DORA Experts in Essen

• Established a cyber resilience framework for AI-accelerated threats in the Frontier AI Threat Endurance (FATE) program: capability assessments, maturity assessments and gap analyses covering cyber security, operational resilience, incident response, recovery and governance, followed by target concepts and improvement measures
• Supported action owners from specification through implementation: implementation roadmaps, decision papers, management presentations and governance reporting, as well as audit- and supervision-ready documentation; managed stakeholders from IT, Information Security, Risk Management, Operational Resilience, Business Continuity and the business units

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

KEY PROJECTS

Since 05/2023 | Bank | Senior Cyber Security Consultant (external)

• Advising and guiding the system owners in creating and further developing IT security concepts
• Coordinating and tracking the remediation of findings from reviews and audits
• Advising on the implementation of regulatory requirements for information security

10/2023 – 02/2024 | Fintech | Project Manager (external)

• Project management to close various audit gaps in the field of information security
• Conceptual design and implementation of an information security management system based on ISO/IEC 27001
• Creation and further development of ISMS documents and processes

• Technical lead for CI/CD modernization in the "Group Archive 4.0" system
• Architecture and steering responsibility according to the statement of work
• Setting up modern build and deployment processes
• CI/CD coaching and enablement of the internal development team
• Integration of modern DevOps, security, and compliance standards
• Ensuring technical governance, including collaboration with internal audit and BaFin
• Independently executing the modernization measures
• Supporting the team in adopting new technologies and methods

• Transition of Microsoft Azure operations to BTC AG
• Responsibility: Budget of 60k €
• Personnel: Managed 5 people
• Tools: Office 365, JIRA, Confluence

NIS2 Implementation Project and ISMS Development Based on IT-Grundschutz

Municipal utilities, public-law institution

• Analysis of the current compliance status regarding the requirements of the NIS Directive (NIS-2, EU 2022/2555).
• Identification of critical infrastructures and processes within the organization.
• Development of an action plan to meet NIS requirements.
• Conducting a risk analysis in accordance with BSI Standard 200-3 as the basis for the security concept.
• Preparation of an individual security concept including technical and organizational measures according to BSI IT-Grundschutz.
• Preparatory support for an optional certification according to BSI IT-Grundschutz.
• Adaptation of existing security policies and development of new ones for access controls, incident management and data protection.
• Consideration of municipality-specific requirements and integration of the measures into the existing IT infrastructure.
• Documentation of the results and preparation of audit-ready evidence for audits.

Tools, languages and frameworks used: MS Office, Verinice, IT-Grundschutz (200-x), NIS-2 (EU 2022/2555), ISMS, AI-Act (EU 2024/1989)

• CHG Meridian AG is a financial company focused on leasing in the areas of IT technology, logistics and medical technology and is regulated by BaFin. One part of the company is Return to Remarketing, where devices delivered to the technology center (notebooks, smartphones, tablets, etc.) are prepared for resale. The project I supported was responsible for enabling damage assessment of returned lease devices, documenting them visually in the form of pictures, enabling invoicing for the customer, and making the pictures available via the in-house customer platform. This was achieved through a combination of in-house development within the internal development department and the use of SaaS products. The second project was the transition of SaaS tendering software, purchased by the business unit, into the operations of the CHG IT department. Evaluation of security questions in relation to BaFin requirements, development of an authorization concept, implementation of single sign-on, documentation of the application in the CHG systems (CMDB, iKnow, etc.) and handover into operations.

Used technologies and methods: NIS2, DORA, agile software development, Scrum, Kanban, ServiceNow, SaaS, MS Teams, MS SharePoint, Active Directory, Entra ID, CMDB, incident management, change management, request management, service level agreement

• Overall responsibility for strategic and operational procurement, Procurement Management (11 FTE).
• Further development of the procurement and procurement organization, including task and role model.
• Management of cross-functional special projects (e.g. value engineering, design-to-cost).
• Development and implementation of a holistic sourcing and procurement strategy with a focus on resilience, ESG, de-risking, decoupling and cost performance.
• Execution of a comprehensive procurement transformation with a new supply chain strategy alignment.
• Reorganization of the procurement team to improve efficiency through clear role allocation and relief from non-core and non-functional tasks.
• Professionalization of contract management processes and supplier development programs.
• Process optimization along the S2C and P2P chain, including standardization and automation in line with MDR (EU Regulation 2017/745), GxP compliance & quality management systems ISO 9001 and ISO 13485.
• KPI development and optimization of the KPI system for performance and efficiency measurement in critical paths and missing parts.
• Coaching the team in strategic procurement work, project management and procurement due diligence.
• Implementation of AI-supported tools for sourcing, spend analysis and inventory management to optimize inventory.
• Achieved inventory reduction of ~31% through professional inventory management.
• Management of two cost reduction (cost avoidance) programs with quantified results: ~50% reduction in manufacturing costs for one core component and ~64% reduction in material costs for the successor platform through redesign and category sourcing.
• Savings in the low double-digit million range versus the baseline.
• Material groups: contract manufacturing, PCBA, EMS, blower, silicone injection molding, power supplies, batteries, displays, hoses, masks, valves, foams, cables, sensors, wireless modules (2G–5G), telemedicine components, laboratory services.

• Developed an IT governance and oversight framework aligned with DORA requirements
• Coordinated and trained external service providers
• Optimized financial processes and performance

• Led the subproject for implementing Vulnerability Response as part of DORA
• Documented the current processes in compliance, risk & security
• Created the functional design for introducing application, infrastructure, and cloud vulnerabilities
• Agile management of the integration service provider, the technical department, and the company's cross-functional teams
• Integrated the V scanners Tenable, Qualys and Defender, as well as NVD and CISA/KEV
• Integrated GitLab Ultimate for importing and processing SBOMs
• Developed automation rules to match scan results with CIs in the CMDB, assign vulnerabilities and remediation tasks, handle approvals (false positives, exceptions) and closures
• Calculated multiple risk scores and priorities
• Defined dashboards and reports (Workspaces, Performance Analytics)
• Aligned the new processes, especially to improve the CMDB data quality (according to CSDM)

• Transforming complex AI use cases into practical solutions
• Analyzing IT/telecom end-to-end business processes from requirements to order (RACI), modeling with IBO Prometheus
• Risk management
• Assessing digitalization potential, AI, and strategic supplier analysis against the IT target picture
• Optimizing offer and cost calculation bases in strategic and operational IT procurement
• Optimizing supplier strategy (DSGV and financial institutions)
• Exploring various approaches to cost optimization and simplifying supplier management
• Optimizing contracts and licensing management (e.g., SAP, Microsoft, IBM, Cisco, BMC, etc.)
• Desk and field expediting with external partners
• Possible outsourcing and consolidation of services with fewer suppliers
• On-time handover of work packages within agreed time and budget

• Assisting in drafting, reviewing, and negotiating contracts and other legal documents (NDAs, termination agreements, termination notices, etc.)
• Research and analysis of legal issues
• Implementation of legal and regulatory requirements (GDPR, NIS2, DORA, Data Act, AI Act)
• Supporting compliance with legal requirements and internal policies (AI Regulation, Accessibility Enhancement Act, Supply Chain Due Diligence Act, Whistleblower Protection Act)
• Documenting and filing important contract documents in the digital system
• Negotiating and evaluating individual contract clauses