DORA Experts in Frankfurt

Reza N.

Senior IT Security Engineer · Detection & Response · Microsoft Security

Dreieich

Last position:

Senior IT-Security Expert at Teambank AG

Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

Olga L.

IT Business Analyst/Test Manager

Last position:

Business Analyst at VisualVest (Union Investment)

Analyzed, structured, and documented business requirements for digital investment solutions, such as robo-advisors.
Designed applications for new retirement products, including user flows, UX requirements, and functional specifications.
Modeled and optimized business processes and coordinated with stakeholders while taking regulatory requirements in the financial sector into account.

Firas J.

IT Governance & IT Compliance Expert

Friedberg

Last position:

Interim Management Group Head of IT Governance & IAM at French-German Private Bank

Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

Dustin D.

Regulatory Risk Executive | Risk Governance & 2nd LoD in Banking | EU AI Act, DORA, MaRisk, NFR | CEO Secori Advisors GmbH

Bad Homburg

Last position:

External consultant at Deutsche Leasing

2nd LoD/Change the Bank (CtB)

CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).

Robert F.

Interim Project Manager

Kriftel

Last position:

Interim Project Manager at IT services company of a regional energy supplier

Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.

Justina K.

Data Management & Governance Manager

Oberursel

Last position:

Freelance Consultant for Change & Data Transformation at Freelance Fast Data Consulting

Project, Strategic Consulting – building the Data Strategy and Data Governance Policy for the German branch, client (private bank Julius Bär, headquarters Zurich), March 2026 – present

Design and negotiation of the data strategy with key stakeholders, including obtaining board sign-off (strategic consulting) – in this context, regulatory advice on data regulations in the EU and specifically for Germany. The data strategy includes: Data Lifecycle Management: data capture, data storage, data usage, data retention policy, data quality incident management
Definition of milestones and technical feasibility for implementing TOM for the data strategy, data quality checks, metrics, and a metadata inventory to ensure the bank’s compliance with DORA, BCBS239, and MaRisk requirements.

Core project data change, client: (ING Bank, Frankfurt am Main), March – December 2025

Concept development and solution design for new end-to-end processes including technical interfaces
Definition of synchronization logic and data flows between legacy and target systems (decommissioning of legacy systems)
Analysis and validation of data models
Stakeholder communication with product owners, feature engineers, UX designers, and operational teams for decision-making
Analytics and impact assessments, e.g. to assess downstream effects and regulatory requirements
Documentation and comments on technical and business requirements to support implementation in agile squads

Project digitalization of a user group, client: (ING Bank, Frankfurt am Main), as Interim Product Owner, Jan 2025 – present

Co-shaping key decisions on data architecture and process logic in the context of historized data and user login functionality
Development of business solution concepts for migration to the target system, including system integration and data flows
Support with analytics and impact analyses, especially regarding the ability to provide information to law enforcement authorities
Active coordination with stakeholders from different squads to support decision-making and ensure regulatory requirements are met
Creation of test scenarios for operational teams and backend systems in the area of API management using Postman and Bruno.

Najat D.

Data Protection Officer, Auditor and ICT Risk Control Function

Großkrotzenburg

Last position:

Freelance Consultant Microsoft Purview at Bechtlee IT-Systemhaus

Design and global rollout of sensitivity labels (confidentiality labels) for automated classification and encryption of business-critical data.
Definition and rollout of Data Loss Prevention (DLP) policies to protect IP and personal data across endpoints, Exchange, SharePoint, Teams, and non-Microsoft clouds.
Setup of Insider Risk Management policies to detect and contain excessive data leaks and risky user behavior.
Implementation of GDPR and retention requirements through automated retention policies and structured records management.
Technical support for legal teams in internal and external investigations using eDiscovery (Standard/Premium) and Content Search.
Continuous improvement of the security and compliance level by reviewing the Microsoft Compliance Manager and closing gaps (regulations such as ISO 27001, NIS-2)

Christine M.

Freelance specialist in regulatory affairs & IT in banks

Last position:

Management consultant at Freelance

Delivery of ICT / DORA management training under DORA Article 5(4) at various banking institutions
Teaching the key content of DORA requirements with a focus on ICT risks, third-party risk management, incident and problem management, and the information register
Deriving implementation measures and recommendations for management and business units

Richard R.

Vice President– Head of Claims Operations, Europe

Langen (Hessen)

Last position:

Vice President– Head of Claims Operations, Europe at SOMPO International

Managing TPA Manager and a team of 10 Claims Operation Assistants.
Designing and implementing processes and workstreams using Guidewire from the ground up with European claims teams across all lines of business.
Establishing service level agreements (SLAs) and detailed key performance indicators (KPIs) with new business intelligence (BI) reporting, payment and performance analysis.
Developing, steering and analysing 50+ strategic, operational and IT initiatives, driving digital change and AI automation in payments while meeting DORA, GDPR, ACM and BAIT MaRisk regulatory compliance.
Increasing customer satisfaction scores by 80%.
Attracting and mentoring market-leading operational and TPA talent.
Demonstrating strong stakeholder leadership and swift decisional influence.

