GRC Experts in Hamburg

• Transition strategic business development: product before customer in <4 months instead of 10
• Transition strategic business development: development cost reduction to plan: 40% (-250 k EUR)
• Executive mentor & coach for CEO & CPO: CEO too busy to improve - portfolio, company structure and strategy
• Executive mentor & coach for CEO & CPO: PO→CPO transition to take over full product responsibility for Lohnpulse
• Interim CIO: scouting / onboarding / handover of general contractor service providers to CPO
• Interim CIO: transition from MVP to a fully operable product by the CPO

As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.

My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).

The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• International Management Consultant

• External Data Protection Officer

• TÜV certified Data Protection Officer and Auditor

• Consulting for national and international data protection

• Expert/Auditor for EU Data Protection Seal

• GDPR implementation in SAP with SAP ILM and EPI-USE Labs

• Compliance Suite

• SAP consulting – focus on GDPR, HCM, Cloud

• Projects:

• GDPR implementations

• Compliance Suite

• SAP ILM

• Design and implementation of SAP authorizations

• SAP and IAM consulting

• International SAP HCM and S/4 rollouts and support

• Project management for the introduction of time tracking (Dormakaba) with company agreement on company pension accounts (lifetime working time accounts)

• Data protection implementation

• H4S4

• Various cloud solutions

• Audits

• AI-driven IAM

• AI/KPI optimization of SAP ERP

• Consulting on SAP authorizations and governance
• Conducting governance consultations, iteration support and project coordination
• Developing solutions for effective control and monitoring of SAP authorizations
• Creating concepts and recommendations
• Drafting detailed concepts to improve the assignment and management of SAP authorizations
• Providing clear recommendations based on established methods and best practices
• Creating/customizing authorizations for MM including MDG/MDM as well as FI, PP including AIRC Services within SAP Finance
• Reviewing existing structures and processes
• Analyzing and evaluating current SAP authorization structures and processes
• Identifying weaknesses and developing optimization strategies
• Conducting trainings and workshops
• Planning and delivering trainings and workshops for awareness
• Sharing knowledge in SAP authorizations, including role assignment, support during iterations and consulting on role development in the pharmaceutical environment.