ISMS Experts in Germany
in minutes from over 15,000 CVs with the power of AIHire experts who can design, run, and improve ISMS work across ISO 27001 controls, risk treatment, internal audits, and security documentation. Get fast, precise matching with vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used ISMS
Andreas Rühl
Last position:
Freelance Consultant for Information Security at A-R-C Andreas Rühl Consulting
Development and implementation of tailored information security strategies
Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards
Risk management and creation of security concepts
Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000
Building and improving security organizations
Creation and implementation of guidelines, policies, work instructions, and process descriptions
Audit support and certification preparation
Conducting trainings, workshops, and awareness campaigns
Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies
Conducting penetration tests and vulnerability analyses
Consulting on the selection, integration, and management of security architectures in complex IT environments
Consulting on ITSM and managed security services and SOC
Leading and managing complex projects to improve information security
Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics
Introduction and quality assurance of management, documentation, and knowledge management systems
Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)
Development and implementation of risk analysis procedures
Organizing initial response, forensic investigations, and organizational measures in the event of security incidents
Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios
Awareness campaigns to promote security culture in companies
Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards
Simulations and exercises to prepare for information security incidents
Interim management for leading information security projects or IT security organizations
Taking on the role of an external CISO (Chief Information Security Officer)
Support in developing and implementing IT security and corporate strategies
Coaching and mentoring of managers in the field of information security
Building and leading security departments as well as recruiting and qualifying employees
Temporary assumption of management responsibility in critical situations
Alwin G.
Last position:
IT Interim Manager & AI Strategist
- AI product development: Design of an AI-supported GRC platform to automate compliance processes.
- AI expertise: Strategic deepening in Agentic AI and GenAI as a core asset for modern IT governance
- IT interim management and strategic consulting
Henry Hanau
Last position:
Interim Manager IT-Compliance at Int. Fertigungsunternehmen
- Industry: mechanical engineering, vehicle manufacturing
- Regulations: Data Act
- Project focus: data governance, legally compliant use of machine data, data platforms
- Assigned by: CFO, platform product owner
Successes/Results (early phase):
- Compliance support for the setup of an internal standardized data usage platform based on Databricks.
- Created the basis for the legally compliant and effective use of machine data, including:
- Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
- Technical: consideration of data flows from the platform to users and third parties.
- Organizational: drafting and finalizing the required data usage agreements.
Sandra Klinkenberg
Last position:
Webinar Leader - Blackout Prevention and Preparation at SANDRA KLINKENBERG • Management Consultant, self-employed independent business consultant
- Webinar on Blackout - Brownout - Power failure - how do I recognise it and what can I do?
Robert Francia
Last position:
Interim Project Manager at IT services company of a regional energy supplier
- Delivery of various end-customer projects in server and network infrastructure on time, in quality, and within budget.
- Project 1: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall at an automotive supplier.
- Project 2: Migration of file services from dedicated servers at 5 branch locations into a central managed file service, including DHCP, directory, and print services, as well as decommissioning of the old domain controllers.
- Project 3: Renewal of the network infrastructure at the headquarters and branch locations of a logistics company and transition of the LAN, WLAN, and firewall environments into a managed network service.
- Project 4: Network renewal, replacement of the core and access switches at the headquarters of a medical technology company and transition into a managed network service.
- Project 5: Firewall renewal, replacement of an ASA firewall with a Fortinet firewall for a city.
- Environment: ASA and Fortinet firewalls, Cisco network components, ITSM Heat/Ivanti, Confluence.
Dirk Peter
Last position:
Freelance Cyber Defense Lead & KRITIS/NIS2 Consultant | AI Security Architect at Self-Employed
Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.
Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.
Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.
Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.
Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.
Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.
Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.
Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.
Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.
Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.
Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.
Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.
Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.
Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.
Result: >99.5% uptime over 20+ years and zero compromises.
Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.
Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.
