MaRisk Experts in Germany

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

2nd LoD/Change the Bank (CtB)

• CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).

• Technical leadership and further development of a team of 28 IT staff (internal & external) in the areas HelpDesk/HelpLine, RHEL (Red Hat), MUREX (trading system & applications), SAP basis operations
• Managing external service providers (including FI-TS for SAP basis operations)
• Personnel, resource and budget planning for the IT department and projects
• Introducing and establishing regular communication formats (weekly status meetings, team and cross-department meetings)
• Ensuring application operations in a hybrid environment (Windows/Linux with database and web/application servers)
• Supporting transformation projects to modernize the application landscape (e.g. DevOps approaches)
• Setting up and implementing a digital IT procurement for hardware & software (e.g. with DELL)
• Developing and managing the "IT Operations DOS" department based on corporate strategy
• Preparing management reports & decision papers on IT projects, optimization potential and automation opportunities
• Representing the department in the advisory boards of the Rentenbank and ensuring regulatory compliance (BaFin §44, GDPR, BSI, MaRisk)

Project, Strategic Consulting – building the Data Strategy and Data Governance Policy for the German branch, client (private bank Julius Bär, headquarters Zurich), March 2026 – present

• Design and negotiation of the data strategy with key stakeholders, including obtaining board sign-off (strategic consulting) – in this context, regulatory advice on data regulations in the EU and specifically for Germany. The data strategy includes: Data Lifecycle Management: data capture, data storage, data usage, data retention policy, data quality incident management
• Definition of milestones and technical feasibility for implementing TOM for the data strategy, data quality checks, metrics, and a metadata inventory to ensure the bank’s compliance with DORA, BCBS239, and MaRisk requirements.

Core project data change, client: (ING Bank, Frankfurt am Main), March – December 2025

• Concept development and solution design for new end-to-end processes including technical interfaces
• Definition of synchronization logic and data flows between legacy and target systems (decommissioning of legacy systems)
• Analysis and validation of data models
• Stakeholder communication with product owners, feature engineers, UX designers, and operational teams for decision-making
• Analytics and impact assessments, e.g. to assess downstream effects and regulatory requirements
• Documentation and comments on technical and business requirements to support implementation in agile squads

Project digitalization of a user group, client: (ING Bank, Frankfurt am Main), as Interim Product Owner, Jan 2025 – present

• Co-shaping key decisions on data architecture and process logic in the context of historized data and user login functionality
• Development of business solution concepts for migration to the target system, including system integration and data flows
• Support with analytics and impact analyses, especially regarding the ability to provide information to law enforcement authorities
• Active coordination with stakeholders from different squads to support decision-making and ensure regulatory requirements are met
• Creation of test scenarios for operational teams and backend systems in the area of API management using Postman and Bruno.

Support for Internal Audit:

Conducting an audit of the data protection officer and data protection management:

• Preparing an audit program based on the audit field concept
• Requesting the necessary audit documentation
• Carrying out control testing based on the audit program with the following focus:
• Reviewing the relevant PPS processes
• Reviewing the data protection mission statement, data protection policy, and data protection management concept
• Conducting audit interviews with the data protection officer
• Preparing the audit documentation
• Training a junior auditor in the methodology of Internal Audit
• Coordinating the audit documentation with the head of audit

Compliance department setup & DORA operationalization

• Setup of a complete compliance organization according to DORA
• Development and operationalization of SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, news feeds)
• Setup of a decentralized risk and action register
• Creation of gap analyses and derivation of actions
• Setup and maintenance of the outsourcing information register
• Use of own TPRM frameworks, checklists and process models

Compliance department setup & DORA operationalization

• Setup of a complete compliance organization according to DORA
• Development and operationalization of SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, news feeds)
• Setup of a decentralized risk and action register
• Creation of gap analyses and derivation of actions
• Setup and maintenance of the outsourcing information register
• Use of own TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of achieved project goals within management reporting.

• Designed a future-proof client database for marketing purposes
• Analyzed requirements, designed, and modeled an entity-relationship model
• Consolidated and optimized a client file from various data sources for targeted marketing campaigns
• Worked closely with marketing and IT in an agile environment to iteratively develop the solution
• Technologies and methods: MS Office (mainly Excel), MS Dynamics CRM, MS SharePoint

• Consulting, training, and coaching in the financial sector on strategy, organization, and IT topics

• MorgenFund: Advising the operator of a fund platform on software selection for a sub-ledger "Cash Accounts" based on Virtual IBANs (VIBAN)

• Structuring requirements, market screening, creating RfIs, communicating with vendors, and conducting the selection process

