GRC Experts in Frankfurt
in minutes with vetted specialists and AI matching from over 15,000 CVsHire experts who shape governance, risk, and compliance processes, configure GRC platforms, and connect controls, audits, and reporting across your systems. FRATCH matches you fast and precisely with vetted, available freelancers.
Meet FRATCH Experts in Frankfurt, who have recently used GRC
Firas Jradi
Last position:
Interim Management Group Head of IT Governance & IAM at French-German Private Bank
- Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
- Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
- Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
- Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
- Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
- Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
- Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
- Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.
Robert Francia
Last position:
Interim Project Manager at IT services company of a regional energy supplier
- Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
- Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
- Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
- Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
- Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
- Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
- Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.
Günther Eufinger
Last position:
Senior Consultant at ISMS Rollout – Information Security Certification (ISO 27001)
- Built and successfully certified the Information Security Management System (ISMS) according to ISO 27001 in seven country organizations (Ghana, India, Bangladesh, Uzbekistan, Serbia, Kosovo, Albania).
- Full implementation of the ISMS from kick-off phase to certification, including defining the governance structure and process landscape.
- Developed and delivered target-group-specific trainings, workshops, and coaching sessions for local responsible persons on the basics of information security and ISMS operations.
- Designed and continuously improved training concepts and content to increase understanding and acceptance.
- Identified and implemented improvements in processes and tools, including risk management for international projects.
- Optimized central ISMS core processes from the idea through pilot operation and fine-tuning to global rollout.
- Optimized knowledge management, as well as work aids and methods for the global ISMS team.
- Built and moderated cross-functional coordination with key interfaces to the ISMS.
- Microsoft Teams, Excel, SharePoint Lists, Power Apps.
Dmitrii Shatov
Last position:
IT Risk & Compliance | DORA | IT Regulatory & Operational Resilience Senior Consultant at Jefferies GmbH
Leading Jefferies’ DORA-driven operational resilience programme by strengthening ICT risk governance, control design, and regulatory readiness across key technology and outsourcing domains. Partnering with senior stakeholders to translate regulatory requirements into pragmatic governance, reporting, and assurance processes suitable for a global investment banking environment.
- Developed the Enterprise Register of Information (DORA Art. 28.3) to align with regulatory requirements.
- Defined and embedded ICT Risk Appetite and tolerance levels aligned to the Global Operational Risk Framework, strengthening decision-making and risk acceptance governance.
- Drove audit readiness by reviewing and re-drafting 50+ IT & Information Security policies, improving clarity, ownership, and control alignment.
- Oversaw the Operational Resilience Testing Programme (including penetration testing) and tracked remediation to closure, strengthening control assurance and reducing open findings.
- Aligned 10+ intra-group agreements with DORA regulatory standards.
- Enhanced executive-level decision-making with an enterprise ICT Risk Dashboard featuring KPIs/KRIs.
Peter Scheitterer
Last position:
IT Project Manager at PAS Provider for Hospital
Overall responsibility for managing a clinical digitization project in a regulated hospital environment.
Design and implementation of a patient call and management system (PASO) for the orthopedics department of a large hospital.
- Project management, planning, and control
- Process analysis and optimization, and managing implementation and rollout
- Coordination with clinical departments, IT, and external service providers
- Ensuring integration into existing IT and process landscapes
Project scope: 310 person-days, team size: 21 members.
Björn Auel
Last position:
Project Manager at DB InfraGO
Project Elevator Emergency Call Reorganization: Project to evaluate and define a new technical solution for connecting elevator emergency calls across all DB InfraGO passenger station facilities.
Objectives: Secure redundant connectivity for all sites nationwide. Define the technical solution, document it, and provide thematic oversight and control of specialist and line organizations.
Identify and commission the technical solutions.
Manage the documentation and approval of the technical solution within DB regulations.
Define and follow up on the roadmap for the solution description.
Develop a rollout plan to prevent shutdowns.
Prepare, align, and implement decision proposals for steering committees.
Communicate the solution in all committees and regional departments.
Zafer Trak
Last position:
Senior Project Manager at RLB / Stack Infrastructure
- Datacenter Senior project lead for the preconstruction phase of a Data Center Development project for an Hyperscaler.
Hassan El Aboubi
Last position:
SAP Authorization Consultant at msg/Denios
- Support for the DENIOS S/4HANA greenfield transformation. - Role development based on the organizational model and structure. - Creation of roles based on process and steps in swimlanes. - Derivation of catalogs, spaces, pages and sections from process IDs. - User assignment via the organizational structure. - Authorization administration in the S/4HANA landscape with a Fiori-first approach. - Consulting and development in the S/4HANA greenfield area.
Steffen Müller
Last position:
Principal Consulting Partner - freelancing at microfin
Discover over 15,000 top freelancers
Statistics of experts using GRC
Aggregated from the professional profiles of matched freelancers.
