ISMS Experts in Berlin
matched in minutes from over 15,000 CVsHire experts who design and operate Information Security Management Systems, prepare organisations for ISO 27001 audits, and connect risk management with practical security controls. FRATCH matches you quickly with vetted, available freelancers suited to your needs.
Meet FRATCH Experts in Berlin, who have recently used ISMS
Daria B.
Last position:
Senior Consultant Strategy, Risk & Resilience Management at Antharas
- Creating guidelines
- Conducting Business Impact Analyses (BIA), assessing risks, and identifying time-critical business processes
- Process management
- Creating emergency plans and crisis management plans, including cyber response and IT emergency plans with special consideration of a cyberattack
- Conducting awareness trainings
- Planning and carrying out tests and exercises
- Developing tailor-made solutions to reduce risks and ensure business continuity
André B.
Last position:
External Attack Surface Assessment & Cybersecurity Readiness Checks at Graydaxe Cybersecurity GmbH
- Conducting cybersecurity readiness checks based on an in-house assessment methodology
- Analyzing the external attack surface using the Graydaxe EASM platform
- Assessing maturity levels and deriving prioritized recommendations for action
Kerstin G.
Last position:
Information Security Consulting at CAS AG
Flamur A.
Last position:
Fractional Chief Information Security Officer at VR Smart Guide GmbH
- Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
- Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
- Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
- Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
- Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
- Implement continuous monitoring solutions to detect and respond to threats in real time.
- Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
- Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
- Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
- Collaborate with project teams to address findings and ensure that security risks are managed effectively.
- Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
- Facilitate a culture of security awareness throughout the organization through training and regular communication.
- Lead security initiatives that align with the organization’s long-term strategic goals.
- Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
- Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.
Daniel S.
Last position:
Engineering Leader & AI-Assisted Developer at Independent · Building with AI
- Building a full-stack e-commerce product using AI-assisted development, deliberately returning to hands-on engineering to validate how AI changes software development workflows and team dynamics.
- Exploring VP Technology, Head of Engineering, and Director of Engineering opportunities where hands-on AI experience meets organisational scaling expertise.
- Open to advisory conversations on AI-augmented engineering teams, technology strategy, platform architecture, and organizational design.
- No registered business. No commercial activity.
Patricia A.
Last position:
Head of Operations at StratifAI GmbH
- Designed, managed, and implemented the company’s operational, compliance, procurement, and financial strategy, ensuring alignment with rapid scaling and regulatory objectives.
- Built and scaled operational infrastructure across IT, HR, Finance, Procurement, and Compliance, supporting growth from 4 to 20 team members in 6 months.
- Oversaw financial management of OPEX, including budgeting, monitoring, and cost optimization to sustain high-growth operations.
- Developed and executed a procurement strategy, including vendor selection, negotiation, and performance oversight.
- Procured and managed external consultants (compliance, quality, regulatory experts) and orchestrated collaboration across internal teams and external partners to meet milestones.
- Implemented policies, SOPs, and business systems (compliance tracking, eQMS, payroll, vendor management, data governance) to support regulatory compliance and scalability.
- Managed and actively oversaw regulatory and compliance programs, embedding GDPR, HIPAA, SOC 2, ISO 27001, and ISO 27701 requirements into day-to-day operations.
- Directed the rollout of a Quality Management System (QMS) aligned with ISO 13485 to prepare for medical device and AI regulatory certifications.
- Led people and culture development, establishing onboarding, performance management, and cross-functional collaboration structures to scale the organization effectively.
- Established risk management and business continuity frameworks, including security controls, risk registers, and compliance safeguards.
- Engaged executive leadership, board, and investors to align operational strategy with corporate goals and market expansion.
- Enabled technology-driven operations, selecting and implementing digital systems (e.g., Drata, Qualio) to ensure compliance and efficiency.
- Scaled StratifAI’s operational backbone to support rapid growth and international market readiness.
- Achieved ISO 27001, ISO 27701, SOC 2, GDPR, and HIPAA compliance within 6 months, enabling enterprise and healthcare partnerships.
- Implemented a QMS system aligned with ISO 13485, paving the way for regulatory approvals and positioning for upcoming ISO 13485 certification, CE-IVDR marking, and FDA clearance within 12 months.
- Designed and executed governance, procurement, and financial controls, ensuring efficient resource allocation and sustainable compliance.
- Established a culture of structured growth, integrating people, processes, and compliance frameworks to maintain operational excellence.
- Enabled StratifAI to confidently enter regulated US and EU markets, building the foundation for long-term expansion.
André G.
Last position:
IT Consulting Project Management / Engineering Subproject Management at T-Systems (on assignment for government agencies)
- Projects for federal networks (NdB).
- CR management, EoL change requests, design and documentation according to ITSCM.
- Data center planning.
- Project management and engineering subproject management.
- Software development for virtual server environments according to BSI.
Konstantin S.
