MaRisk Expert in Frankfurt
for sound bank risk management, matched with vetted and available freelancersHire experts who design MaRisk-compliant risk frameworks, document governance processes and support audits across ICAAP, outsourcing and internal controls. Get a precise match with vetted, available freelancers in minutes.
Meet FRATCH Experts in Frankfurt, who have recently used MaRisk
Reza N.
Last position:
Senior IT-Security Expert at Teambank AG
- Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
- Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
- Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
- Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
- Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
- Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
- Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR
Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK
Eric B.
Last position:
Quality Assurance Manager (QSV) at Federal Employment Agency
Supporting the International Web Presence of the BA (IntWeb) project in the area of quality management, with the aim of taking responsibility for the quality of processes and project results while considering BA standards. The main objectives of the project are to give professionals abroad a quick overview of their opportunities for moving to Germany and to enable them to take the necessary steps consistently and with digital support by providing access to services.
Defining the general guidelines in the QA handbook
Summarising test results in QA reports for PLA
Analysing project results for improvement opportunities
Quality management of requirements analysis (particularly processes, methods, and tools)
Ensuring compliance with SERA requirements
Creating a cross-project test concept
Agreeing on sprint completion reports
Formal review of work results in accordance with requirements and/or the project plan
Contact person for internal audit, external audits by auditors, or BRH (Federal Court of Audit)
Technologies: JIRA, Confluence, MS Office, GitLab, Kubernetes
Dustin D.
Last position:
External consultant at Deutsche Leasing
2nd LoD/Change the Bank (CtB)
- CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).
Justina K.
Last position:
Freelance Consultant for Change & Data Transformation at Freelance Fast Data Consulting
Project, Strategic Consulting – building the Data Strategy and Data Governance Policy for the German branch, client (private bank Julius Bär, headquarters Zurich), March 2026 – present
- Design and negotiation of the data strategy with key stakeholders, including obtaining board sign-off (strategic consulting) – in this context, regulatory advice on data regulations in the EU and specifically for Germany. The data strategy includes: Data Lifecycle Management: data capture, data storage, data usage, data retention policy, data quality incident management
- Definition of milestones and technical feasibility for implementing TOM for the data strategy, data quality checks, metrics, and a metadata inventory to ensure the bank’s compliance with DORA, BCBS239, and MaRisk requirements.
Core project data change, client: (ING Bank, Frankfurt am Main), March – December 2025
- Concept development and solution design for new end-to-end processes including technical interfaces
- Definition of synchronization logic and data flows between legacy and target systems (decommissioning of legacy systems)
- Analysis and validation of data models
- Stakeholder communication with product owners, feature engineers, UX designers, and operational teams for decision-making
- Analytics and impact assessments, e.g. to assess downstream effects and regulatory requirements
- Documentation and comments on technical and business requirements to support implementation in agile squads
Project digitalization of a user group, client: (ING Bank, Frankfurt am Main), as Interim Product Owner, Jan 2025 – present
- Co-shaping key decisions on data architecture and process logic in the context of historized data and user login functionality
- Development of business solution concepts for migration to the target system, including system integration and data flows
- Support with analytics and impact analyses, especially regarding the ability to provide information to law enforcement authorities
- Active coordination with stakeholders from different squads to support decision-making and ensure regulatory requirements are met
- Creation of test scenarios for operational teams and backend systems in the area of API management using Postman and Bruno.
Jörn B.
Last position:
Project Management and PMO at TANKKARTEN | PAYMENT
- Close collaboration with development teams to ensure alignment with project objectives
- Assessment of in-scope assets, creation of requirements, and support of the public tender process through the selection of a provider
- Creation and maintenance of UML sequence diagrams to document system interactions
- Extensive use of Agile/Scrum methodology and Spotify model
- Development and implementation of cutover and dress rehearsal plans together with the application managers
Christine M.
Last position:
Management consultant at Freelance
Delivery of ICT / DORA management training under DORA Article 5(4) at various banking institutions
Teaching the key content of DORA requirements with a focus on ICT risks, third-party risk management, incident and problem management, and the information register
Deriving implementation measures and recommendations for management and business units
Firas J.
Last position:
Interim Management Group Head of IT Governance & IAM at French-German Private Bank
- Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
- Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
- Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
- Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
- Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
- Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
- Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
- Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.
Richard R.
Last position:
Vice President– Head of Claims Operations, Europe at SOMPO International
Managing TPA Manager and a team of 10 Claims Operation Assistants.
Designing and implementing processes and workstreams using Guidewire from the ground up with European claims teams across all lines of business.
Establishing service level agreements (SLAs) and detailed key performance indicators (KPIs) with new business intelligence (BI) reporting, payment and performance analysis.
Developing, steering and analysing 50+ strategic, operational and IT initiatives, driving digital change and AI automation in payments while meeting DORA, GDPR, ACM and BAIT MaRisk regulatory compliance.
Increasing customer satisfaction scores by 80%.
Attracting and mentoring market-leading operational and TPA talent.
