssenKrupp AG, involving all business units and stakeholders while considering business unit specific requirements
• Conducted an IT benchmark for a business unit of ThyssenKrupp AG, including structural analysis of the organizational structure and IT strategy
• Introduced a company-wide business continuity management system for Krieger Group, including identification and assessment of potential crisis scenarios and risks, and establishment of structures
• Developed an S/4HANA transformation strategy for Pfalzwerke AG, including a transformation plan and preliminary project
• Developed a restructuring strategy for Pfalzwerke AG, including the future IT delivery model, transformation plans, and business cases for each scenario
• Conducted an IT cost review for AMS-OSRAM AG, including analysis and optimization of IT costs and budget, as well as planning and implementing a strategy to reduce IT costs.

• Responsibility for IT infrastructure across 8 sites, 2,500 users, 80 systems, 8,000 assets
• Responsibility for IT/non-IT procurement with €18M annual budget
• Central service provider management, digitalization of contracts and procurement
• Project management for scanning solution, site integration, MS SharePoint
• Leadership of 18 FTE across 3 teams
• Agile leadership in implementation of Digital Office and Digital Coach

• Led engineering execution: roadmap planning, capacity alignment, risk management, dependencies, and delivery tracking.
• Consolidated multiple payroll product lines into a unified SaaS platform on Dynamics 365 Business Central, enabling scalable post-merger operations and reducing operational complexity across the portfolio.
• Restructured engineering and product teams in a remote-first setting across Germany, Austria and Poland, consisting of five cross-functional units: compliance/enabling, platform, DevOps and two stream-aligned teams with total FTE depending on phase of reorganisation.
• Rebuilt the mid-level leadership layer and mentored engineering leaders, establishing a leadership pipeline and strengthening architectural decision-making across teams for scalable growth, delivery ownership and predictability.
• Designed platform foundations and system boundaries using Team Topologies aligned structures, enabling scalable ownership, clear interfaces and parallel development across distributed teams.
• Spearheaded AI transformation by implementing AI-assisted SDLC practices using SpecKit and GitHub Actions for automated, executable specifications, while delivering agentic product capabilities by securely exposing platform data and services to AI agents and copilots via RAG-based retrieval pipelines and MCP-style extensions.
• Drove modularisation of tightly coupled legacy logic into independently deployable services, improving maintainability, testability and architectural clarity while preserving continuity through targeted, low-risk extraction rather than full rewrites.
• Established observability, CI/CD and DevOps governance as platform capabilities, increasing automated compliance gates from 25% to 75% and improving deployment cadence by 40% across 15+ product versions.
• Improved operational resilience using DORA-aligned practices (lead time ↓50%, SaaS MTTR ↓85%), strengthening reliability and reducing support overhead.
• Coordinated engineering recovery for the German payroll platform during a company-wide P0 ransomware incident; restored platform continuity within 72h, validated data integrity, and rolled out hardened runbooks and automated recovery playbooks.
• Responsible for budget compliance and cost oversight in Engineering, with limited P&L responsibility and participating in the annual COGS/OPEX/CAPEX planning cycle.

• Led infrastructure and security integration project for Private Equity acquisition, reducing security vulnerabilities through streamlined governance.
• Restructured resource allocation for strategic projects, enhancing governance through automated tracking and reporting to executive stakeholders.

• Development of a cloud security strategy
• Implementation of cloud security governance to comply with ISO/IEC 27017 and the CSA CCM
• Creation of a management system to control cloud security with a focus on process design as well as roles and responsibilities
• Definition of security measures to safeguard cloud solutions
• Conducting requirements analyses and defining the scope for cloud security projects
• Achievements: Established an effective NIS2-compliant cloud security governance that meets industry-specific requirements and effectively minimizes cloud security risks

• Preparing an oil company for KRITIS auditing
• KRITIS consulting
• Creating necessary policies, processes, and guidelines in line with KRITIS requirements
• Tools and methodologies used: ISO/IEC 27001, BSI IT Baseline Protection, KRITIS-V