Last position:
Head of Cyber Defense Unit at Simonow Consulting GmbH
- Established the Cyber Defense Unit following a major cybersecurity incident
- Recruited a team of Cybersecurity Architects, Engineers and Senior Security Analysts
- Managed the team’s resources and activities in defining and implementing a target cybersecurity architecture, monitoring the IT landscape, detecting and responding to security events and incidents, and consulting other IT stakeholders in their efforts to improve the organization’s cybersecurity posture (comparable to Technical CISO role)
- Led the separation of Information Security (governance, risk, compliance) and Cyberdefense Unit (technical cybersecurity), in close collaboration with the CISO
- Led the selection and onboarding of external Security Operations Center (MSSP)
Albrecht N.
Last position:
Senior Project Manager IT at HAYS Technology Solutions GmbH
- Leasing, lifecycle and process management for Apple iPhones, maintenance and expansion of the MDM system, coordination of leasing, device integration into DEP and MDM, followed by a rollout and hardware swap process, plus a BYOD and Android option
- Migration of the IT ticket system from ManageEngine ServiceDesk Plus to Atlassian Jira Service Management: project management, definition of ticket types, seamless execution according to a detailed timeline, user communication, decommissioning of the old system
- Project lead: SAP interface in workforce management to automate reading of working hours
- Sub-project lead for inventory software EZO AssetSonar: demand management, software selection, procurement
Tino T.
Last position:
Director Technology at Forte Digital Germany
- Leading 20+ staff in development, site reliability engineering, and architecture.
- Leading the group-wide agentic AI initiative (Norway, Poland, Germany).
- Hands-on solution architect and AI consultant for over 50% of my working time on client projects in the publishing sector – from local publishers to international corporations.
- Strategic consulting and technical implementation of AI workflow platforms (n8n, Workato).
- Developing prototypes for traditional, AI-based, and agentic AI workflows.
Matthias S.
Last position:
Senior Security Consultant (freelance) at DVZ M-V
- ISMS and security concept for the Fabasoft e-file according to BSI 200-1/2, among others
- Structural analysis (A.1), modeling (A.3), and baseline protection checks (A.4)
- Preparation for OWASP penetration test, incident response plan, risk analysis
- DevOps Bitbucket, ARC42, IAM with Keycloak/AD, multi-tenant setup, DMS, SOC
- Emergency preparedness concept (BSI 200-4), operations and service concept (BSK), ITSM
Jan K.
Last position:
Consultant for Information Security & Auditor at Kopiasonsulting GmbH
Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures
Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks
Conducting red teaming processes, including penetration tests and security analyses for companies
Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)
Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX
Advising companies in critical infrastructures on information security and compliance with the IT Security Act
Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)
Integrating data into monitoring tools (Prometheus, Grafana)
Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management
Security assessments and penetration testing of IT and network architectures
Henryk O.
Last position:
Security Consultant at Daimler AG
- Development of a cloud security strategy
- Implementation of cloud security governance to comply with ISO/IEC 27017 and the CSA CCM
- Creation of a management system to control cloud security with a focus on process design as well as roles and responsibilities
- Definition of security measures to safeguard cloud solutions
- Conducting requirements analyses and defining the scope for cloud security projects
- Achievements: Established an effective NIS2-compliant cloud security governance that meets industry-specific requirements and effectively minimizes cloud security risks
Dan W.
Last position:
Chief Operating Officer (COO) / Chief Revenue Officer (CRO) at samedi
- Unified and optimized organizational structures across sales, delivery, and support; standardized handoffs and workflows to reduce friction.
- Designed and rolled out digitized, harmonized operational processes to improve efficiency and quality.
- Built and scaled the KHZG patient portal unit with integrated governance, making samedi a lead provider in Germany.
- Aligned revenue and fulfillment under coherent frameworks, delivering 25%+ YoY growth in 2024 and projected ~30%+ in 2025.
- Established cross-functional KPI oversight with process-driven improvement initiatives.
Tuan Minh N.
Last position:
Security Consulting Manager at Accenture
- Project management for cyber security and data protection projects in the financial, public and IT sector
- Business development activities and project acquisitions
- Topics: Data Privacy, Information Security Management Systems (ISMS), Privileged Access Management (PAM), Identity and Access Management (IAM), Security Operations Center (SOC)
- Enabled client to drive IAM strategy forward by decommissioning legacy application used for managing entitlements of enterprise users over more than 15 years
- Ensured security and privacy for personal data of more than 64 million residents by leading security workstream for development of vaccination quota monitoring web-application
- Supported expansion of CDN provider's market presence in Europe by comparing data privacy offering with customer requirements and competitors' offerings, and defining 10 now implemented measures
- Awarded distinctive achievement for leading a PAM project after only 6 months at Accenture and selling a follow-on project worth more than €3 million
Discover over 15,000 top freelancers
Statistics of experts using ISMS
Aggregated from the professional profiles of matched freelancers.