Demonstrating strong stakeholder leadership and swift decisional influence.
Noel L.
Last position:
Founder & Lead Engineer at ausbildung-in-der-it.de
- Platform established and running stably; deliberately reducing my involvement to refocus on an engineering mandate in the financial sector.
- Built an own SaaS learning platform from the ground up and scaled it to over 20,000 users (over 6,000 courses sold, B2C and B2B); end-to-end ownership from development through infrastructure to operations.
- Built a lab environment that provisions an isolated Linux container per user (Docker, Traefik, Go), including automatic provisioning and a dedicated subdomain per user.
- Integrated LLM features into the product and accelerated development end-to-end with AI-assisted workflows (Claude Code, Codex); CI/CD with automated tests.
Dmitrii S.
Last position:
IT Risk & Compliance | DORA | IT Regulatory & Operational Resilience Senior Consultant at Jefferies GmbH
Leading Jefferies’ DORA-driven operational resilience programme by strengthening ICT risk governance, control design, and regulatory readiness across key technology and outsourcing domains. Partnering with senior stakeholders to translate regulatory requirements into pragmatic governance, reporting, and assurance processes suitable for a global investment banking environment.
- Developed the Enterprise Register of Information (DORA Art. 28.3) to align with regulatory requirements.
- Defined and embedded ICT Risk Appetite and tolerance levels aligned to the Global Operational Risk Framework, strengthening decision-making and risk acceptance governance.
- Drove audit readiness by reviewing and re-drafting 50+ IT & Information Security policies, improving clarity, ownership, and control alignment.
- Oversaw the Operational Resilience Testing Programme (including penetration testing) and tracked remediation to closure, strengthening control assurance and reducing open findings.
- Aligned 10+ intra-group agreements with DORA regulatory standards.
- Enhanced executive-level decision-making with an enterprise ICT Risk Dashboard featuring KPIs/KRIs.
Peter W.
Last position:
ISO 27001 Auditor for health insurance archive system at Health insurance company
The replacement of the existing archive system (document management system – DMS) on a host-based platform is well advanced.
The internal audit is meant to ensure the company's quality standards.
GDPR
ISO 27001 ff.
BSI
DORA
Patient data regulations
Host / Cloud / S3 / Container / highly scalable / Nuxeo
Budget: 50,000
Team: 1
Achim K.
Last position:
Portfolio Manager, Consultant, Leadership Coach at Abbvie Deutschland GmbH &Co. KG
- Management and optimization of a portfolio of about 100 projects (launches, in-field solutions, data & analytics, digital solutions, digital products)
- Optimization of the existing project standard (playbook) and alignment with the European and global organization (USA)
- Coaching project managers on setup, planning, cooperation with business, GDPR, GxP, data security and launches
- Preparing projects for works council information and project closeout communication
- Optimization of resource management (tracking, allocation, prioritization)
- Taking over individual project leads (off-/transboarding, event management, checking whether WhatsApp is allowed on a business smartphone)
- Supporting the hiring of external project managers
- Optimization of meeting structure, project controlling (KPIs), change and demand management
- Optimization of risk, issue, dependency and quality management and support during internal audits (GxP)
- Optimization of the portfolio steering tool (Smartsheet) on national, European and global level
- Design and implementation of a Business Value Complexity Scoring
- Building a strategic PMO with a sister department and optimizing cross-functional teams
- Reporting, communication and escalation at management level
- Leadership coaching for several future leaders (short-time assignment)
- Development of the concepts "PPM as a Service" and "Internal Customer Approach"
- Development and review of a concept "AI Data Governance" including roles and processes
- Selection and onboarding of the successor
Alexander M.
Last position:
Managing Director & Senior Project Manager at Mendelson GmbH
- Interim project manager and requirements engineer in various client projects
Markus G.
Last position:
Master Candidate at Universidad de Málaga
- Final preparation for the defense to graduate with a Master's in Computer Science for the PhD
Stefan F.
Last position:
Project Management – Telecommunications at 1&1 Versatel
- Set of concurrent projects (BSS/OSS related)
Discover over 15,000 top freelancers
Statistics of experts using MaRisk
Aggregated from the professional profiles of matched freelancers.
Experience
22 years (Germany: 24 years)
Position duration
2.5 years (Germany: 2.4 years)
Positions per freelancer
15 (Germany: 17)
Top business areas
Information Technology, Operations, Project Management
Top industries
Banking and Finance, Information Technology, Professional Services
Certification focus areas
Information Technology, Project Management, Quality Assurance
Bachelor's degree or higher
93% (Germany: 92%)
Master's degree or higher
60% (Germany: 56%)
Doctorate
7% (Germany: 10%)
Certifications per freelancer
6
Most common languages
German, English, French
Speak two or more languages
100% (Germany: 99%)
Based on our profile pool as of 29 Oct 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology in Frankfurt are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates of experts in Frankfurt using MaRisk
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 29 Oct 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
MaRisk experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Banking and Finance (95%)
- Information Technology (79%)
- Professional Services (58%)
- Insurance (47%)
- Automotive (37%)
- Energy (37%)
- Telecommunication (32%)
- Government and Administration (26%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
Regulatory foundation
MaRisk, short for Mindestanforderungen an das Risikomanagement, is BaFin’s framework for the organisation of risk management in German credit institutions. Its English description, Minimum Requirements for Risk Management, is also used in international projects. MaRisk connects governance, risk control and internal audit expectations.
