DORA Experts in Frankfurt

Reza N.

Senior IT Security Engineer · Detection & Response · Microsoft Security

Dreieich

Last position:

Senior IT-Security Expert at Teambank AG

Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR

Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK

Olga L.

IT Business Analyst/Test Manager

Last position:

Business Analyst at VisualVest (Union Investment)

Analyzed, structured, and documented business requirements for digital investment solutions, such as robo-advisors.
Designed applications for new retirement products, including user flows, UX requirements, and functional specifications.
Modeled and optimized business processes and coordinated with stakeholders while taking regulatory requirements in the financial sector into account.

Christian H.

PM / Management Consultant

Frankfurt

Last position:

NTT Data Center Replacement – €20m at ING

NTT Data Center Replacement – €20m

Strategy & Requirements: Data Center migration and exit strategy for ING Germany, including definition of project scope, objectives, KPIs and comprehensive requirements across cybersecurity, physical security, regulatory and group-wide strategic standards.
Regulatory & Risk Governance: Regulatory and supervisory requirements, risk assessments, ECB notification and audit-ready documentation, achieving formal sign-off with no material findings.
Procurement & Vendor Selection: RFP and selection of Data Center providers, migration specialists and secure transportation partners in cooperation with Procurement and in line with ING Group requirements.
Commercial & Contractual: Complex contract negotiations with selected providers, coordinating Legal, Procurement, Business, Security, Compliance (incl. DORA) and Senior Management across both organisations.
Infrastructure & Data Center Delivery: Data Center fit-out and implementation of base technology, including internal networks, external connectivity, cabling and core services, aligned with required security standards.
Migration & Transition: End-to-end planning and preparation of application and infrastructure migrations, including environment-specific runbooks and coordination with Release Management, followed by handover to the internal ING organisation for execution; migration execution achieved zero unplanned downtime and no customer impact.
Financial & Program Control: €20m Program budget with governance of expenditure, forecasts, milestones, dependencies and critical paths, maintaining delivery within approved budget and timeline parameters.

Dustin D.

Regulatory Risk Executive | Risk Governance & 2nd LoD in Banking | EU AI Act, DORA, MaRisk, NFR | CEO Secori Advisors GmbH

Bad Homburg

Last position:

External consultant at Deutsche Leasing

2nd LoD/Change the Bank (CtB)

CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).

Robert F.

Interim Project Manager

Kriftel

Last position:

Interim Project Manager at IT services company of a regional energy supplier

Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.

Justina K.

Data Management & Governance Manager

Oberursel

Last position:

Freelance Consultant for Change & Data Transformation at Freelance Fast Data Consulting

Project, Strategic Consulting – building the Data Strategy and Data Governance Policy for the German branch, client (private bank Julius Bär, headquarters Zurich), March 2026 – present

Design and negotiation of the data strategy with key stakeholders, including obtaining board sign-off (strategic consulting) – in this context, regulatory advice on data regulations in the EU and specifically for Germany. The data strategy includes: Data Lifecycle Management: data capture, data storage, data usage, data retention policy, data quality incident management
Definition of milestones and technical feasibility for implementing TOM for the data strategy, data quality checks, metrics, and a metadata inventory to ensure the bank’s compliance with DORA, BCBS239, and MaRisk requirements.

Core project data change, client: (ING Bank, Frankfurt am Main), March – December 2025

Concept development and solution design for new end-to-end processes including technical interfaces
Definition of synchronization logic and data flows between legacy and target systems (decommissioning of legacy systems)
Analysis and validation of data models
Stakeholder communication with product owners, feature engineers, UX designers, and operational teams for decision-making
Analytics and impact assessments, e.g. to assess downstream effects and regulatory requirements
Documentation and comments on technical and business requirements to support implementation in agile squads

Project digitalization of a user group, client: (ING Bank, Frankfurt am Main), as Interim Product Owner, Jan 2025 – present

Co-shaping key decisions on data architecture and process logic in the context of historized data and user login functionality
Development of business solution concepts for migration to the target system, including system integration and data flows
Support with analytics and impact analyses, especially regarding the ability to provide information to law enforcement authorities
Active coordination with stakeholders from different squads to support decision-making and ensure regulatory requirements are met
Creation of test scenarios for operational teams and backend systems in the area of API management using Postman and Bruno.

Christine M.

Freelance specialist in regulatory affairs & IT in banks

Last position:

Management consultant at Freelance

Delivery of ICT / DORA management training under DORA Article 5(4) at various banking institutions
Teaching the key content of DORA requirements with a focus on ICT risks, third-party risk management, incident and problem management, and the information register
Deriving implementation measures and recommendations for management and business units

Firas J.

