ISO 27001 Experts in Dusseldorf

• Creation of complete bilingual (DE/EN) security and emergency documentation: Business Continuity Plan / Disaster Recovery Plan, Incident Response Plan v2.0 with four case-specific playbooks (PICERL), access control policy, vulnerability management policy, business resilience programme, risk governance plan
• Consolidation into an integrated emergency handbook (12 chapters) with immediate checklists for six emergency scenarios, a prioritized action table, and a formal approval structure
• Review of a penetration test report (Greenbone) with complete remediation of all findings and formal risk acceptance of a residual risk with documented compensating control
• Review and documentation of NIS2 and HinSchG applicability, including the legal reasoning for non-applicability

• Further development and optimization of the PIM system (e.g. data modeling, interfaces, user experience)
• Analysis, structuring, and professional evaluation of business requirements in close coordination with business units and stakeholders
• Translating business requirements into functional and technical concepts (business & solution design)
• Designing and further developing the target PIM architecture including data models, object structures, versioning, and lifecycle concepts
• Defining interfaces, integration concepts, and data flows between PIM, eCommerce, ERP, and other systems
• Quality assurance in close collaboration with business units and the development team
• Effort estimations for analysis, design, and testing activities
• Agile, Scrum, 4APortal, SAP ERP, SAP eCommerce (Hybris)

As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW.  Developed and implemented a holistic process view covering both technical and organizational aspects  Ensured end-to-end control of all IAM-related technical services  Established clear responsibilities and accountabilities within the IAM landscape  Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security  Introduced and monitored governance policies to ensure compliance and security  Continuously improved IAM processes and systems through regular audits and evaluations  Participated in external audits of the process as part of official ISO audits  Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units  Conceptually advanced the KPI system to measure process quality

• Full product responsibility from a business perspective: requirement analysis, UX design, product strategy, and go-to-market implemented without an internal dev team using fully AI-supported development (Claude Code / Anthropic)
• Technical differentiation: KRITIS-compliant air-gapped deployment (Windows/NSIS), GDT interface for PVS integration, DATEV-LODAS export for payroll
• Managed pilot operation with initial external client (Dormagen medical practice): structured requirement gathering, test support, error analysis, and release management
• Developed rollout and sales strategy for market entry in the segment of private practices and small medical centers
• Human-in-the-Loop development principle: business decision → AI implementation → manual review → approval → release – each sprint documented in Jira (TIME project), every change traceable via co-authored commits
• Product outcome: Tauri/Rust desktop app with GDT watcher, multi-tier model (Starter/Professional/Enterprise), cloud mirror on Hetzner/Traefik, complete ISMS framework based on ISO 27001 and BSI basic protection as product foundation
• Direct method validation for the test manager role: hands-on experience with quality assurance of AI-generated products from a user perspective, review gate discipline, release approval under GDPR and the EU AI Act

• Digitalization of accounting, signature/approval, and onboarding processes
• Restructuring of the IT department
• Introduction of a digital sales tool
• Implementation of an AI webinar series
• Introduction and optimization of information security
• Administration and optimization of the MS Office 365 environment

• Operating Model Design: Designed and rolled out a 3-tier AI Governance Operating Model, defining organizational structures, roles, tooling, guidelines and processes across Corporate, Business Units, and Implementation layers to manage compliance for 200,000+ employees.
• EU AI Act Compliance: Led the strategic screening and risk classification of 3,800+ AI applications, implementing automated assessments for prohibited practices and General Purpose AI (GPAI) requirements.
• Enterprise Roll-out: Orchestrated the deployment of an internal GPT platform and Generative AI tools, defining the value proposition and adoption strategies for 10,000+ users.
• AI Literacy Architecture: Designed a modular AI training framework to transition the workforce from legacy manual workflows to AI-assisted processes.
• Executive Storylining: Developed strategic narratives for the CIO and Board to secure buy-in for AI investments, translating technical model performance into business-value summaries.
• PMO Infrastructure: Built the end-to-end PMO infrastructure using Jira, Confluence, and Azure Boards to track transformation progress and cross-entity dependencies.

