ISMS Expert
to strengthen information security with vetted, available freelancers matched in minutesHire experts who design and improve Information Security Management Systems, prepare ISO 27001 programs, manage risk registers and support audit readiness. FRATCH connects you with vetted, available freelancers through fast, precise AI matching.
Meet FRATCH Experts who have recently used ISMS
Willy W.
Last position:
IT Security Consultant
SIEM/SOC Wazuh Implementation
Logistics
Wazuh | OpenSearch | Use Cases | Dashboards | Training
- Advised and provided technical support for the implementation of Wazuh as a SIEM solution
- Prepared and coordinated with teams involved in firewall, network, and IT operations
- Installed and configured Wazuh on the designated server infrastructure
- Developed security-related use cases and dashboards for centralized monitoring
- Delivered employee training on using and analyzing data from the SIEM solution
Roberto S.
Last position:
Requirements Management & Compliance for the Cyber Resilience Act (CRA) at Please inquire
Technology company
- Analysis of CRA requirements
- Management workshop
- Development of recommendations
Result: Prioritized CRA readiness plan for compliance.
Mischa G.
Last position:
Non-Financial Risk Officer at Nationale-Nederlanden
- Temporary cover for an absent non-financial risk officer.
- Operational scope: incident intake and follow-up, internal control testing, and first-line reporting for the Belgian entity.
Stefan R.
Last position:
Information Security Consultant at TĂśV TRUST IT GmbH
- Conducting information classification, risk management and supplier assessment workshops
- Introduction of a customer-specific information security minimum standard (based on TISAX and ISO 27001) since Apr. 2026; implementing the same standard in parallel for a second customer
- Building an ISMS according to ISO 27001 for a logistics company (approx. 160–200 MA)
- Municipal utility company (KRITIS, approx. 450 MA): independently introduced the CRISAM GRC tool and am currently expanding it to include NIS-2 areas, took over parts of the ISB support mandate, and followed up on and remediated audit findings
- Supporting customers in implementing DORA and NIS-2, including documentation for a financial institution
- Conducting and supporting audits of systems for attack detection (SzA) according to § 8a BSIG (today §§ 31, 39 BSIG)
- Creating network structure plans according to IT-SiKat
- Creating technical security concepts (logging, IAM, attack detection)
Heiko F.
Last position:
External Senior Advisor, Workshop Design and Facilitation at Mainova
ISMS-/KRITIS Target Vision and Development Roadmap
Energy / Utilities | regulated and KRITIS-focused environment
- Two half-day workshops with a structured interim phase to further develop the ISMS.
- Three-year target vision for governance/scope/roles, integration/scopes, management, as well as policies and interfaces.
- Facilitation of key areas of tension and consolidation into an implementation-oriented development roadmap.
Result: 30 specified work packages | 15 workshop focus areas + 15 additions
Mahmoud Q.
Last position:
Information Security & GRC Expert at GLG (Gerson Lehrman Group)
As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.
My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).
The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.
Markus B.
Last position:
Developer / DevOps, Consulting at A state authority in Baden-WĂĽrttemberg / FSAS Technologies GmbH
Oracle Project Management and Automation
As part of the project, the operation of an Oracle infrastructure was automated through the development and enhancement of Puppet modules and the migration of existing Bash scripts to a standardized configuration management solution.
The project aimed to standardize and automate administrative processes, improve the maintainability of the Oracle platform, and increase the efficiency and traceability of infrastructure management through the use of Infrastructure as Code.
- Analyzed and migrated existing Bash shell scripts to a Puppet-based automation solution
- Developed and enhanced Puppet modules for Oracle environments
- Automated installation, configuration, and operational processes using Infrastructure as Code
- Standardized and optimized configuration management for Oracle systems
- Created and maintained technical and operational documentation
- Planned, coordinated, and provided technical support for project implementation
- Operated and automated Oracle systems on x86-based Linux server platforms
- Tested and ensured the quality of the developed Puppet modules
- Analyzed and resolved technical issues related to automation and migration
- Worked closely with business units and infrastructure teams to implement automation requirements
Technologies used: Puppet 7/8, SLES 15, Oracle 19, Oracle Grid, SVN, Windows Server, Confluence, VS Code, Ruby, Bash, Pass
Lutz E.
Last position:
Founder & Principal InfoSec Recruiter at Cyber Defense Recruitment / Lutz Eichenhofer HR Consult
Specialist recruiting for cyber security.
- Filling specialist and leadership roles exclusively in information security (IAM/PAM, GRC/ISMS, SOC/DFIR, pentesting, security architecture, CISO)
- Active sourcing and direct outreach, including to passive candidates
- Structured candidate interviews and candidate reports for clients
- Anonymized candidate profile marketing to companies and security consultancies
- Clients in Germany and Austria, including consultancies, banks, industry, and public IT service providers
Timo T.
