DORA Experts in Düsseldorf

• Transition of Microsoft Azure operations to BTC AG
• Responsibility: budget of €60k
• Staff: leadership of 5 people
• Tools: Office 365, JIRA, Confluence

• Service owner of the receivables management platform Ikarus
• Management and coordination of external 1st-level service providers
• Team leadership and building ITIL-compliant support structures
• Managing the handover to 3rd-level support (internal & external, incl. vendor/development)
• Stakeholder management between the business unit, IT, and external partners
• Jira ticket automations and maintenance of Confluence documentation

• DORA consulting and system optimization
• Process analysis of existing business processes that are complex from both a business and technical point of view
• Analysis of the individual business processes in the relevant business areas Trading, Back Office, Settlement, Custodian Bank
• Interface between the business units and IT to understand and define requirements
• Creation of a business concept incl. adjustments and implementation of software applications and their interfaces to the systems
• Preparation of a decision template for the management board for project approval
• Setting up and running project meetings with the relevant stakeholders and documenting them
• Close collaboration with the stakeholders
• Coordination and control of the analysis
• Creation and planning of resources and budget
• Onboarding of large banks (Asia and Eastern Europe) for Depot B
• Migration of portfolio holdings (volume around EUR 70-100 million)

• Developed an IT governance and oversight framework aligned with DORA requirements
• Coordinated and trained external service providers
• Optimized financial processes and performance

• Led the subproject for implementing Vulnerability Response as part of DORA
• Documented the current processes in compliance, risk & security
• Created the functional design for introducing application, infrastructure, and cloud vulnerabilities
• Agile management of the integration service provider, the technical department, and the company's cross-functional teams
• Integrated the V scanners Tenable, Qualys and Defender, as well as NVD and CISA/KEV
• Integrated GitLab Ultimate for importing and processing SBOMs
• Developed automation rules to match scan results with CIs in the CMDB, assign vulnerabilities and remediation tasks, handle approvals (false positives, exceptions) and closures
• Calculated multiple risk scores and priorities
• Defined dashboards and reports (Workspaces, Performance Analytics)
• Aligned the new processes, especially to improve the CMDB data quality (according to CSDM)

As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW.  Developed and implemented a holistic process view covering both technical and organizational aspects  Ensured end-to-end control of all IAM-related technical services  Established clear responsibilities and accountabilities within the IAM landscape  Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security  Introduced and monitored governance policies to ensure compliance and security  Continuously improved IAM processes and systems through regular audits and evaluations  Participated in external audits of the process as part of official ISO audits  Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units  Conceptually advanced the KPI system to measure process quality

• Processing entries in the Third Party Risk Management (TPRM) process
• Conducting clean-ups of existing business relationships
• Creating, processing, and documenting requests
• Reviewing entries from process participants based on existing files
• Collaborating with risk SMEs (Subject Matter Experts) and vendor contacts
• Working closely with procurement, information security, and data protection to align business requirements
• Implementing regulatory requirements (VAIT, DORA) and ensuring compliance and risk management

• Independently develop policies, guidelines, and frameworks for ICT risk management and information security
• Advise business units on ICT risk management and information security
• Further develop the ICT risk management framework that governs the identification, assessment, and control of ICT risks
• Evaluate the Information Security Management System (ISMS) and adjust it for new challenges
• Conduct risk analyses to identify and assess potential ICT risks and information security risks for the Metzler Group
• Advise on defining and implementing measures to reduce risks and improve the resilience of ICT systems
• Advise on ensuring compliance with relevant internal and external regulatory requirements (MaRisk, DORA, BAIT, BSI IT baseline protection, ISMS, ISO 27001, ISO 42001, ISO 27005, BCM ISO 22301)
• Advise on internal and cross-functional projects (SAP DORA compliance, Target2, Section 8a BSI Act)

• Creation of business and technical concepts as well as support for enterprise architecture management as part of the migration to the Adesso standard insurance solutions and the renewal of surrounding systems

• Interface definitions

• Business analysis and creation of the business concepts for input management and sales

• Creation of architecture guidelines and processes

• Processing technical and business decisions in the architecture board

• Definition of service processes and system management aspects

• Creation of the technical target operating model

• Creation of an integration architecture for AI/LLMs from the providers Commasoft and Insiders

• CommaSoft (Alan) webpages and web services

• Insiders for Smartfix based on web services

• Creation of a question catalog for a security/regulatory check.

• Analysis of threats using threat modeling / STRIDE incl. creation of a set of measures to secure the systems

System environment: Jira, Confluence, Java, Enterprise Architect, VAIT/DORA, KritisV, GDPR, IT ServiceMgmt, Adesso Ecosphere and Insure Health, DoPIX and successor product, SmartFix, SmartFlow, Zabas, Kolumbus, Clarc archive, BiPRO, AI / LLM, MS Azure, AWS, TOM/FMO

• Advice on governance and information security topics: BAIT, MaRisk
• Creating governance documents (policies, guidelines)
• Developing emergency manuals
• Based on BSI IT baseline protection standard 200-4 and ISO2700x