• Hybrid/Remote
• Digitalisation introduction and optimisation of software
• Advice on the introduction of AI
• Data & AI strategy
• Interim / tech consultant
• Product, process & management
• Vendor management
• Compliance management platforms (ISO 27001, GDPR, EU AI Act)
• M&A due diligence & analysis

• Introduction of a central change process
• Technical support for the operational implementation of changes (ITIL technical change management)
• Co-design and technical implementation of digital processes

• Development and implementation of multi-domain infrastructure strategies to optimize system performance in OT and IT.
• Design of security concepts for multi-domain infrastructures, including IT security management.
• Oversight of incident management, problem management, and change management.
• Managing the entire lifecycle of a strategic project, including planning, execution, delivery, and stabilization.
• Supporting IT governance, IT architecture, and risk management.
• Conducting workshops on IT security and infrastructure.

• DORA consulting and system optimization
• Process analysis of existing business and technically complex processes
• Analysis of individual processes in relevant areas: trading, back office, settlement, custodian bank
• Acting as interface between business areas and IT to understand and define requirements
• Creating a functional specification including adjustments and implementation of software applications and their interfaces to systems
• Preparing a decision paper for the executive board to approve the project
• Setting up and conducting project meetings with relevant stakeholders and documenting them
• Close collaboration with stakeholders
• Coordinating and steering the analysis
• Planning and allocating resources and budget
• Onboarding large banks (Asia and Eastern Europe) for Depot B
• Migrating Depot B holdings (volume around EUR 70-100 million)

• Led SampleManager LIMS 21.x & LabWare LIMS v8 implementation, reducing manual lab errors by 40% and improving data traceability.
• Configured LW LIMS & SM LIMS 21.2: workflow design, role-based access control (RBAC), and master data management.
• Designed and configured LES workflows: sample lifecycle management, test assignments, approvals, and result review processes.
• Managed Master Menu and CI configuration, ensuring consistency, data integrity, and regulatory compliance.
• Integrated LIMS 21.2 with MES, ERP, EM, WinKQCL (Lonza MODA), SoftMax Pro, Empower, and Chromeleon CDS via REST APIs and web services.
• Implemented PAS-X MES: architecture design, multi-platform implementation (PAS-X, Siemens Opcenter), and integration with PLC, SCADA, and DCS systems.
• Executed IQ/OQ/PQ qualification protocols and Validation Summary Reports (VSR) for QC analytical and utility systems in aseptic and sterile production environments.
• Developed and reviewed Risk Assessments, Traceability Matrices, and Data Integrity evaluations in accordance with ALCOA+, 21 CFR Part 11, and EU Annex 11.
• Led EMA/FDA/WHO inspection readiness, standardized CQV SOPs, enabled digital CQV integration (LIMS/CDS/MES/SCADA/ERP/SDMS), and ensured 21 CFR Part 11 & Annex 11 compliance.
• Managed secure OT cybersecurity: network configuration and access control.
• Configured NuGenesis SDMS for document/data management, CDS/LIMS integration, workflow automation, and reporting.

• Introduction of a new Information Security Management System (ISMS) according to ISO/IEC 27001.
• Implementation of the cybersecurity guideline RL CySec-Rail for cross-border rail networks.

• CFO of the company
• Consulting in processes and process management
• Consulting in information security ISO 27001
• Consulting Scrum / Agile Management
• Project management for IT projects, especially doctors' practices
• Digitalization projects
• Data protection / data security training

• Independently develop policies, guidelines, and frameworks for ICT risk management and information security
• Advise business units on ICT risk management and information security
• Further develop the ICT risk management framework that governs the identification, assessment, and control of ICT risks
• Evaluate the Information Security Management System (ISMS) and adjust it for new challenges
• Conduct risk analyses to identify and assess potential ICT risks and information security risks for the Metzler Group
• Advise on defining and implementing measures to reduce risks and improve the resilience of ICT systems
• Advise on ensuring compliance with relevant internal and external regulatory requirements (MaRisk, DORA, BAIT, BSI IT baseline protection, ISMS, ISO 27001, ISO 42001, ISO 27005, BCM ISO 22301)
• Advise on internal and cross-functional projects (SAP DORA compliance, Target2, Section 8a BSI Act)