IT-Sicherheitsgesetz Experts in Germany

As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW.  Developed and implemented a holistic process view covering both technical and organizational aspects  Ensured end-to-end control of all IAM-related technical services  Established clear responsibilities and accountabilities within the IAM landscape  Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security  Introduced and monitored governance policies to ensure compliance and security  Continuously improved IAM processes and systems through regular audits and evaluations  Participated in external audits of the process as part of official ISO audits  Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units  Conceptually advanced the KPI system to measure process quality

• Recognition of national notified bodies
• Preparation of cybersecurity competency reports
• EU Radio Equipment Directive

• Leading and building integrated management systems (IMS) for quality (QMS), data protection and information security (ISMS), risk (GRC), and artificial intelligence (AI) in accordance with ISO 9001, ISO 27001, ISO 42001, ISO 21500, ISO 21502, ISO 37301, ISO 31000
• Governance, project, and transformation management nationally and internationally incl. enterprise and project governance
• Process development, optimization, and business process reengineering according to BPMN 2.0, Kaizen, IATF 16949, VDA, BPMN 2.0
• Compliance and risk management in the company and project context as well as connection to internal control systems (ICS) and Group Risk Compliance (GRC)
• Carrying out and leading internal audits and lead audits according to ISO 19011; audit management and test equipment / special equipment management
• Methodical and systemic coaching (IFS, Hakomi) as well as conflict moderation and change management
• Designing and delivering AI trainings, prompt engineering, and AI literacy workshops
• Advising on data protection impact assessments (DPIA), implementing EU GDPR, BDSG, and IT-SiG as well as NIS-2 and DORA
• Building and leading Program Management Offices (PMO) and introducing Project Management Office structures
• Contract management, clause-by-clause analyses, and project controlling according to PMI® standards incl. Earned Value Management
• Building knowledge, document, and content management systems (Confluence, SharePoint, EY iManage)

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures

• Consulting and support in gathering information security requirements (IT-SIG 2.0, KRITIS, TISAX, industry standards, ISO 27001, A-960/1)

• Acting as data protection officer and auditor as well as information security auditor

• Conducting employee training

• Updating risk analyses with risk treatment

• Designing information security concepts based on BSI IT Baseline Protection, KRITIS, ISO 27001, A-960/1 and TISAX

• Identifying information security requirements for IT systems (WAN, LAN, clouds) and overseeing implementation

• Administering the ISMS using Verinice and SAVe

• Integrating security concepts into existing management systems according to ISO 9001 and ISO 27001

• Process management and modeling according to ITIL

• Management consulting for integrating an ISMS into integrated management systems

• Advising on data protection (GDPR, BDSG)

• Planning and conducting data protection audits

• Designing risk management processes and methodologies according to ISO 27005, ISO 31000 and BSI 200-3

• Developing and setting up training programs for employees

• Building an information security management system for the entire group
• Supporting 2 KRITIS subsidiaries

• Making new compliance norms easily readable

• Enhanced quality assurance of documents, processes and required evidence in preparation for the upcoming KRITIS audit 2025.
• Reviewing and commenting on all relevant documents.
• Advising authors and document owners on inquiries and during the creation process.
• Supporting departments with IT security inquiries.
• Used tools/Frameworks MS Office, SharePoint, Jira, Confluence, ISO27001+, NIS-2 (EU 2022/2555), B3S (Statutory Health & Private Health Insurance), BSIG / IT-SIG 2.0, BSI-KritisV, BSI-C5, BSI Baseline Protection (200-2, 200-4), ServiceNow, RCE (EU 2022/2557), SGB, GDPR

• Planning and managing all projects in the context of IT security
• Establishing a Cyber Security Incident Response procedure according to ISO/IEC 27035
• NIS2 readiness: impact analysis, planning and implementation of NIS2 compliance
• Management reporting based on KPIs