Salim Chehab
Last position:
Cloud / Systems Architect
- Development and introduction of operational processes
- Preparation of complete documentation packages (including emergency management and operations) to meet compliance requirements
- Introduction of a workshop on IaC (Infrastructure as Code)
- Professional consulting for the project's security concept (ISMS)
- Installation and operation of Kubernetes clusters on AWS, on-prem, and Azure
- Design of hybrid cloud architecture (on-prem, Hetzner, AWS)
- Analysis and resolution of incidents and system outages
- Network changes to firewall rules, gateways, OpenVPN settings, and IPsec tunnel (pfSense)
- Professional consulting on BitBucket, Jenkins, and GitLab CI/CD pipelines
- Consulting on Ansible deployments and infrastructure automation
- Consulting on building a scalable system in the cloud (AWS / Azure)
- Technologies / Tools: Ansible, Terraform, AWS, Azure, VPN, pfSense, Jenkins, Bitbucket, Kubernetes, GitLab Runner, ISMS, Golang, Prometheus, Grafana, S3, Lambda, RDS, ECS, Cognito, OIDC, Harbor, MinIO, Postgres, Redis, Keycloak, Ceph, Proxmox, CloudFormation, PostgreSQL, Flux CD, Hetzner, IONOS, Sonatype Nexus Repository, Entra ID, Dex IdP, Pulumi
Steffen Lotze
Last position:
Consultant for BSI baseline protection and ISO 27701 at Society for International Cooperation
- Support in building and further developing the information security management system
- Cooperation with external consultants in the certification team for the support structure
- Involvement in project planning, identification, and implementation of the necessary measures according to BSI IT baseline protection
- Professional support for in-house subject matter experts in creating the documents required for certifications
- Carrying out the work according to BSI 200-2
Peter Konrad
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Alicja Wilczek
Last position:
Integrated security and emergency documentation for a 24/7 logistics company at Medium-sized logistics company
- Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
- Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
- Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
- Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability
Laurin Hagemann
Last position:
Software Architect (Freelance) at Care4Sure
- Delivered MVP-focused full-stack architecture for a health-sector client: Vite/React frontend, backend services on Google Cloud Run, and Supabase for database plus IAM/authentication.
- Supported product requirements engineering and prioritized cost-aware workload placement, implementing browser-side/edge computation where feasible before moving logic to backend services.
Florian Krebs
Last position:
LAN Planner at Global Network AG
- As-is assessment of the current network infrastructure and its documentation, including on-site inspections
- Independent planning of new distribution and main distribution rooms in the individual district offices (components used, rack layout, connectivity), considering the BSI IT-Grundschutz and InfoSic requirements
- Planning of new copper and fiber optic cabling, including patch panels
- Coordination with building services engineering (TGA) to ensure compliance with relevant on-site requirements
- Development of detailed execution plans and high-level concepts for the rollout of the new infrastructure
- Additional support after the components go live (hypercare phase)
- Regular communication with project management and client stakeholders
Frank Borgfeld
Last position:
Consulting & Project Management at B-IT - Ihr IT-Kompetenz
- Planning the migration approach from the old to the new ZEWIS system
- Configuring the modules (basic module, project recording, assembly billing, etc.)
- Setting up interfaces and data imports
- Coordinating the rollout and aligning with departments
- Supporting the team during the go-live and troubleshooting
- Quality assurance and preparation for acceptance
- Documenting all steps for smooth operations
Michael Müller
Last position:
IT PROJECT MANAGER (MS Exchange) at Statutory Health Insurance on behalf of Randstad Digital Germany (formerly AUSY Technologies Germany)
Migration from Exchange 2016 to Exchange 2019 and Exchange Online, as well as the introduction of a backup solution and an archiving solution. The goal was a secure, compliant, and high-performance modernization of the email and archiving infrastructure.
Responsibilities as IT PROJECT MANAGER: Overall project management and operational control / Ensuring adherence to costs and resources / Ensuring achievement of project objectives / Ensuring compliance with regulatory requirements and compliance guidelines, including ISMS, ITIL, and data protection regulations / Preparing and delivering management reports for the project sponsors and project committee / Coordinating interdisciplinary teams from Exchange, network, data protection, and IT security / Planning and executing the system migration from Exchange 2016 to Exchange 2019 / Planning and executing the system migration from Exchange 2019 to Exchange Online / Planning and implementing a backup solution for Exchange Online / Coordinating an EU-wide tender for an archiving solution including market analysis with potential vendors / Planning and implementing an archiving solution for Exchange Online / Coordinating and preparing the necessary BAS notifications in the project context / Coordinating and aligning with stakeholders (e.g. business units, external service providers, and suppliers) for requirements definition and implementation
Technical environment: MS Exchange 2016, MS Exchange 2019, MS Exchange Online, MS Office, MS Planner, MS PowerPoint, MS Project, MS Teams
Florian Schröder
Last position:
Information Security Officer / Designated InfoSec Officer at Oil Company
- Complete overhaul of the ISMS according to ISO 27001
- Conducted a comprehensive gap analysis
- Reduced ISMS documentation by 30% through consolidation and process optimization
- Introduced a full PDCA cycle for continuous improvement
- Established the ISMS within the company
- Implemented the necessary processes
- Managed and conducted internal and external audits
- Developed and implemented a company-wide risk management system
- Deployed an ISMS tool including process design and training
- KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
- NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
- Led a cybersecurity team of 3 members
- Conducted various internal and external audits, managed providers, introduced continuous improvement
- Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
- Redesigned the security architecture, reducing administrative efforts by 20%
- Implemented ITIL processes (e.g., change management)
- Revised service agreements with internal and external providers
- Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
- Managed a budget of one million euros
Discover over 15,000 top freelancers
Statistics of experts using ISMS
Aggregated from the professional profiles of matched freelancers.
