ISMS Experts
in minutes from over 15,000 CVs with the power of AIHire experts who design, run, and improve Information Security Management Systems, support ISO 27001 work, and turn security policies into daily practice. Get fast, precise matching with vetted, available freelancers.
Meet FRATCH Experts who have recently used ISMS
Andreas Rühl
Last position:
Freelance Consultant for Information Security at A-R-C Andreas Rühl Consulting
Development and implementation of tailored information security strategies
Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards
Risk management and creation of security concepts
Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000
Building and improving security organizations
Creation and implementation of guidelines, policies, work instructions, and process descriptions
Audit support and certification preparation
Conducting trainings, workshops, and awareness campaigns
Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies
Conducting penetration tests and vulnerability analyses
Consulting on the selection, integration, and management of security architectures in complex IT environments
Consulting on ITSM and managed security services and SOC
Leading and managing complex projects to improve information security
Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics
Introduction and quality assurance of management, documentation, and knowledge management systems
Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)
Development and implementation of risk analysis procedures
Organizing initial response, forensic investigations, and organizational measures in the event of security incidents
Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios
Awareness campaigns to promote security culture in companies
Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards
Simulations and exercises to prepare for information security incidents
Interim management for leading information security projects or IT security organizations
Taking on the role of an external CISO (Chief Information Security Officer)
Support in developing and implementing IT security and corporate strategies
Coaching and mentoring of managers in the field of information security
Building and leading security departments as well as recruiting and qualifying employees
Temporary assumption of management responsibility in critical situations
Alwin G.
Last position:
IT Interim Manager & AI Strategist
- AI product development: Design of an AI-supported GRC platform to automate compliance processes.
- AI expertise: Strategic deepening in Agentic AI and GenAI as a core asset for modern IT governance
- IT interim management and strategic consulting
Henry Hanau
Last position:
Interim Manager IT-Compliance at Int. Fertigungsunternehmen
- Industry: mechanical engineering, vehicle manufacturing
- Regulations: Data Act
- Project focus: data governance, legally compliant use of machine data, data platforms
- Assigned by: CFO, platform product owner
Successes/Results (early phase):
- Compliance support for the setup of an internal standardized data usage platform based on Databricks.
- Created the basis for the legally compliant and effective use of machine data, including:
- Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
- Technical: consideration of data flows from the platform to users and third parties.
- Organizational: drafting and finalizing the required data usage agreements.
Jens Brennscheidt
Last position:
Senior Cyber Security Consultant at Brennscheidt IT Consulting
KEY PROJECTS
Since 05/2023 | Bank | Senior Cyber Security Consultant (external)
- Advising and guiding the system owners in creating and further developing IT security concepts
- Coordinating and tracking the remediation of findings from reviews and audits
- Advising on the implementation of regulatory requirements for information security
10/2023 – 02/2024 | Fintech | Project Manager (external)
- Project management to close various audit gaps in the field of information security
- Conceptual design and implementation of an information security management system based on ISO/IEC 27001
- Creation and further development of ISMS documents and processes
Sandra Klinkenberg
Last position:
Webinar Leader - Blackout Prevention and Preparation at SANDRA KLINKENBERG • Management Consultant, self-employed independent business consultant
- Webinar on Blackout - Brownout - Power failure - how do I recognise it and what can I do?
Robert Francia
Last position:
Interim Project Manager at IT services company of a regional energy supplier
- Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
- Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
- Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
- Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
- Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
- Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
- Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.