Experience
23 years (Germany: 22 years)
Position duration
2.1 years (Germany: 2.5 years)
Positions per freelancer
18 (Germany: 14)
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Professional Services, Media and Entertainment
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
80% (Germany: 87%)
Master's degree or higher
60% (Germany: 56%)
Doctorate
7% (Germany: 12%)
Certifications per freelancer
8 (Germany: 7)
Most common languages
English, German, French
Speak two or more languages
100% (Germany: 97%)
Based on our profile pool as of 29 Oct 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology in Berlin are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates of experts in Berlin using ISMS
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 29 Oct 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
ISMS experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (100%)
- Professional Services (82%)
- Media and Entertainment (59%)
- Banking and Finance (53%)
- Education (47%)
- Automotive (41%)
- Manufacturing (35%)
- Retail (35%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
What ISMS covers
An Information Security Management System, or ISMS, is a structured way to manage information security across an organisation. It combines policies, risk assessment, controls, responsibilities, evidence and continual improvement. An ISMS can support certification, customer assurance and stronger day-to-day decisions.
Where it is used
ISMS work applies wherever sensitive information, regulated processes or critical services must be protected. Common settings include software companies, financial services, healthcare, public institutions and industrial businesses. Berlin organisations often need specialists who can work with local teams while coordinating securely with remote stakeholders.
- Define information security scope and objectives
- Assess risks to systems, data and business processes
- Select controls and assign accountable owners
- Prepare audit evidence and management reviews
Standards and tooling
Strong professionals connect the ISMS with ISO 27001, risk registers, asset inventories and control libraries. They may work with governance, risk and compliance tools, ticketing systems, identity platforms, cloud security services and document repositories. The right setup turns policies into traceable actions rather than isolated files.
When specialists help
Companies bring in freelance ISMS specialists during certification preparation, security programme changes, customer due diligence or major cloud and supplier transitions. They can create missing documentation, facilitate risk workshops, define control ownership and coordinate internal and external audits.
- Establish an ISMS from an unclear starting point
- Close audit findings and improve corrective actions
- Map controls across cloud, office and supplier environments
- Build practical training and security awareness processes
Skills that matter
An effective ISMS professional understands governance as well as technology. Useful adjacent skills include ISO 27001, business continuity, privacy, supplier risk, incident management, identity and access management, cloud security and audit preparation. Clear writing and stakeholder facilitation matter because every control needs adoption, evidence and review.
Choosing the right expert
Look for someone who can explain risk in business terms and show how policies become operating practice. Ask for examples of risk treatment, control testing, audit remediation and management reporting, while protecting confidential client details. For Berlin-based work, agree early on language, site access, remote collaboration and availability for workshops or audits.
Frequently asked questions
Before you brief your next project: the most common questions about ISMS.
An ISMS is used to manage information security as a repeatable business process. It helps an organisation identify risks, select controls, assign responsibilities, preserve evidence and improve its security programme over time.
An Information Security Management System is the management framework that an organisation operates, while ISO 27001 defines requirements for building and certifying that framework. A specialist can align policies, risk treatment, controls and evidence with the standard without reducing the ISMS to paperwork.
A strong ISMS specialist often understands ISO 27001, privacy, business continuity, supplier risk, incident response and cloud security. Experience with governance, risk and compliance tools, identity management and audit communication is also useful.
The right level depends on the scope, maturity and audit goals of the organisation. For a new Information Security Management System, look for someone who has led risk assessment, control design and implementation; a focused remediation task may need a narrower specialist.
Much ISMS work can be handled remotely through workshops, document reviews and secure collaboration tools. On-site sessions may still help with asset discovery, interviews, physical security reviews or audit preparation, so clarify access and German or English language expectations at the start.
An ISMS links security objectives, risk decisions, controls, owners, evidence and improvement activities. A checklist can confirm isolated requirements, but it rarely provides the governance and operating rhythm needed to manage changing risks.
Typical ISMS deliverables include a defined scope, information security policy, risk methodology, risk register, statement of applicability, control plans and audit evidence. Depending on the engagement, the specialist may also deliver training, supplier assessments, management reports and remediation tracking.
Ask how the ISMS professional would understand your business, prioritise risks and gain control ownership from teams. Strong candidates explain trade-offs clearly, connect evidence to real processes and can demonstrate experience improving audit readiness without creating unnecessary bureaucracy.
The average hourly rate of freelancers in Berlin, Germany who have used ISMS in their recent projects is 123 €, which corresponds to a daily rate of about 984 € based on an 8-hour working day.
Of the freelancers in Berlin, Germany who have used ISMS in their recent projects, 80% hold at least a Bachelor's degree, 60% hold at least a Master's degree, and 7% hold a doctorate.
On average, freelancers in Berlin, Germany who have used ISMS in their recent projects have 23 years of professional experience, with a single engagement typically lasting around 2.1 years.
The most common languages among freelancers in Berlin, Germany who have used ISMS in their recent projects are English (100%), German (94%), and French (18%).
The most common industries among freelancers in Berlin, Germany who have used ISMS in their recent projects are Information Technology (100%), Professional Services (82%), and Media and Entertainment (59%).
The most common business areas among freelancers in Berlin, Germany who have used ISMS in their recent projects are Information Technology (100%), Project Management (100%), and Operations (76%).
Main locations of FRATCH Experts, who have recently used ISMS
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Hamburg 
Munich 
Cologne 
Frankfurt 
Dusseldorf 
Essen Countries:
Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
