HiScout Experts in Germany

Senior Security Consultant in the PHOENIX project

• Creation of security documentation according to BSI IT Baseline Protection
• Conducting BSI IT Baseline Protection checks in several languages
• Creation and maintenance of milestone plans, work packages, project plans, and project documentation
• Structural analyses, determination of protection needs, modeling, baseline protection checks, risk analyses, HiScout tool
• Consulting on information security and data protection
• Review of operating concepts

In my role as Managing Director of QFITS GmbH, I support companies throughout the entire project cycle - from requirements gathering and process analysis to the design of suitable system solutions and all the way to implementation and quality assurance. My focus is on the introduction and integration of POS and ERP systems as well as their seamless connection to existing backend systems and interfaces.

Direct food sales (09/2025 – 05/2026) Support of a project from requirements analysis to the introduction and integration of a new POS system for a direct food sales company. A special focus was on archiving POS logs as well as preparing and providing them as transactions for connected surrounding systems. In addition, design and setup of functional tests and performance tests for the existing backend system, which had to be seamlessly integrated with the POS system.

• Redesigning cablewise infrastructure with CAT 8.1 keystones, measuring the speed and quality of the new installation with Pockethernet, documentation at a local saddlery
• CAT 8.1 installation and building a data center, site linking, VPN and VLAN configuration for a local car dealership, implementation of IT-Security standards like virus protection (G Data) and firewalling (OPNSense)
• Relocation of a tax office with redesign of the IT infrastructure, virus protection (G Data) and backup solutions (QNAP)
• Planning, conception and implementation of an inhouse data center, BSI-compliant for commercial laundry (including Proxmox-based virtualization of existing infrastructures, QNAP, G Data, OPNSense, APC)
• Implementation and conception of security solutions in the SME sector
• Collaboration on the IT-security concept for the Bremen network of authorities (in the dLAN network)
• Creation of IT-security concept VOIS (modules MESO, KFZ/iKFZ) including audit preparation for KBA
• Expansion of the IT-security concept for the online service for electronic residence registration (eWA) to include use as an eFA (one-for-all) service (nationwide)
• Expansion of the IT-security concept to include modules wos & wvp
• Concept development for the implementation of DIN SPEC 27076 at MSEs and SMEs
• Creation and evaluation of emergency concepts
• Creation and evaluation of response actions and BCM plans
• Assessment of existing business continuity management (ISO 22301)
• Development of BCM strategy options
• Conducting awareness training

• Consulting on an ongoing IT security architecture project
• Documenting past progress and planning next steps
• Applying and implementing the BSI IT baseline protection
• Building and maintaining security management systems
• Applying the ISO 27001 standard series
• Integrating ITIL processes into security architectures
• Collaborating with public clients, regulatory authorities and internal and external service providers

Supervised the course Software Engineering for Bachelor students and delivered lectures.

• ISMS and security concept for the Fabasoft e-file according to BSI 200-1/2, among others
• Structural analysis (A.1), modeling (A.3), and baseline protection checks (A.4)
• Preparation for OWASP penetration test, incident response plan, risk analysis
• DevOps Bitbucket, ARC42, IAM with Keycloak/AD, multi-tenant setup, DMS, SOC
• Emergency preparedness concept (BSI 200-4), operations and service concept (BSK), ITSM

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures

• Independently develop policies, guidelines, and frameworks for ICT risk management and information security
• Advise business units on ICT risk management and information security
• Further develop the ICT risk management framework that governs the identification, assessment, and control of ICT risks
• Evaluate the Information Security Management System (ISMS) and adjust it for new challenges
• Conduct risk analyses to identify and assess potential ICT risks and information security risks for the Metzler Group
• Advise on defining and implementing measures to reduce risks and improve the resilience of ICT systems
• Advise on ensuring compliance with relevant internal and external regulatory requirements (MaRisk, DORA, BAIT, BSI IT baseline protection, ISMS, ISO 27001, ISO 42001, ISO 27005, BCM ISO 22301)
• Advise on internal and cross-functional projects (SAP DORA compliance, Target2, Section 8a BSI Act)