AT and BT structure
The framework is commonly read through its general requirements in AT and its business-specific requirements in BT. It addresses risk strategy, risk-bearing capacity, management responsibilities, reporting, documentation and the control environment. Specialists translate these principles into policies, processes and evidence that stand up to supervisory review.
Risk disciplines
MaRisk work often spans the full control model and related banking processes:
- Define risk strategy, risk appetite and escalation paths
- Align ICAAP, stress testing and risk-bearing capacity
- Review credit processes, collateral and problem-loan handling
- Govern outsourcing, service providers and critical activities
- Prepare reports, control evidence and audit responses
Professionals may also connect MaRisk requirements with liquidity, market, operational and model risk management.
Systems and deliverables
Strong MaRisk specialists understand how requirements become usable controls. They work with risk inventories, process maps, control descriptions, reporting concepts and governance records. Depending on the assignment, they contribute to GRC tools, risk data platforms, document management, workflow systems and interfaces to regulatory reporting.
When companies need support
Banks and financial institutions bring in freelance expertise during remediation, new product launches, reorganisations, outsourcing assessments and supervisory reviews. Frankfurt teams may need on-site workshops for governance decisions, while documentation, analysis and evidence preparation can often be handled remotely. German language skills are frequently important for policies and communication with local stakeholders.
What strong experts bring
The best professionals combine practical banking knowledge with precise interpretation of MaRisk requirements. They can challenge incomplete controls without losing sight of business processes, risk data or accountable owners. Look for clear deliverables, audit-ready documentation and experience explaining findings to management, compliance, internal audit and operational teams.
Frequently asked questions
Not sure where to start with MaRisk? These answers cover the essentials.
MaRisk sets the minimum requirements for risk management at German credit institutions. It guides governance, risk strategy, internal controls, reporting, documentation and the handling of material risks.
MaRisk is a BaFin circular that interprets supervisory expectations for risk management in German banking. It works alongside rules such as the German Banking Act, CRR requirements and guidance from the European Banking Authority rather than replacing them.
A strong MaRisk specialist often brings knowledge of ICAAP, stress testing, credit risk, operational risk, outsourcing controls and internal audit. Familiarity with risk data, GRC tools and regulatory reporting makes the work more effective.
Companies engage MaRisk professionals for remediation programmes, governance redesigns, outsourcing reviews, new products and supervisory findings. The right level of expertise depends on the scope, risk profile and maturity of the institution, not simply on the length of a résumé.
MaRisk assignments can often be delivered remotely when documents, systems and decision-makers are accessible. Frankfurt-based institutions may still prefer on-site workshops for sensitive governance topics, and German is commonly needed for policies and communication with local stakeholders.
MaRisk is specific to German supervisory practice and therefore has a stronger local governance and documentation context than broad international frameworks. It can be mapped to standards such as Basel principles, but that mapping does not remove the need to meet German expectations.
Look for a MaRisk professional who explains requirements in terms of controls, owners, evidence and business impact. Ask for anonymised examples of risk assessments, remediation plans or audit responses, and test whether the person can identify gaps without proposing impractical processes.
MaRisk is principle-based, so institutions must apply it in proportion to their business model, risks and organisational structure. Consistency requires clear responsibilities, reliable risk data, documented decisions and effective challenge across management, control functions and internal audit.
The average hourly rate of freelancers in Frankfurt, Germany who have used MaRisk in their recent projects is 116 €, which corresponds to a daily rate of about 931 € based on an 8-hour working day.
Of the freelancers in Frankfurt, Germany who have used MaRisk in their recent projects, 93% hold at least a Bachelor's degree, 60% hold at least a Master's degree, and 7% hold a doctorate.
On average, freelancers in Frankfurt, Germany who have used MaRisk in their recent projects have 22 years of professional experience, with a single engagement typically lasting around 2.5 years.
The most common languages among freelancers in Frankfurt, Germany who have used MaRisk in their recent projects are German (100%), English (100%), and French (37%).
The most common industries among freelancers in Frankfurt, Germany who have used MaRisk in their recent projects are Banking and Finance (95%), Information Technology (79%), and Professional Services (58%).
The most common business areas among freelancers in Frankfurt, Germany who have used MaRisk in their recent projects are Information Technology (95%), Operations (89%), and Project Management (89%).
Main locations of FRATCH Experts, who have recently used MaRisk
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne 
Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Munich 
Cologne 
Dusseldorf Countries:
Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