Andreas I.

Senior Cybersecurity Governance & ISMS Consultant

Last position:

Cybersecurity Specialist Assessor at Bundesnetzagentur

Recognition of national notified bodies
Preparation of cybersecurity competency reports
EU Radio Equipment Directive

Markus M.

Project Manager / Senior Consultant (multiple projects)

Last position:

Project Manager / Senior Consultant (multiple projects) at gkv informatik

Project manager controlling the update to ISO 27001:2022 (certification from ISO 27002:2013 to ISO 27002:2022) including gap analysis, project planning, preparation of internal and external audits, and creation and maintenance of required documentation.
Coordination of adjusting existing measures and implementing new measures according to the new standard’s requirements, as well as continuous monitoring and adjustment of these measures.
Regular reporting to management on progress and risks.
Senior consultant supporting audit reviews with a focus on critical infrastructures (KRITIS), including resolving findings, creating and updating evidence documents, and amending provider contracts.
Senior consultant reviewing all deliverables and responsibilities of the IT provider according to the existing contract: identification of over 1500 deliverables & obligations (D&O), setup of a D&O tracker (claim register), and joint expert review with service owners for various service descriptions (e.g. IT service management, workplace and print services, application and desktop services, endpoint management, email including archiving, file services, software packaging, certification, distribution).
Senior consultant adjusting service scopes in existing service descriptions to enable end-to-end service responsibility of the provider, including identification and analysis of use cases, process analysis and optimization (incident, problem, change), as well as recording and documenting all software products in LeanIX and documenting the contract change.
Focused services: managed software service, application and desktop service, workplace and print services, web server service, container service, M365, SAP/Oscare, output management systems (OMS), telephony and omnichannel management service.
Project manager steering a benchmark based on the existing IT contract, including coordination of the entire benchmark process between the benchmarker, IT provider and client, review of benchmark results, and preparation and conduct of price negotiations with the IT provider.

Kurt R.

CTO / Project Lead & Product Co-Owner

Eschborn

Last position:

Lead Solution Architect (AI HealthTech) / interim CTO & Product Co-Owner at Physio-Agil Frankfurt

General CTO responsibilities (architectural design, operational setup, external runtime product evaluation, investor buy-in, regulatory compliance).
Software development oversight (implementation on deep-dive-in) plus workflow design.
Product co-ownership.
Tech/tools/frameworks: proprietary software (Java, JavaScript), Kubernetes, Postgres, MiniIO, Ollama (internal), several xAI API (external), OpenTofu (Terraform), Keycloak, Kafka, Prometheus, ELK Stack, GitHub, GitHub Workflows, Argo CD, ISO 27001, BSI-ISM, EU AI Act.

Fabrizio D.

Managing Director

Frankfurt

Last position:

Managing Director at ContrailRisks Germany

Founded and lead a cybersecurity advisory firm focused on virtual CISO services for financial, SaaS, and critical infrastructure clients.
Advise executive teams on cyber risk, regulatory compliance (DORA, NIS2, ISO 27001), and incident preparedness.
Built and executed security programs from scratch, driving measurable maturity improvements.
Delivered tailored risk assessments, policies, and cloud security guidance (AWS, Azure).
Scaled the business through client acquisition, partnerships (Vanta, AWS, etc), and a network of senior consultants.

Dmitrii S.

IT Regulatory Compliance & GRC (BCM, IT Risk, DORA, ISO 22301, Outsourcing)

Frankfurt

Last position:

IT Risk & Compliance | DORA | IT Regulatory & Operational Resilience Senior Consultant at Jefferies GmbH

Leading Jefferies’ DORA-driven operational resilience programme by strengthening ICT risk governance, control design, and regulatory readiness across key technology and outsourcing domains. Partnering with senior stakeholders to translate regulatory requirements into pragmatic governance, reporting, and assurance processes suitable for a global investment banking environment.

Developed the Enterprise Register of Information (DORA Art. 28.3) to align with regulatory requirements.
Defined and embedded ICT Risk Appetite and tolerance levels aligned to the Global Operational Risk Framework, strengthening decision-making and risk acceptance governance.
Drove audit readiness by reviewing and re-drafting 50+ IT & Information Security policies, improving clarity, ownership, and control alignment.
Oversaw the Operational Resilience Testing Programme (including penetration testing) and tracked remediation to closure, strengthening control assurance and reducing open findings.
Aligned 10+ intra-group agreements with DORA regulatory standards.
Enhanced executive-level decision-making with an enterprise ICT Risk Dashboard featuring KPIs/KRIs.

Peter W.

Program and Project Manager / Internal Auditor / CISO