• UniCredit/HypoVereinsbank: Workstream lead "Booking and Customer Reporting" in the payment transformation project "PULS"

• Business analysis, creating business requirements and aligning solution items as part of the functional specification with the bank's IT service providers

• Business analysis of SEPA CT and SWIFT MX (.camt, .pain, and .pacs formats), change management, team lead for a virtual team of fifteen line experts, and stakeholder management

• equensWorldline Germany: Program management for three projects of the SWIFT service bureau (CBPR+, ESMIG, and Euro1Step1 migration) as part of the SWIFT MX migration

• Managing individual project managers regarding overarching goals and requirements; reporting to internal and external committees and stakeholders; coordinating with dependent projects and programs

• Project management/PMO: interim project management, stand-in for project managers, resource planning, budget and cost management, general PMO tasks

• Platform established and running stably; deliberately reducing my involvement to refocus on an engineering mandate in the financial sector.
• Built an own SaaS learning platform from the ground up and scaled it to over 20,000 users (over 6,000 courses sold, B2C and B2B); end-to-end ownership from development through infrastructure to operations.
• Built a lab environment that provisions an isolated Linux container per user (Docker, Traefik, Go), including automatic provisioning and a dedicated subdomain per user.
• Integrated LLM features into the product and accelerated development end-to-end with AI-assisted workflows (Claude Code, Codex); CI/CD with automated tests.

• Management and optimization of a portfolio of about 100 projects (launches, in-field solutions, data & analytics, digital solutions, digital products)
• Optimization of the existing project standard (playbook) and alignment with the European and global organization (USA)
• Coaching project managers on setup, planning, cooperation with business, GDPR, GxP, data security and launches
• Preparing projects for works council information and project closeout communication
• Optimization of resource management (tracking, allocation, prioritization)
• Taking over individual project leads (off-/transboarding, event management, checking whether WhatsApp is allowed on a business smartphone)
• Supporting the hiring of external project managers
• Optimization of meeting structure, project controlling (KPIs), change and demand management
• Optimization of risk, issue, dependency and quality management and support during internal audits (GxP)
• Optimization of the portfolio steering tool (Smartsheet) on national, European and global level
• Design and implementation of a Business Value Complexity Scoring
• Building a strategic PMO with a sister department and optimizing cross-functional teams
• Reporting, communication and escalation at management level
• Leadership coaching for several future leaders (short-time assignment)
• Development of the concepts "PPM as a Service" and "Internal Customer Approach"
• Development and review of a concept "AI Data Governance" including roles and processes
• Selection and onboarding of the successor

• Analysis and audit of the current situation on-site and at customer locations
• Planning of IT infrastructures and advice on new hardware purchases as well as migration planning
• Planning and management of the IT budget
• Configuration and support of IT hardware under Windows 7, 8.x, 10 and Mac OS
• Review and update of documentation with regard to GDPR
• Analysis and expansion of technical and organizational measures in accordance with GDPR and BDSG
• Training of employees
• Training in AI-Assistant Consulting and Cybersecurity with AI
• Recording the current state and planning the target state
• 2nd/3rd level support (C/S/N)
• Technical environment: Exchange Administration, Active Directory, MS Server 2016 R2, MS Server 2022, MS SQL Developer, MS SQL, Visual Studio 2013+, Tivoli Monitoring, Tivoli Remote, TeamViewer, weclapp CRM Solution, RA-Micro, IT Compliance, Citrix, UltraEdit, SCCM, Windows XP–11, Office 2010–M365, VPN Solutions, Lexware Solutions, OKI Management Solutions, LogMyTime, SAGE Systems

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Project manager for banking projects

Implementation of anti-money laundering requirements in accordance with AMLA/KYC for an international large bank in Munich

Services provided:

• Clarification of the assignment, definition of the work package structure for the AMLA/KYC implementation project
• AI-supported project planning using my own AI workflow for project management
• Creation of the project management plan
• Resource and capacity planning
• Development of collaboration structures between IT service provider and bank client
• Alignment of responsibilities (RACI matrix)
• Management of 5 project members (core team)
• Project control, project monitoring, project reporting
• Communication management
• Escalation management
• Stakeholder management (11 stakeholders)
• Permanent member of the steering committee
• Project representation internally and externally
• Project reporting, management of decision-making bodies
• Project volume: 506 person-days (development effort)
• Risk management
• Quality management
• Organization and running of workshops

Methods: PMI PMBOK, EVM, GWG, DORA, BAIT, KANBAN, AML, AMLR, AMLA, GWG, KYC

IT environment: JIRA, Confluence, Sharepoint, Kantata Kimble, AI LLM Copilot, ChatGPT, anti-money laundering systems (in-house developments and SMARAGD)