IT Governance & IT Compliance Expert

Friedberg

Last position:

Interim Management Group Head of IT Governance & IAM at French-German Private Bank

Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

Simone K.

Consultant

Last position:

Consultant at EPSM (European Association of Payment Service Providers for Merchants)

Stakeholder management and coordination of board meetings
Acquisition of speakers as well as management and moderation of physical and virtual EPSM meetings for members and guests from the payment industry
Organization and coordination of working groups on regulatory topics (DORA, PCI-DSS, AML, PSD3/PSR)
Consulting and representing EPSM on social channels, on the web and at external events and trade fairs

Richard R.

Vice President– Head of Claims Operations, Europe

Langen (Hessen)

Last position:

Vice President– Head of Claims Operations, Europe at SOMPO International

Managing TPA Manager and a team of 10 Claims Operation Assistants.
Designing and implementing processes and workstreams using Guidewire from the ground up with European claims teams across all lines of business.
Establishing service level agreements (SLAs) and detailed key performance indicators (KPIs) with new business intelligence (BI) reporting, payment and performance analysis.
Developing, steering and analysing 50+ strategic, operational and IT initiatives, driving digital change and AI automation in payments while meeting DORA, GDPR, ACM and BAIT MaRisk regulatory compliance.
Increasing customer satisfaction scores by 80%.
Attracting and mentoring market-leading operational and TPA talent.
Demonstrating strong stakeholder leadership and swift decisional influence.

Andreas I.

Senior Cybersecurity Governance & ISMS Consultant

Last position:

Cybersecurity Specialist Assessor at Bundesnetzagentur

Recognition of national notified bodies
Preparation of cybersecurity competency reports
EU Radio Equipment Directive

Dmitrii S.

IT Regulatory Compliance & GRC (BCM, IT Risk, DORA, ISO 22301, Outsourcing)

Frankfurt

Last position:

IT Risk & Compliance | DORA | IT Regulatory & Operational Resilience Senior Consultant at Jefferies GmbH

Leading Jefferies’ DORA-driven operational resilience programme by strengthening ICT risk governance, control design, and regulatory readiness across key technology and outsourcing domains. Partnering with senior stakeholders to translate regulatory requirements into pragmatic governance, reporting, and assurance processes suitable for a global investment banking environment.

Developed the Enterprise Register of Information (DORA Art. 28.3) to align with regulatory requirements.
Defined and embedded ICT Risk Appetite and tolerance levels aligned to the Global Operational Risk Framework, strengthening decision-making and risk acceptance governance.
Drove audit readiness by reviewing and re-drafting 50+ IT & Information Security policies, improving clarity, ownership, and control alignment.
Oversaw the Operational Resilience Testing Programme (including penetration testing) and tracked remediation to closure, strengthening control assurance and reducing open findings.
Aligned 10+ intra-group agreements with DORA regulatory standards.
Enhanced executive-level decision-making with an enterprise ICT Risk Dashboard featuring KPIs/KRIs.

Kurt R.

CTO / Project Lead & Product Co-Owner

Eschborn

Last position:

Lead Solution Architect (AI HealthTech) / interim CTO & Product Co-Owner at Physio-Agil Frankfurt

General CTO responsibilities (architectural design, operational setup, external runtime product evaluation, investor buy-in, regulatory compliance).
Software development oversight (implementation on deep-dive-in) plus workflow design.
Product co-ownership.
Tech/tools/frameworks: proprietary software (Java, JavaScript), Kubernetes, Postgres, MiniIO, Ollama (internal), several xAI API (external), OpenTofu (Terraform), Keycloak, Kafka, Prometheus, ELK Stack, GitHub, GitHub Workflows, Argo CD, ISO 27001, BSI-ISM, EU AI Act.

Fabrizio D.

Managing Director

Frankfurt

Last position:

Managing Director at ContrailRisks Germany

Founded and lead a cybersecurity advisory firm focused on virtual CISO services for financial, SaaS, and critical infrastructure clients.
Advise executive teams on cyber risk, regulatory compliance (DORA, NIS2, ISO 27001), and incident preparedness.
Built and executed security programs from scratch, driving measurable maturity improvements.
Delivered tailored risk assessments, policies, and cloud security guidance (AWS, Azure).
Scaled the business through client acquisition, partnerships (Vanta, AWS, etc), and a network of senior consultants.

Peter W.

Program and Project Manager / Internal Auditor / CISO