Salim Chehab
Last position:
Cloud / Systems Architect
- Development and introduction of operations processes
- Preparation of complete documentation packages (including incident management and operations support) to meet compliance requirements
- Introduction of a workshop on IaC (Infrastructure as Code)
- Technical consulting for the project security concept (ISMS)
- Installation and operation of Kubernetes clusters on AWS, on-prem, and Azure
- Hybrid cloud architecture design (on-prem, Hetzner, AWS)
- Analysis and troubleshooting of incidents and system outages
- Network adjustments for firewall rules, gateways, OpenVPN settings, and IPsec tunnels (pfSense)
- Technical consulting on Bitbucket, Jenkins, and GitLab CI/CD pipelines
- Consulting on Ansible deployments and infrastructure automation
- Consulting on building a scalable system in the cloud (AWS / Azure)
- Technologies / Tools: Ansible, Terraform, AWS, Azure, VPN, pfSense, Jenkins, Bitbucket, Kubernetes, GitLab Runner, ISMS, Golang, Prometheus, Grafana, S3, Lambda, RDS, ECS, Cognito, OIDC, Harbor, MinIO, Postgres, Redis, Keycloak, Ceph, Proxmox, CloudFormation, PostgreSQL, Flux CD, Hetzner, IONOS, Sonatype Nexus Repository, Entra ID, Dex IdP, Pulumi
Dirk Peter
Last position:
Freelance Cyber Defense Lead & KRITIS/NIS2 Consultant | AI Security Architect at Self-Employed
Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.
Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.
Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.
Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.
Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.
Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.
Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.
Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.
Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.
Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.
Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.
Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.
Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.
Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.
Result: >99.5% uptime over 20+ years and zero compromises.
Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.
Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.
Steffen Lotze
Last position:
Consultant for BSI baseline protection and ISO 27701 at Society for International Cooperation
- Support in building and further developing the information security management system
- Cooperation with external consultants in the certification team for the support structure
- Involvement in project planning, identification, and implementation of the necessary measures according to BSI IT baseline protection
- Professional support for in-house subject matter experts in creating the documents required for certifications
- Carrying out the work according to BSI 200-2
Peter Konrad
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Alicja Wilczek
Last position:
Integrated security and emergency documentation for a 24/7 logistics company at Medium-sized logistics company
- Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
- Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
- Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
- Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability
Laurin Hagemann
Last position:
Software Architect (Freelance) at Care4Sure
- Delivered MVP-focused full-stack architecture for a health-sector client: Vite/React frontend, backend services on Google Cloud Run, and Supabase for database plus IAM/authentication.
- Supported product requirements engineering and prioritized cost-aware workload placement, implementing browser-side/edge computation where feasible before moving logic to backend services.
Rüdiger Von Schierstaedt
Last position:
Security Consultant at Dataport AÖR
Senior Security Consultant in the PHOENIX project
- Creation of security documentation according to BSI IT Baseline Protection
- Conducting BSI IT Baseline Protection checks in several languages
- Creation and maintenance of milestone plans, work packages, project plans, and project documentation
- Structural analyses, determination of protection needs, modeling, baseline protection checks, risk analyses, HiScout tool
- Consulting on information security and data protection
- Review of operating concepts
Florian Krebs
Last position:
LAN Planner at Global Network AG
- As-is assessment of the current network infrastructure and its documentation, including on-site inspections
- Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
- Planning of new copper and fiber optic cabling, including patch panels
- Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
- Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
- Additional support after the components go live (hypercare phase)
- Regular communication with project management and client stakeholders
Tarek El Idrisi
Last position:
Associate GRC at Egerer Consulting
Carve-out project: Development of certification strategy, implementation and requirement plans across multiple standards — ISO/IEC 27001, ISO 9001, ISO 14001, ISO 22301, ISO/IEC 20000-1, BSI IT-Grundschutz, and BSI TR-RESISCAN
- Cross-standard inventory and risk assessment
- Coordination with cross-department stakeholders: ISB, executive management, certification bodies, legal and data protection
- Consulting in information security, GRC, and IT auditing
Discover over 15,000 top freelancers
Statistics of experts using ISMS
Aggregated from the professional profiles of matched freelancers.
Experience
22 years
Position duration
2.7 years
Positions per freelancer
14
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
89%
Master's degree or higher
54%
Doctorate
14%
Certifications per freelancer
7
Most common languages
German, English, French
Speak two or more languages
97%
Based on our profile pool as of 6 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts using ISMS
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 6 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the technology
What ISMS means
An Information Security Management System, or ISMS, is the framework a company uses to control security risks in a structured way. It connects policies, procedures, controls, audits, and ongoing improvement into one system. Many teams also search for ISMS in the context of ISO 27001 work.