Last position:
Gronic Ident & Sign at Gronic Systems GmbH
Gronic Ident & Sign
Core technologies: Android, Jetpack Compose, Retrofit, Regula Document Reader, Adobe Sign
Android app on dedicated devices for identifications and electronic signatures at the PoS
Andreas K.
Last position:
Manufacturing
- IT interim management
- Functional leadership, establishment and management of the local IT team
- Responsibility for all IT services (e.g. server, storage, backup, network, security and OT services), including planning, setup and operation of these services for the site
- Responsibility for all business services (ERP, sales / configuration, development), including planning, setup and operation of these services for the site
- Ensuring the overall strategic direction of the IT team and integrating this team into the overarching holding functions
- Budgeting and execution of controlling processes, including risk analyses
- Supporting the development of project management standards and methods
- Supporting IT project portfolio management, including the continuous improvement of portfolio standards and methods
- Developing and aligning standards and methods for process management
- Responsible for the availability, capacity and continuity of the relevant IT services
- Responsibility for IT resource management processes
- Project management for various infrastructure projects:
- Storage migration from NetApp to Huawei
- Windows 11 rollout
- Rebuilding a Citrix environment
Tools/Werkzeuge/Methoden: Confluence, Jira
Hardware: HP servers, Fortigate NGFW, storage: Huawei OceanStor, network: HP and Huawei switches, Fortinet WLAN
Software: VMware vSphere, network: Dell switches, Fortinet WLAN, Windows 11, Citrix
Applications: Office-Suite M365, Exchange Online, Azure AD / Entra ID
Markus M.
Last position:
Project Manager: Engineering Excellence at EnBW Energie Baden-WĂĽrttemberg
- Evaluation and further development of Engineering Excellence initiatives as part of the “Digital First” program
- Validation of efficiency, productivity, and cost-saving potential in the Software Development Lifecycle (SDLC)
- Organization-wide analysis of the use of Generative AI in the Software Development Lifecycle (SDLC)
- Evaluation of optimization measures in the areas of product management, delivery, developer experience, metrics, and quality assurance
- Alignment of the “Next Level Architecture (NLA)” target vision with regard to organizational design, governance model, and scalability
- Identification of structural bottlenecks in the delivery organization and development of alternative optimization approaches
- Preparation of decision-making and management documents for department management and the Executive Board to evaluate efficiency potential and transformation measures
Skillset: Engineering Excellence, Operating Model Design, Generative AI, AI in SDLC, SAFe, DevOps, Software Delivery Metrics, Value Streams, Team Topologies, Domain Driven Design, Azure DevOps, Jira, Confluence, Management Reporting, Business Case Assessment
Melissa K.
Last position:
CEO at Certifynow
- Founded and lead a consulting firm specializing in ISO 27001 and integrated management systems, advising organizations on certification readiness, governance frameworks and compliance structures.
- Support technology companies in implementing ISO-based management systems and risk management frameworks to strengthen information security and regulatory compliance.
GĂĽnther E.
Last position:
IT Security & Governance Consulting (DORA & NIS2): at Freelance Assignment
Strategic consulting for the development and strengthening of ISMS structures (ISO 27001 / BSI IT-Grundschutz), including onboarding, gap analyses, and preparation of the IT organization for DORA requirements (ICT third-party risk) and NIS2 compliance. Auditing compliance requirements in a regulated environment.
Reza N.
Last position:
Senior IT-Security Expert at Teambank AG
- Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
- Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
- Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
- Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
- Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
- Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
- Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR
Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK
RĂĽdiger V.
Last position:
Security Consultant at Dataport AĂ–R
Senior Security Consultant in the PHOENIX project
- Creation of security documentation according to BSI IT Baseline Protection
- Conducting BSI IT Baseline Protection checks in several languages
- Creation and maintenance of milestone plans, work packages, project plans, and project documentation
- Structural analyses, determination of protection needs, modeling, baseline protection checks, risk analyses, HiScout tool
- Consulting on information security and data protection
- Review of operating concepts
Discover over 15,000 top freelancers
Statistics of experts using ISMS
Aggregated from the professional profiles of matched freelancers.
Experience
21 years
Position duration
2.5 years
Positions per freelancer
14
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
88%
Master's degree or higher
56%
Doctorate
12%
Certifications per freelancer
8
Most common languages
German, English, French
Speak two or more languages
97%
Based on our profile pool as of 11 Nov 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates of experts using ISMS
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 11 Nov 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
ISMS experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (92%)
- Professional Services (68%)
- Banking and Finance (53%)
- Manufacturing (42%)
- Automotive (39%)
- Government and Administration (36%)
- Insurance (35%)
- Healthcare (32%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
What ISMS covers
An Information Security Management System, or ISMS, is a structured way to manage information security across an organisation. It combines policies, risk assessment, controls, responsibilities and continual improvement. Many companies align their ISMS with ISO 27001 while adapting it to their services, data and risk profile.
