GRC Experts

• Strategic planning, detailed technical preparation and operational management of an email gateway migration in a security-critical government environment.
• Preparation of the technical specification and development of technical concepts and migration approaches in line with BSI requirements.
• Technical requirements management with business units, information security and operations.
• Coordination of external service providers, integrators and implementation partners; maintenance of project plans, milestones, resources, risks and dependencies.
• Regular reporting to project management, the program environment and internal stakeholders.

• Private Equity owned precision grinding machines for Auto, Military & Aerospace – 1200 Employees
• Acting as Interim Group CIO / CISO consolidating Global IT back to Europe – M&A consolidation
• Managed major Security event and post event cleanup – Reporting to regulators
• Performed Vendor & Contract Management – full assessment of capabilities
• Guided Infrastructure refresh & Security Hygiene assessments

Using periods between projects to deepen leadership skills and Change Management methods.

• Personnel and culture development: Supporting specialists and managers with professional reorientation and providing strategic coaching for successful self-presentation.

• Empowerment & Performance Coaching: Conducting systemic personality assessments to identify performance bottlenecks and specifically develop strengths within teams.

• Moderation & Training: Managing interdisciplinary workshop and seminar groups in both industrial-technical and commercial environments.

• Managed Microsoft Cloud Accelerator Factory (CAF) programs for global enterprise customers, ensuring Azure cloud implementations aligned with security, governance, and compliance best practices, including ISO 27001-aligned controls and cloud security frameworks.
• Managed complex global enterprise transformation programs with strong focus on project delivery, financial governance, budget control, planning, risk management, and executive reporting, ensuring delivery within scope, timeline, and budget.
• Led the implementation of e-invoicing solutions for Nestlé, coordinating finance, IT, business stakeholders, and external providers to ensure successful integration, testing, rollout, and delivery of electronic invoicing processes.
• Managed an Oracle-to-PostgreSQL database migration, coordinating technical teams, application owners, testing activities, dependencies, risks, and cutover planning to ensure a controlled and successful transition.
• Led cross-functional programs involving finance and payment-related processes, enterprise platforms, and system integrations, with strong stakeholder management across business, IT, vendors, and senior leadership.
• Delivered transformation programs in FMCG environments, including Nestlé, managing complex international stakeholder structures, third-party providers, governance, RAID management, and business-critical dependencies.

• Elevator emergency call reorganization project: Project to evaluate and define a new technical solution for connecting elevator emergency calls for all facilities of DB InfraGO passenger stations.

• Objectives: Secure, redundant connection of all locations across Germany. Definition of the technical solution, documentation, subject-matter support and management of specialist and line organizations.

• Identification and commissioning of technical solutions.

• Management of documentation and approval of the technical solution in DB regulations.

• Definition and tracking of the roadmap for describing the solution.

• Preparation of a rollout plan to avoid shutdowns.

• Coordination and implementation of decision proposals for steering committees.

• Communication of the solution to all committees and regional areas.

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
• Overall responsibility for establishing a Compliance, Governance and Risk organization
• Establishment of an integrated GRC model and executive reporting for the Management Board.

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

• WiNOWiG enhancements (digitalization & organization)
• Project management for the WiNOWiG project (regulatory offenses)
• Process optimization and coordination

KEY PROJECTS

Since 05/2023 | Bank | Senior Cyber Security Consultant (external)

• Advising and guiding the system owners in creating and further developing IT security concepts
• Coordinating and tracking the remediation of findings from reviews and audits
• Advising on the implementation of regulatory requirements for information security

10/2023 – 02/2024 | Fintech | Project Manager (external)

• Project management to close various audit gaps in the field of information security
• Conceptual design and implementation of an information security management system based on ISO/IEC 27001
• Creation and further development of ISMS documents and processes

To achieve savings and optimize compliance, apps were restructured in line with the mappings in identity management, restrictions were defined and, above all, costs resulting from overuse were reduced. Communication with stakeholders, validation of authorizations with users and technical implementation in the SAP FI/CO and Sourcing & Procurement modules created significant added value for the group. This also included the corresponding documentation for the auditors.

• Transition strategic business development: product before customer in <4 months instead of 10
• Transition strategic business development: development cost reduction to plan: 40% (-250 k EUR)
• Executive mentor & coach for CEO & CPO: CEO too busy to improve - portfolio, company structure and strategy
• Executive mentor & coach for CEO & CPO: PO→CPO transition to take over full product responsibility for Lohnpulse
• Interim CIO: scouting / onboarding / handover of general contractor service providers to CPO
• Interim CIO: transition from MVP to a fully operable product by the CPO

Industry: Finance/Insurance

• Sparring partner for the data protection team
• Taking over tasks from the data protection backlog
• Updating data protection processes
• Updating TOMs
• Revising template documents (including DPA, data protection guidelines)
• Conducting audits (authorization concept, software development)
• Taking over tasks from day-to-day operations
• Processing data protection reports
• Conducting DPIA and TIA
• Reviewing data processing agreements
• Designing and delivering trainings
• Standard Data Protection Model
• AI and data protection

Result: Successfully supported the data protection team, worked through the data protection backlog, and delivered trainings successfully

Strategic consulting for the development and strengthening of ISMS structures (ISO 27001 / BSI IT-Grundschutz), including onboarding, gap analyses, and preparation of the IT organization for DORA requirements (ICT third-party risk) and NIS2 compliance. Auditing compliance requirements in a regulated environment.

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.