ISMS Experts in Berlin

Andreas R.

Principal Consultant Information Security

Last position:

Freelance Consultant for Information Security at A-R-C Andreas Rühl Consulting

Development and implementation of tailored information security strategies
Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards
Risk management and creation of security concepts
Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000
Building and improving security organizations
Creation and implementation of guidelines, policies, work instructions, and process descriptions
Audit support and certification preparation
Conducting trainings, workshops, and awareness campaigns
Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies
Conducting penetration tests and vulnerability analyses
Consulting on the selection, integration, and management of security architectures in complex IT environments
Consulting on ITSM and managed security services and SOC
Leading and managing complex projects to improve information security
Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics
Introduction and quality assurance of management, documentation, and knowledge management systems
Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)
Development and implementation of risk analysis procedures
Organizing initial response, forensic investigations, and organizational measures in the event of security incidents
Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios
Awareness campaigns to promote security culture in companies
Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards
Simulations and exercises to prepare for information security incidents
Interim management for leading information security projects or IT security organizations
Taking on the role of an external CISO (Chief Information Security Officer)
Support in developing and implementing IT security and corporate strategies
Coaching and mentoring of managers in the field of information security
Building and leading security departments as well as recruiting and qualifying employees
Temporary assumption of management responsibility in critical situations

Kerstin G.

IT Security Officer with TÜV Rheinland certified qualification

Last position:

Information Security Consulting at CAS AG

Daria B.

Senior Consultant Strategy, Risk & Resilience Management

Last position:

Senior Consultant Strategy, Risk & Resilience Management at Antharas

Creating guidelines
Conducting Business Impact Analyses (BIA), assessing risks, and identifying time-critical business processes
Process management
Creating emergency plans and crisis management plans, including cyber response and IT emergency plans with special consideration of a cyberattack
Conducting awareness trainings
Planning and carrying out tests and exercises
Developing tailor-made solutions to reduce risks and ensure business continuity

André B.

External Attack Surface Assessment & Cybersecurity Readiness Checks

Last position:

External Attack Surface Assessment & Cybersecurity Readiness Checks at Graydaxe Cybersecurity GmbH

Conducting cybersecurity readiness checks based on an in-house assessment methodology
Analyzing the external attack surface using the Graydaxe EASM platform
Assessing maturity levels and deriving prioritized recommendations for action

Flamur A.

Fractional Chief Information Security Officer

Last position:

Fractional Chief Information Security Officer at VR Smart Guide GmbH

Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
Implement continuous monitoring solutions to detect and respond to threats in real time.
Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
Collaborate with project teams to address findings and ensure that security risks are managed effectively.
Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
Facilitate a culture of security awareness throughout the organization through training and regular communication.
Lead security initiatives that align with the organization’s long-term strategic goals.
Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

Daniel S.

Engineering Leader & AI-Assisted Developer

Last position:

Engineering Leader & AI-Assisted Developer at Independent · Building with AI

Building a full-stack e-commerce product using AI-assisted development, deliberately returning to hands-on engineering to validate how AI changes software development workflows and team dynamics.
Exploring VP Technology, Head of Engineering, and Director of Engineering opportunities where hands-on AI experience meets organisational scaling expertise.
Open to advisory conversations on AI-augmented engineering teams, technology strategy, platform architecture, and organizational design.
No registered business. No commercial activity.

Patricia A.

Head of Operations

Last position:

Head of Operations at StratifAI GmbH

Designed, managed, and implemented the company’s operational, compliance, procurement, and financial strategy, ensuring alignment with rapid scaling and regulatory objectives.
Built and scaled operational infrastructure across IT, HR, Finance, Procurement, and Compliance, supporting growth from 4 to 20 team members in 6 months.
Oversaw financial management of OPEX, including budgeting, monitoring, and cost optimization to sustain high-growth operations.
Developed and executed a procurement strategy, including vendor selection, negotiation, and performance oversight.
Procured and managed external consultants (compliance, quality, regulatory experts) and orchestrated collaboration across internal teams and external partners to meet milestones.
Implemented policies, SOPs, and business systems (compliance tracking, eQMS, payroll, vendor management, data governance) to support regulatory compliance and scalability.
Managed and actively oversaw regulatory and compliance programs, embedding GDPR, HIPAA, SOC 2, ISO 27001, and ISO 27701 requirements into day-to-day operations.
Directed the rollout of a Quality Management System (QMS) aligned with ISO 13485 to prepare for medical device and AI regulatory certifications.
Led people and culture development, establishing onboarding, performance management, and cross-functional collaboration structures to scale the organization effectively.
Established risk management and business continuity frameworks, including security controls, risk registers, and compliance safeguards.
Engaged executive leadership, board, and investors to align operational strategy with corporate goals and market expansion.
Enabled technology-driven operations, selecting and implementing digital systems (e.g., Drata, Qualio) to ensure compliance and efficiency.
Scaled StratifAI’s operational backbone to support rapid growth and international market readiness.
Achieved ISO 27001, ISO 27701, SOC 2, GDPR, and HIPAA compliance within 6 months, enabling enterprise and healthcare partnerships.
Implemented a QMS system aligned with ISO 13485, paving the way for regulatory approvals and positioning for upcoming ISO 13485 certification, CE-IVDR marking, and FDA clearance within 12 months.
Designed and executed governance, procurement, and financial controls, ensuring efficient resource allocation and sustainable compliance.
Established a culture of structured growth, integrating people, processes, and compliance frameworks to maintain operational excellence.
Enabled StratifAI to confidently enter regulated US and EU markets, building the foundation for long-term expansion.