Where it is used
- Define security policies and control ownership
- Run risk assessments and treatment plans
- Prepare for certification and surveillance audits
- Document evidence, exceptions, and corrective actions
- Keep security management aligned with business goals
Ecosystem and standards
Strong specialists know the wider security and compliance setup around an ISMS. That usually includes ISO 27001, ISO 27002, risk registers, internal audit routines, asset inventories, access control, incident handling, and supplier security reviews. They should be comfortable translating standard requirements into practical company processes.
When to bring in help
Companies bring in freelance expertise when the ISMS must be built from scratch, cleaned up before an audit, or kept alive after the first certification push. This is common when internal teams lack time, need an outside view, or want support for policies, statements of applicability, evidence collection, and remediation tracking. Remote work often fits well, but on-site workshops can help with interviews and control mapping.
What strong specialists do
A good ISMS professional does more than write documents. They ask how the business really works, identify gaps between formal controls and daily practice, and help turn vague requirements into usable tasks for security, legal, IT, and operations. They also know how to keep records clear, current, and defensible.
Signs you need an ISMS expert
- Audit findings keep coming back
- Policies exist, but teams do not follow them
- The scope, risks, or controls are unclear
- You need better evidence and traceability
- Security work is spread across too many owners
Frequently asked questions
What clients ask us most about ISMS — answered in short.
An ISMS is used to manage information security in a repeatable way. It helps a company define policies, assess risk, choose controls, and prove that the controls are working. In practice, it supports compliance, customer trust, and better day-to-day security decisions.
No. ISMS is the management system, while ISO 27001 is the standard often used to define and assess it. Many companies build their ISMS to meet ISO 27001 requirements, but the system itself can also support broader security governance.
A strong ISMS specialist should know risk management, policy writing, audit preparation, and control design. They also need enough understanding of IT, legal, privacy, and supplier management to connect security requirements with real business processes. Clear communication matters as much as documentation.
Most ISMS work benefits from someone who has already taken a system through real audits or major internal reviews. Simple policy updates can be handled by a lighter touch, but building scope, risk treatment, and evidence routines usually needs a specialist who has seen common failure points before.
A ISMS freelancer focuses on the management system, not only technical controls. That means scope, governance, evidence, audit readiness, and continuous improvement are central. A general security expert may be stronger on tools or operations, but not always on the formal structure an ISMS needs.
Yes, much of ISMS work can be done remotely because it relies on interviews, document review, workshops, and process design. On-site time can still help when teams need stakeholder alignment, walkthroughs of real controls, or access to internal evidence that is easier to review in person.
Look for clear thinking, not just templates. A good ISMS professional can explain why each control exists, show how it maps to risk, and keep the system practical for the business. Strong evidence, clean documentation, and a calm approach to audit questions are good signs.
Typical ISMS deliverables include the scope statement, risk methodology, risk register, statement of applicability, policies, internal audit plans, and corrective action tracking. Depending on the project, you may also need training material, supplier review templates, and support during certification or re-certification audits.
The average hourly rate of freelancers who have used ISMS in their recent projects is 121 €, which corresponds to a daily rate of about 967 € based on an 8-hour working day.
Of the freelancers who have used ISMS in their recent projects, 89% hold at least a Bachelor's degree, 54% hold at least a Master's degree, and 14% hold a doctorate.
On average, freelancers who have used ISMS in their recent projects have 22 years of professional experience, with a single engagement typically lasting around 2.7 years.
The most common languages among freelancers who have used ISMS in their recent projects are German (99%), English (96%), and French (22%).
The most common industries among freelancers who have used ISMS in their recent projects are Information Technology (93%), Professional Services (70%), and Banking and Finance (49%).
The most common business areas among freelancers who have used ISMS in their recent projects are Information Technology (96%), Project Management (91%), and Quality Assurance (69%).
Main locations of FRATCH Experts, who have recently used ISMS
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Berlin 
Munich 
Cologne 
Frankfurt 
Dusseldorf Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