Experience
21 years
Position duration
2.6 years
Positions per freelancer
14
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
89%
Master's degree or higher
55%
Doctorate
14%
Certifications per freelancer
8
Most common languages
German, English, French
Speak two or more languages
96%
Based on our profile pool as of 30 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Germany using ISMS
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 30 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the technology
What ISMS covers
An Information Security Management System, or ISMS, helps a company manage security in a structured way. It brings policy, risk, controls, evidence, and review together so security work is consistent instead of ad hoc. Many companies use ISMS work to prepare for audits, support customer trust, and keep day-to-day security decisions clear.
Common deliverables
- ISMS scope and policy set
- Risk assessment and treatment plans
- Statement of Applicability
- Control mapping and evidence packs
- Internal audit and review support
Where experts help
Companies usually bring in freelance ISMS professionals when they need to start an ISMS, prepare for ISO 27001 certification, or clean up an existing setup. That is common in regulated sectors, SaaS, and industrial firms in Germany, where security questions often involve both internal teams and external auditors. Freelancers also help when projects need extra capacity for a short period.
Tools and standards
Strong specialists know ISO 27001 and the related control landscape, but they also work well with the tools that keep an ISMS alive. That can include risk registers, policy repositories, ticketing systems, GRC tools, and evidence tracking. Good experts keep the system usable for operations, not just audit season.
What strong professionals do
- Translate security requirements into clear controls
- Work with legal, IT, and business stakeholders
- Write documents people can actually use
- Spot gaps before an audit does
- Keep the ISMS current as systems change
Germany delivery
In Germany, ISMS work often needs clear German or English documentation, depending on the company and its customers. Remote collaboration works well for policy, risk, and evidence work, while on-site time can help with interviews, workshops, and internal alignment. The best specialists stay precise, practical, and easy to work with.
Frequently asked questions
What clients ask us most about ISMS — answered in short.
An ISMS is used to manage information security in a controlled, repeatable way. It helps a company define scope, assign responsibilities, assess risk, and prove that controls are in place. It is especially useful when the business needs to show customers, partners, or auditors that security is handled seriously.
No. ISMS is the management system; ISO 27001 is the standard many companies use to build and assess it. A freelancer with the right background should understand how the standard, Annex A controls, risk treatment, and evidence all fit together.
A company usually brings in ISMS help when it is starting from scratch, preparing for certification, or trying to fix a messy setup. Freelance support also makes sense when internal security staff are busy and documentation, audits, or risk work needs steady progress. Short projects often benefit from a specialist who can work independently.
A strong ISMS specialist usually knows risk management, policy writing, control design, audit support, and stakeholder communication. Familiarity with ISO 27001, evidence collection, and GRC tools is a major plus. It also helps when the person can translate technical issues into language that leadership and auditors understand.
An ISMS expert focuses on the management system itself: scope, governance, controls, records, and continuous improvement. General security specialists may be stronger in technical testing or architecture, but not always in audit-ready documentation and process design. For certification or formal governance work, the ISMS focus matters.
A serious ISMS project usually needs someone who has worked through a full cycle before, not just someone who knows the theory. If the work includes certification, supplier reviews, or recurring audits, practical experience matters more than a long tool list. The best sign is whether the specialist can produce usable outputs with little supervision.
Yes, much of ISMS work can be done remotely in Germany. Policy drafting, risk reviews, evidence collection, and gap analysis are well suited to online collaboration. On-site sessions can still help when the project depends on interviews, workshops, or sensitive internal discussions.
Look for clear deliverables, strong writing, and a practical understanding of how controls are used in daily work. A good ISMS freelancer can explain the reasoning behind a control, not just quote a standard. Ask for examples of risk treatment, audit prep, or documentation work that led to a cleaner and more usable system.
The average hourly rate of freelancers in Germany who have used ISMS in their recent projects is 121 €, which corresponds to a daily rate of about 968 € based on an 8-hour working day.
Of the freelancers in Germany who have used ISMS in their recent projects, 89% hold at least a Bachelor's degree, 55% hold at least a Master's degree, and 14% hold a doctorate.
On average, freelancers in Germany who have used ISMS in their recent projects have 21 years of professional experience, with a single engagement typically lasting around 2.6 years.
The most common languages among freelancers in Germany who have used ISMS in their recent projects are German (99%), English (96%), and French (22%).
The most common industries among freelancers in Germany who have used ISMS in their recent projects are Information Technology (93%), Professional Services (70%), and Banking and Finance (49%).
The most common business areas among freelancers in Germany who have used ISMS in their recent projects are Information Technology (96%), Project Management (91%), and Quality Assurance (69%).
Main locations of FRATCH Experts, who have recently used ISMS
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Berlin 
Munich 
Cologne 
Frankfurt 
Dusseldorf Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