André G.

IT Consulting Project Management / Engineering Subproject Management

Last position:

IT Consulting Project Management / Engineering Subproject Management at T-Systems (on assignment for government agencies)

Projects for federal networks (NdB).
CR management, EoL change requests, design and documentation according to ITSCM.
Data center planning.
Project management and engineering subproject management.
Software development for virtual server environments according to BSI.

Konstantin S.

Head of Cyber Defense Unit

Last position:

Head of Cyber Defense Unit at Simonow Consulting GmbH

Established the Cyber Defense Unit following a major cybersecurity incident
Recruited a team of Cybersecurity Architects, Engineers and Senior Security Analysts
Managed the team’s resources and activities in defining and implementing a target cybersecurity architecture, monitoring the IT landscape, detecting and responding to security events and incidents, and consulting other IT stakeholders in their efforts to improve the organization’s cybersecurity posture (comparable to Technical CISO role)
Led the separation of Information Security (governance, risk, compliance) and Cyberdefense Unit (technical cybersecurity), in close collaboration with the CISO
Led the selection and onboarding of external Security Operations Center (MSSP)

Albrecht N.

Senior Project Manager IT

Last position:

Senior Project Manager IT at HAYS Technology Solutions GmbH

Leasing, lifecycle and process management for Apple iPhones, maintenance and expansion of the MDM system, coordination of leasing, device integration into DEP and MDM, followed by a rollout and hardware swap process, plus a BYOD and Android option
Migration of the IT ticket system from ManageEngine ServiceDesk Plus to Atlassian Jira Service Management: project management, definition of ticket types, seamless execution according to a detailed timeline, user communication, decommissioning of the old system
Project lead: SAP interface in workforce management to automate reading of working hours
Sub-project lead for inventory software EZO AssetSonar: demand management, software selection, procurement

Tino T.

Fractional AI Architect | AI Strategy Lead

Last position:

Director Technology at Forte Digital Germany

Leading 20+ staff in development, site reliability engineering, and architecture.
Leading the group-wide agentic AI initiative (Norway, Poland, Germany).
Hands-on solution architect and AI consultant for over 50% of my working time on client projects in the publishing sector – from local publishers to international corporations.
Strategic consulting and technical implementation of AI workflow platforms (n8n, Workato).
Developing prototypes for traditional, AI-based, and agentic AI workflows.

Matthias S.

Senior Security Consultant (freelance)

Panketal

Last position:

Senior Security Consultant (freelance) at DVZ M-V

ISMS and security concept for the Fabasoft e-file according to BSI 200-1/2, among others
Structural analysis (A.1), modeling (A.3), and baseline protection checks (A.4)
Preparation for OWASP penetration test, incident response plan, risk analysis
DevOps Bitbucket, ARC42, IAM with Keycloak/AD, multi-tenant setup, DMS, SOC
Emergency preparedness concept (BSI 200-4), operations and service concept (BSK), ITSM

Jan K.

Consultant for Information Security & Auditor

Last position:

Consultant for Information Security & Auditor at Kopiasonsulting GmbH

Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures
Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks
Conducting red teaming processes, including penetration tests and security analyses for companies
Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)
Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX
Advising companies in critical infrastructures on information security and compliance with the IT Security Act
Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)
Integrating data into monitoring tools (Prometheus, Grafana)
Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management
Security assessments and penetration testing of IT and network architectures

Henryk O.

Security Consultant

Blankenfelde-Mahlow

Last position:

Security Consultant at Daimler AG

Development of a cloud security strategy
Implementation of cloud security governance to comply with ISO/IEC 27017 and the CSA CCM
Creation of a management system to control cloud security with a focus on process design as well as roles and responsibilities
Definition of security measures to safeguard cloud solutions
Conducting requirements analyses and defining the scope for cloud security projects
Achievements: Established an effective NIS2-compliant cloud security governance that meets industry-specific requirements and effectively minimizes cloud security risks

Dan W.

Chief Operating Officer (COO) / Chief Revenue Officer (CRO)