DORA Experts in Germany
, matched in minutes from over 15,000 CVs with the power of AIHire experts who guide DORA readiness, ICT risk management and incident reporting, while connecting regulatory requirements with practical controls, supplier oversight and resilience testing. FRATCH matches you quickly and precisely with vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used DORA
Nikolaus B.
Last position:
Information Security, IS-Governance & Crossfunctional Governance at Zürich Beteiligungs-AG (Deutschland)
- Conducted security assessments for supplier qualification, business unit onboarding, and ongoing reviews of service providers and partners (Ongoing Assurance).
- Assessed technical and organizational measures (TOMs) against GDPR and information security requirements.
- Handled security reviews and approval processes in the Global Approval Navigator (OneTrust).
- Advised business units and IT on information security, security requirements, and risk-appropriate measures.
- Supported the development of SOC/SIEM processes and tools as part of the ISMS in line with ISO/IEC 27001.
- Analyzed cyber threats and coordinated security objectives and measures to address Security Findings with the SOC team.
- Monitored and assessed current security advisories and security-related metrics (KPIs).
- Reviewed, assessed risks, and approved exception requests (Security Exceptions).
- Independently analyzed and handled Security Events and supported the handling of security incidents.
- Planned and supported awareness initiatives to strengthen security awareness.
- Created, implemented, and reviewed information security policies and standards.
- Conducted protection needs analyses and gap assessments to identify security gaps and risk deviations.
- Defined and reviewed technical and organizational risk treatment measures.
- Advised on Third Party Governance with consideration of DORA, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, and BCM in line with ISO 22301.
Alwin G.
Last position:
IT Interim Manager & AI Strategist
- Founder of CheironX: AI-supported GRC management (ISO 27001, BSI IT-Grundschutz, TISAX, DORA)
- Strategic focus on Agentic AI and GenAI for modern IT Governance, Risk & Compliance Management
- IT interim management and strategic consulting
Matthias K.
Last position:
Business Owner at AKM
Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as Support, Finance, Developers, and Security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA topics and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.
Tools/Frameworks: FIDO, Yubikey, Veridium, BSI Grundschutz, NIST
Vladimir E.
Last position:
Technical Project Manager / Freelancer at Deutsche Bank
- Engaged within the Information and Security Management division for a Proof of Concept (PoC) project focused on developing a Client Security Portal.
- Managed project resources across the UK, India, and Germany.
- Architected and deployed the PoC solution leveraging a modern Java stack, Google Cloud Platform (GCP) with Kubernetes, and Active Directory (Entra ID) for authentication.
- Implemented OAuth 2.0 for authorization.
- Ensured DORA alignment according to Deutsche Bank security rules and regulatory preparation.
Christian F.
Last position:
Project Lead & Cyber Security Consultant at Deutsche Börse Gruppe
- Established a cyber resilience framework for AI-accelerated threats in the Frontier AI Threat Endurance (FATE) program: capability assessments, maturity assessments and gap analyses covering cyber security, operational resilience, incident response, recovery and governance, followed by target concepts and improvement measures
- Supported action owners from specification through implementation: implementation roadmaps, decision papers, management presentations and governance reporting, as well as audit- and supervision-ready documentation; managed stakeholders from IT, Information Security, Risk Management, Operational Resilience, Business Continuity and the business units
Oliver V.
Last position:
Interim Manager and Management Consultant at Self-employed
- Developed a market entry strategy for the claims division of an insurance services provider.
- Analyzed and optimized existing claims processes.
- Defined management metrics and KPIs to improve performance and efficiency.
- Advised management on market positioning and process digitalization.
- Led an IT team of 13 employees as part of an interim vacancy cover.
- Ensured stable IT operations and managed external IT service providers.
- Led regulatory projects, particularly the implementation of the DORA regulation.
- Prepared and supported an IT security audit.
- Change management and conflict moderation in a challenging transformation environment (FI migration).
Robert F.
Last position:
Interim Group CIO / CISO at Kellenberger
- Private Equity owned precision grinding machines for Auto, Military & Aerospace – 1200 Employees
- Acting as Interim Group CIO / CISO consolidating Global IT back to Europe – M&A consolidation
- Managed major Security event and post event cleanup – Reporting to regulators
- Performed Vendor & Contract Management – full assessment of capabilities
- Guided Infrastructure refresh & Security Hygiene assessments
Federico L.
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As Germany’s only large integrated energy company, EnBW covers the entire value chain—from energy generation and distribution to serving customers. The company is expanding its renewable energy sources, working toward a socially responsible coal phase-out, and advancing key technologies such as the use of green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developing and implementing an end-to-end process view that takes both technical and organizational aspects into account Ensuring end-to-end control of all IAM-related technical services Establishing clear responsibilities and accountabilities across the IAM landscape Working with various departments to identify and optimize an end-to-end architecture and act as the Single Point of Contact (SPoC) for Information Security Introducing and monitoring governance policies to ensure compliance and security Continuously improving IAM processes and systems through regular audits and service reviews Taking part in external process audits as part of official audits against ISO standards Further developing the policy that sets administrative requirements and procedures, and aligning it with administrative departments Conceptually developing the KPI system for measuring process quality
Martin R.
