GDPR Experts in Hamburg

Technologies: n8n, Notion, OpenAI API, Claude, MS AI Foundry, MS CoPilot Studio, MS CoPilot, LLM, Node.js, Vercel, LangGraph, PostgreSQL, pgEdge, pgvector, Docker, LangChain, Ollama, Open WebUI

• Continuous evaluation and prioritization of internal automation needs
• ~20 AI agents in active use: research, content pipelines, document processing
• 5 n8n workflows for automated data and process control
• Architecture built on the same principles as in customer projects: state management, event-driven orchestration, API integration
• Ongoing operation and further development

• Complete overhaul of the ISMS according to ISO 27001
• Conducted a comprehensive gap analysis
• Reduced ISMS documentation by 30% through consolidation and process optimization
• Introduced a full PDCA cycle for continuous improvement
• Established the ISMS within the company
• Implemented the necessary processes
• Managed and conducted internal and external audits
• Developed and implemented a company-wide risk management system
• Deployed an ISMS tool including process design and training
• KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
• NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
• Led a cybersecurity team of 3 members
• Conducted various internal and external audits, managed providers, introduced continuous improvement
• Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
• Redesigned the security architecture, reducing administrative efforts by 20%
• Implemented ITIL processes (e.g., change management)
• Revised service agreements with internal and external providers
• Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
• Managed a budget of one million euros

• Privacy by Design and by Default
• Working with OneTrust: creating and managing records for requesters
• Interface role: mediation and communication between the DPO and the specialist departments, including clarifying data protection questions
• Handling data protection incidents: analysis, documentation, and coordination of measures
• General advice on data protection topics: support with data protection-related questions
• Process optimization: identifying room for improvement in processes and implementing changes
• Documentation & reporting: creating reports on data protection incidents or general data protection topics for the DPO and weekly reports for the line manager for presentation in the performance board
• Risk assessment & compliance: support in assessing data protection risks in new projects or processes
• Distribution and independent handling of email requests or requests from the DPO: all incoming tickets are divided among team members, with no specialization in the tasks. Tickets are created and tracked in Jira.

Approach/Methods:

• Stakeholder management
• Communication at C-level
• Timeline and implementation plan

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Data-analysis, Preparation, gathering and coordination of business requirements for retrieval of monthly- and long term (CLV – relevant) cost- and revenue-components per contract for a customer–base–grouping project (HUB–Project) for B2C-Postpaid-Controlling
• Concept and Implementation of cost- and revenue-KPIs calculation and corresponding CLV–reports (Oracle, Perl, SVN, MS SQL Server, MS Power BI, Serviceware Performance Analytics)
• Operational support of the HUB-Project – various ad-hoc reports, deployments, job-scheduling etc. (Oracle, SVN, BICSuite–Scheduler, DWSODA etc.)
• Analysis, implementation, retrieval and reporting of various physical and financial KPIs for B2P-Prepaid Business on an existing data-mart (Oracle, Perl)

I help marketing teams and leaders get from data to decision - understanding their business model, defining what to measure, and building the tracking and reporting infrastructure to make it happen.

• Built and optimized analytics setups for 60+ clients across D2C, E-Commerce, SaaS, LeadGen and Subscription businesses in my career - from early-stage startups to enterprises
• Core focus: GA4 & GTM tracking architecture (incl. server-side), consent-compliant measurement, marketing dashboards (Power BI) and attribution
• Trusted long-term partner: most client relationships extend well beyond the initial project into ongoing strategic and operational support (NPS > 9.4)
• Regularly act as analytical sparring partner for marketing leads and C-level stakeholders, bridging the gap between data, tech and business strategy

• Planning, steering, and monitoring the Corporate Responsibility Tech Enablement project for IT
• Concept and implementation of the EUDR (EU Deforestation Regulation)
• Concept and implementation of the Eco-Design Regulation
• Continued support of projects within the Corporate Responsibility strategy
• Definition and review of guidelines (e.g. governance, success metrics) and, if needed, analysis of issues and their solutions
• Overall project management, marketing, communication, and quality assurance for the projects
• Creation of the project plan including timeline/roadmap, budget, and resources
• Ensuring compliance with budget and deadlines
• Defining guidelines for project control, methods, and priorities
• Planning and tracking resources and effort, also together with other IT teams
• Evaluation of projects and preparation of results (reporting to management)
• Identification and reduction of risks
• Regular communication with stakeholders
• Steering internal and external stakeholders and service providers (Jira, Confluence, backlog management, task tracking, SharePoint, MS 365 platform etc.)
• Development of standards and process automation

Label: Azure Cloud, Jira, Confluence, Power BI, SAP BW, AWS, Miro, Bee360, Draw.io, SharePoint, MS 365 platform, Trello etc.