Where it is used
ISMS work supports companies that handle sensitive customer, employee, financial or operational information. It is common in software, cloud services, healthcare, finance, manufacturing, professional services and public-sector supply chains.
- Protect confidential, accurate and available information
- Prepare for customer security reviews and certification audits
- Connect security controls with business and operational risks
Core ecosystem
Strong ISMS work connects governance with practical security operations. Typical activities include asset inventories, risk registers, statements of applicability, internal audits, supplier assessments, incident processes and management reviews. Specialists may also work with GRC tools, ticketing systems, policy repositories, cloud controls and privacy programmes.
When companies need help
Companies often bring in freelance ISMS expertise when building a programme from scratch, preparing for ISO 27001 certification or responding to demanding customer questionnaires. External support is also useful after an acquisition, major cloud migration, security incident or change in regulatory scope.
- Define scope, policies, roles and security objectives
- Assess risks and select proportionate controls
- Collect evidence and close audit findings
- Establish repeatable review and improvement processes
Skills that matter
A capable professional can translate business processes into clear security requirements without creating unnecessary bureaucracy. They understand risk ownership, control design, evidence quality and audit conversations. Useful adjacent skills include information security, privacy, business continuity, vendor risk, cloud security and security awareness.
Choosing the right specialist
Look for experience with the organisation’s size, sector, technology landscape and intended assurance outcome. Ask how the professional has handled scope decisions, risk acceptance, control testing and evidence collection. The strongest specialists leave behind usable processes, clear ownership and a programme the internal team can maintain after the engagement.
Frequently asked questions
What clients ask us most about ISMS — answered in short.
An ISMS helps an organisation manage information security through defined policies, risks, controls, responsibilities and reviews. It provides a repeatable framework for protecting information and demonstrating that security decisions are managed rather than ad hoc.
An ISMS is the management system an organisation operates, while ISO 27001 is the standard used to specify requirements and assess conformity. A professional can map the system to the standard, prepare evidence and support internal or external audit activities.
An ISMS is the governance and operating framework, not simply a software product. A GRC tool can help document risks, controls, tasks and evidence, but it does not replace leadership decisions, accountable owners or working security processes.
A strong ISMS specialist often brings knowledge of risk management, cloud security, privacy, supplier assurance, business continuity and incident response. Familiarity with security controls, audit evidence and tools such as GRC or ticketing systems is also valuable.
The right level for an ISMS engagement depends on scope, existing controls, sector requirements and the desired assurance outcome. A focused gap assessment may need a different profile from a full programme build, certification preparation or remediation effort.
Much ISMS work can be delivered remotely through interviews, document reviews, workshops and evidence tracking. On-site sessions can still help with process observation, stakeholder alignment or organisations with restricted environments.
Good ISMS work links controls to real risks, assigns clear ownership and produces evidence that people can maintain. Review the specialist’s approach to scope, risk acceptance, audit findings and handover rather than judging the programme by the volume of documents.
An ISMS engagement usually involves interviews with business and technical stakeholders, reviewing existing documentation, assessing controls and coordinating actions across teams. Freelancers should be comfortable explaining security decisions in plain language and working with incomplete information while keeping recommendations practical.
The average hourly rate of freelancers who have used ISMS in their recent projects is 120 €, which corresponds to a daily rate of about 963 € based on an 8-hour working day.
Of the freelancers who have used ISMS in their recent projects, 88% hold at least a Bachelor's degree, 56% hold at least a Master's degree, and 12% hold a doctorate.
On average, freelancers who have used ISMS in their recent projects have 21 years of professional experience, with a single engagement typically lasting around 2.5 years.
The most common languages among freelancers who have used ISMS in their recent projects are German (99%), English (97%), and French (23%).
The most common industries among freelancers who have used ISMS in their recent projects are Information Technology (92%), Professional Services (68%), and Banking and Finance (53%).
The most common business areas among freelancers who have used ISMS in their recent projects are Information Technology (97%), Project Management (89%), and Quality Assurance (65%).
Main locations of FRATCH Experts, who have recently used ISMS
Our freelancers and interim experts are at home all over Germany — available on-site in Berlin, Hamburg, Munich and every major business hub, or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Berlin 
Hamburg 
Munich 
Cologne 
Frankfurt 
Dusseldorf 
Essen In Austria our freelancers and interim experts support companies from Vienna to Graz — on-site where your project needs them, or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Vienna Graz Across Switzerland our specialists are active in Zurich, Geneva, Basel and Bern — working on-site or fully remote. Choose a city to discover matched specialists, local market insights and up-to-date availability.
Zurich Geneva Basel Bern Countries:
Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