Last position:
Fractional CIO - IT Carve-out & Post-Merger Integration at XTRONIC GmbH & iinovis GmbH (Accursia Capital)
Carve-out and post-merger integration of two automotive engineering companies under Accursia Capital, 6 locations in Germany and Spain, 250+ employees after the carve-out. Reporting directly to the investor, with overall IT responsibility for both companies.
- Consolidation of the ERP landscape into one instance (replacement of SAP legacy)
- TISAX certification
- M365, identity and data center migration
- Replacement of end-of-life infrastructure
- Weekly investor reporting
Results:
- Critical infrastructure risk eliminated, backup and platform stabilized
- One IT organization established for both companies
- Weekly investor reporting successfully established
Peter D.
Last position:
Security Consultant at Public-law institution of the city administration
- Requirements management, process planning, interface function, ISMS setup, and documentation
- Setup and establishment of an ISMS according to ISO 27001 and establishment of emergency management / ITSCM
- Coordination of the circumstances with the public-sector IT service provider
- Consideration of KRITIS relevance within the scope and implementation of a B3S
- Development of requirements for document control and the continuous improvement process
- Preparation of relevant project documents
- Analysis of existing processes and preparation of guidelines
- Requirements gathering for ISMS and ITSCM and coordination with the IT service provider, including definition of interfaces
- Analysis of communication processes and escalation paths
- Review of documents for risk management, ISMS, emergency preparedness, and emergency response
- Redesign of the complete documentation and preparation of new relevant documents
- Development of necessary rules, policies, and concepts
- Interface between customer and service provider to ensure document quality
- Coordination of protection needs with specialist departments, particularly regarding KRITIS relevance, and planning of resulting measures
- Development of preventive measures to minimize the risk of data center outages in scenarios such as pandemics or ransomware attacks
- Definition of the test strategy for IT emergency exercises
- Initiation of necessary awareness training measures for specialist departments
- External Information Security Officer
- Introduction of document control
Onur K.
Last position:
Project Manager & Outsourcing Manager at SENEC GmbH (EnBW Group)
- Built a scalable nearshore IT developer hub (Croatia, Czech Republic, Poland) as an independent company through a BOT model (Build – Operate – Transfer)
- Identified, selected, and managed full-service agencies; introduced management and control mechanisms, including KPIs, SLAs, and regular service reviews
- Prepared and reviewed data processing agreements and framework contracts in coordination with Legal & Compliance; integrated regulatory requirements (including KRITIS) into process design
- Advised on cloud vs. on-premise strategies, data storage, and authorization concepts; supported Procurement with tendering and service provider evaluations
- Managed change and process harmonization between internal teams and nearshore partners; reported to executive management, CFO, and CIO
Result: Scalable IT developer hub with an audit-ready governance model, reduced operating costs, and accelerated product development.
Reza N.
Last position:
Senior IT-Security Expert at Teambank AG
- Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
- Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
- Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
- Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
- Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
- Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
- Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR
Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK
Mahmoud Q.
Last position:
Information Security & GRC Expert at GLG (Gerson Lehrman Group)
As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.
My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).
The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.
Jens H.
Last position:
Interim CTO (occasional assignments) at Fujitsu / FSAS
Stabilization of an Azure/.NET landscape in live operation.
- Architecture, DevOps, and operational readiness; technical decisions under time pressure
- Azure DevOps, monitoring, ETL/ELT, cloud security, FinOps, and data-mesh-related topics
Technologies: Azure DevOps, .NET, CI/CD, monitoring, FinOps
Michael S.
Last position:
Establishment of Compliance/TPRM at Haftpflichtkasse
Establishment of Compliance Department & DORA Operationalization
- Establishment of a complete compliance organization in accordance with DORA
- Development and operationalization of the SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, newsfeeds)
- Establishment of a decentralized risk and action register
- Preparation of GAP analyses and derivation of measures
- Establishment and maintenance of the Outsourcing Information Register
- Use of proprietary TPRM frameworks, checklists and process models
Establishment of Compliance Department & DORA Operationalization
- Establishment of a complete compliance organization in accordance with DORA
- Development and operationalization of the SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, newsfeeds)
- Establishment of a decentralized risk and action register
- Preparation of GAP analyses and derivation of measures
- Establishment and maintenance of the Outsourcing Information Register
- Use of proprietary TPRM frameworks, checklists and process models
- Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
- Overall responsibility for establishing a Compliance, Governance and Risk organization
- Establishment of an integrated GRC model and executive reporting for the Management Board.
Discover over 15,000 top freelancers
Statistics of experts using DORA
Aggregated from the professional profiles of matched freelancers.