• Project lead ‘Cloud Migration’ for moving the on-premise production environment to Scaleway.
• Transformed a Docker-Swarm legacy setup to a modern Kubernetes-based cloud environment.
• Architected a GDPR-compliant cloud landscape and deployment setup – 100% European sovereign cloud.
• Hands-on bootstrapped the cloud environment with Terraform, ArgoCD, and GitLab Pipelines CI/CD.
• Replaced the legacy VPN with modern mTLS PKI and deep AD integration.
• Managed an 11-headed agile team using Kanban, moderating team meetings and plannings.
• Successfully finished the migration, moving infrastructure, services, and data, from planning to execution.

• Strategic consulting on marketing funds (WKZ) and retail media, focusing on monetization opportunities and data-driven business models
• Conducting a portfolio analysis of existing WKZ measures to assess the revenue and ROI impact of WKZ investments on supplier performance
• Potential analysis of digital WKZ products and initiatives to identify growth and efficiency levers
• Preparing and presenting the results to management and deriving a strategic move-forward plan
• Designing and facilitating several executive workshops to develop a holistic retail media vision and transformation roadmap
• Defining and prioritizing retail media business cases for data-driven evaluation of investment options
• Developing a technical target architecture considering heterogeneous ERP infrastructures and designing an integrated loyalty program
• Designing change management, including impact analysis on organizational structures and processes
• Creating and presenting C-level decision templates
• Establishing a clear retail media governance structure and technical foundation for data-driven marketing
• Developing a roadmap for implementation in 2026

Consulting on compliance and data protection topics in the telecommunications environment.

• With the CPQ process change from "ETO" to "CTO", the previous tools "Selling" and "Camos CPQ" are replaced by "MS Dynamics 365" and "Configure One CPQ".
• Assessment of the current vs. target state and recommendations for action.
• Assessing the project from an external perspective (both technically and in terms of content).
• Evaluating the Configure One system in the context of LMT.
• Jointly develop a concept for further CPQ implementation and create an MVP.
• Change and stakeholder management.
• Product Owner for setting up follow-up projects.
• Handover to business units.
• Final consulting on open issues (e.g. future controlling).

• Conducting e-commerce courses covering basics, digital business models & trends, competitor analysis, product casting, shop P&L, minimum viable product process, funnel & conversion rate optimization, shop platform evaluation, first steps with Shopify, shop structure setup, payment & shipping systems, ERP & interfaces, fulfillment, process optimization, customer centricity, affiliate marketing

• Content Management: Developing the messaging and creating content for the website, brochure, and social media activities as part of a product launch in the USA (neurosurgery)
• Strategic Marketing: Developing the customer profile, positioning, and messaging as part of the go-to-market strategy for a product launch (ENT surgery)
• Briefing and managing external service providers as well as stakeholder management

As a bridge between Legal, IT, and Marketing, my responsibilities include conducting technical due diligence, documentation, and designing privacy-compliant IT functions across multiple B2P Telefónica Germany brands as part of the RAITT digitalization program. Focused on aligning web and app services with GDPR, TDDDG, and Privacy by Design & Default principles.

Core responsibilities included analysing and visualising data flows across customer journeys, validating tracking and martech integrations, and supporting IT teams in designing privacy-compliant digital architectures. Delivered documentation for internal legal assessments and maintained OneTrust governance and cookie-banner accuracy.

Services and technologies involved:

• Identity & Authentication: CIAM (OAuth2, OIDC), login and session handling, customer account services
• Analytics & Measurement: Google Analytics (GA4), Google Tag Manager (Server-side Tagging & Data Stream Design), event tracking and tagging
• Advertising & Attribution: Google Ads, Google DoubleClick / Campaign Manager, Meta Pixel, affiliate partner integrations
• Experience & Personalisation: Adobe Experience Manager (AEM), Adobe Target, Adobe Experience Platform (AEP), Adobe Edge Network
• Security & Delivery: Cloudflare (CDN), PayPal FraudNet
• Compliance & Governance: OneTrust CMP, consent categories, cookie governance, TDDDG-compliant banner logic
• General web/app services: partner APIs, data transfers, tracking schemas, consent-dependent data activation