GRC Experts in Frankfurt

• Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
• Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
• Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
• Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
• Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
• Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
• Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

• Built and successfully certified the Information Security Management System (ISMS) according to ISO 27001 in seven country organizations (Ghana, India, Bangladesh, Uzbekistan, Serbia, Kosovo, Albania).
• Full implementation of the ISMS from kick-off phase to certification, including defining the governance structure and process landscape.
• Developed and delivered target-group-specific trainings, workshops, and coaching sessions for local responsible persons on the basics of information security and ISMS operations.
• Designed and continuously improved training concepts and content to increase understanding and acceptance.
• Identified and implemented improvements in processes and tools, including risk management for international projects.
• Optimized central ISMS core processes from the idea through pilot operation and fine-tuning to global rollout.
• Optimized knowledge management, as well as work aids and methods for the global ISMS team.
• Built and moderated cross-functional coordination with key interfaces to the ISMS.
• Microsoft Teams, Excel, SharePoint Lists, Power Apps.

Leading Jefferies’ DORA-driven operational resilience programme by strengthening ICT risk governance, control design, and regulatory readiness across key technology and outsourcing domains. Partnering with senior stakeholders to translate regulatory requirements into pragmatic governance, reporting, and assurance processes suitable for a global investment banking environment.

• Developed the Enterprise Register of Information (DORA Art. 28.3) to align with regulatory requirements.
• Defined and embedded ICT Risk Appetite and tolerance levels aligned to the Global Operational Risk Framework, strengthening decision-making and risk acceptance governance.
• Drove audit readiness by reviewing and re-drafting 50+ IT & Information Security policies, improving clarity, ownership, and control alignment.
• Oversaw the Operational Resilience Testing Programme (including penetration testing) and tracked remediation to closure, strengthening control assurance and reducing open findings.
• Aligned 10+ intra-group agreements with DORA regulatory standards.
• Enhanced executive-level decision-making with an enterprise ICT Risk Dashboard featuring KPIs/KRIs.

Overall responsibility for managing a clinical digitization project in a regulated hospital environment.

Design and implementation of a patient call and management system (PASO) for the orthopedics department of a large hospital.

• Project management, planning, and control
• Process analysis and optimization, and managing implementation and rollout
• Coordination with clinical departments, IT, and external service providers
• Ensuring integration into existing IT and process landscapes

Project scope: 310 person-days, team size: 21 members.

• Datacenter Senior project lead for the preconstruction phase of a Data Center Development project for an Hyperscaler.

• Support for the DENIOS S/4HANA greenfield transformation. - Role development based on the organizational model and structure. - Creation of roles based on process and steps in swimlanes. - Derivation of catalogs, spaces, pages and sections from process IDs. - User assignment via the organizational structure. - Authorization administration in the S/4HANA landscape with a Fiori-first approach. - Consulting and development in the S/4HANA greenfield area.