Experience
23 years (Germany: 22 years)
Position duration
1.2 years (Germany: 2.2 years)
Positions per freelancer
20 (Germany: 14)
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Banking and Finance, Professional Services
Certification focus areas
Project Management, Information Technology, Quality Assurance
Bachelor's degree or higher
88% (Germany: 92%)
Master's degree or higher
50% (Germany: 58%)
Certifications per freelancer
6 (Germany: 7)
Most common languages
German, English, French
Speak two or more languages
100% (Germany: 99%)
Based on our profile pool as of 30 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Frankfurt are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Frankfurt using GRC
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 30 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the technology
GRC in practice
GRC stands for Governance, Risk and Compliance. It brings policies, controls, risk data, and audit work into one operating model. Companies use it to keep oversight clear, prove compliance, and react faster when requirements change.
What specialists deliver
They turn manual control work into structured processes and reporting.
- Define control frameworks and ownership
- Set up risk registers and issue tracking
- Map policies to regulations and internal standards
- Build dashboards for reviews and audits
Common ecosystems
Strong professionals work across tools such as Archer, ServiceNow GRC, MetricStream, IBM OpenPages, and SAP GRC. They also connect GRC with identity systems, ticketing tools, document management, and data sources used by finance, security, and legal teams.
When companies bring them in
GRC expertise is useful when controls are scattered, audits take too much manual effort, or risk reporting is inconsistent. It also helps during platform rollouts, control redesign, and mergers where policies and evidence need to be aligned quickly. In Frankfurt, this often matters for regulated firms, financial services, and international groups with shared reporting needs.
What good experts do
A strong specialist does more than configure fields. They understand how governance, risk, and compliance fit the business, can translate policy into workable workflows, and keep records usable for audits.
- Ask the right questions about ownership and evidence
- Design processes that teams will actually follow
- Balance detail, usability, and reporting needs
- Work closely with security, legal, audit, and operations
Skills around GRC
GRC work often touches internal control design, risk assessment, audit support, data classification, and access governance. Many projects also need clear documentation, stakeholder handling, and an eye for regulatory change. The best experts know how to make the framework practical, not just compliant.
Frequently asked questions
Everything clients usually want to know about GRC, in one place.
GRC is used to connect governance, risk, and compliance work in one structure. It helps companies manage policies, controls, issues, audits, and reporting without losing traceability. That makes it easier to prove what is in place and what still needs attention.
Not exactly. GRC and integrated risk management are closely related, and many teams use the terms side by side. GRC focuses more on governance and compliance as well as risk, while IRM often puts more weight on risk workflows and operational resilience.
A GRC specialist often works with platforms such as Archer, ServiceNow GRC, MetricStream, IBM OpenPages, or SAP GRC. The exact stack depends on the company, but connectors to identity, ticketing, document, and reporting systems are common. Good experts can work across both the platform and the process around it.
Look for someone who can turn policy into working controls and clear evidence trails. A strong GRC freelancer knows the platform, understands audits, and can speak with security, legal, finance, and operations without losing the thread. Ask for examples of workflows, reporting, and control design, not just tool setup.
That depends on the scope. A focused GRC task like workflow tuning or report cleanup may need one specialist, while a broader rollout needs someone who understands controls, stakeholders, and change management. The safest choice is an expert who has worked on similar process complexity before.
Yes, most GRC work can be done remotely because the core tasks are analysis, configuration, documentation, and stakeholder coordination. On-site time is useful for workshops, governance meetings, and sensitive rollout phases. In Frankfurt, hybrid work is common when teams span local offices and central risk functions.
GRC tools are built for traceability, ownership, approvals, and reporting across many controls and risks. Spreadsheets can work for very small setups, but they become hard to govern when audit evidence, issue follow-up, and role-based access matter. A specialist can help decide when the move is worth it.
Besides GRC knowledge, useful skills include internal audit, risk management, compliance operations, process design, and data handling. Knowledge of IAM, reporting, and document workflows also helps. The best freelancers combine tool skill with a clear view of how teams actually work.
The average hourly rate of freelancers in Frankfurt, Germany who have used GRC in their recent projects is 135 €, which corresponds to a daily rate of about 1,081 € based on an 8-hour working day.
Of the freelancers in Frankfurt, Germany who have used GRC in their recent projects, 88% hold at least a Bachelor's degree and 50% hold at least a Master's degree.
On average, freelancers in Frankfurt, Germany who have used GRC in their recent projects have 23 years of professional experience, with a single engagement typically lasting around 1.2 years.
The most common languages among freelancers in Frankfurt, Germany who have used GRC in their recent projects are German (100%), English (100%), and French (33%).
The most common industries among freelancers in Frankfurt, Germany who have used GRC in their recent projects are Information Technology (100%), Banking and Finance (89%), and Professional Services (67%).
The most common business areas among freelancers in Frankfurt, Germany who have used GRC in their recent projects are Information Technology (100%), Project Management (100%), and Operations (89%).
Main locations of FRATCH Experts, who have recently used GRC
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne 
Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Munich Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