Experience
22 years
Position duration
2.3 years
Positions per freelancer
16
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Banking and Finance, Professional Services
Certification focus areas
Information Technology, Project Management, Quality Assurance
Bachelor's degree or higher
89%
Master's degree or higher
61%
Doctorate
8%
Certifications per freelancer
7
Most common languages
German, English, French
Speak two or more languages
98%
Based on our profile pool as of 29 Oct 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Discover detailed DORA rate benchmarks:
Explore rate insightsAverage rates of experts in Germany using DORA
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 29 Oct 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
DORA experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (84%)
- Banking and Finance (78%)
- Professional Services (60%)
- Insurance (51%)
- Manufacturing (43%)
- Government and Administration (38%)
- Automotive (33%)
- Healthcare (31%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
DORA in practice
DORA, the Digital Operational Resilience Act, establishes a common framework for digital operational resilience in the European financial sector. It addresses how organisations identify, manage and report ICT risks across critical business services, systems and external providers.
Core requirements
DORA brings together ICT risk management, incident handling, resilience testing and information-sharing practices. It also introduces stronger oversight of critical ICT third-party providers and requires clear accountability from the organisation’s management body.
Systems and controls
Successful implementation connects regulatory requirements with daily operations. Work may include mapping ICT assets and dependencies, defining recovery objectives, maintaining risk registers, documenting controls and setting evidence trails for audits. Security, continuity and supplier management must work as one process.
Typical workstreams
- Assessing current DORA readiness and control gaps
- Building ICT risk management frameworks and registers
- Designing major ICT-related incident workflows
- Preparing resilience testing and remediation plans
- Reviewing contracts and registers for ICT third parties
When specialists help
Companies often bring in freelance specialists when a DORA programme needs independent structure, sector knowledge or delivery capacity. This is useful during regulatory gap assessments, operating model changes, supplier reviews, audit preparation or the integration of compliance work into existing risk and security processes. In Germany, collaboration may involve remote teams across Europe, on-site workshops and documentation in English or German.
Strong DORA expertise
Strong professionals translate legal expectations into controls that teams can operate and evidence. They understand governance, information security, business continuity, operational risk, cloud dependencies and third-party management without treating compliance as a document exercise. Look for clear mappings, practical ownership models, traceable evidence and recommendations that fit the organisation’s risk profile.
Frequently asked questions
Before you brief your next project: the most common questions about DORA.
DORA is used to strengthen digital operational resilience across financial entities and their important ICT providers. It covers ICT risk management, incident reporting, resilience testing, information sharing and oversight of critical third parties.
DORA is tailored to financial-sector operational resilience and sets specific expectations for ICT risk, incidents, testing and third-party oversight. NIS2 has a broader cybersecurity scope across essential sectors, while ISO 27001 provides a certifiable information security management framework; they can support DORA but do not replace it.
A strong DORA specialist should connect regulatory interpretation with ICT risk, information security, business continuity, cloud governance, supplier management and internal audit. Experience with control frameworks, incident processes and evidence management is also valuable.
The right level depends on the workstream rather than a fixed time period. A readiness assessment may need broad experience across governance and controls, while a focused supplier review or incident process can be handled by a specialist with deep expertise in that area.
DORA work is often suitable for remote collaboration because assessments, control mapping and documentation use shared systems and structured workshops. German organisations may still prefer on-site sessions for management interviews, sensitive risk discussions or process walkthroughs, with English or German language capability agreed at the outset.
Ask for examples of how the professional turned regulatory requirements into owned controls, measurable evidence and workable processes. Strong DORA expertise is visible in clear dependency mapping, realistic testing plans, disciplined incident workflows and recommendations that reflect business impact.
DORA applies across a defined group of financial entities, not only banks. Its scope also includes organisations such as insurers, investment firms, payment institutions and other regulated entities, subject to the detailed rules for each category.
Typical DORA deliverables include a readiness assessment, ICT risk register, control and dependency mappings, incident reporting procedures, testing plans, third-party registers and remediation roadmaps. The documents should identify owners, evidence requirements and practical next steps rather than repeat legal text.
The average hourly rate of freelancers in Germany who have used DORA in their recent projects is 121 €, which corresponds to a daily rate of about 969 € based on an 8-hour working day.
Of the freelancers in Germany who have used DORA in their recent projects, 89% hold at least a Bachelor's degree, 61% hold at least a Master's degree, and 8% hold a doctorate.
On average, freelancers in Germany who have used DORA in their recent projects have 22 years of professional experience, with a single engagement typically lasting around 2.3 years.
The most common languages among freelancers in Germany who have used DORA in their recent projects are German (99%), English (98%), and French (24%).
The most common industries among freelancers in Germany who have used DORA in their recent projects are Information Technology (84%), Banking and Finance (78%), and Professional Services (60%).
The most common business areas among freelancers in Germany who have used DORA in their recent projects are Information Technology (95%), Project Management (91%), and Operations (69%).
Main locations of FRATCH Experts, who have recently used DORA
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Berlin 
Cologne 
Frankfurt 
Dusseldorf 
Essen Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
