MaRisk Experts in Germany
matched in minutes with the power of AIWork with specialists who master BaFin regulatory audits, risk governance architectures, and internal control frameworks, precisely matched from vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used MaRisk
Paul K.
Last position:
Program Manager – Multi-Project Operational Stabilization (Operational Excellence) at ITDZ - IT Service Center Berlin
- Overall leadership of several strategic operations projects focusing on Workplace Services, SLA Framework, access management, certificate management, e-learning, backup & recovery, test management, and capacity management, as well as the introduction of system monitoring and feasibility studies for 24x7 operations, in some cases including implementation in ServiceNow
- Creation of various ServiceNow operating concepts covering training, access rights, and emergency management as part of a new cloud hosting initiative for the ServiceNow platform
- Executive board reports and leadership of steering committees as part of company-wide strategic objectives, as well as the establishment of new balanced scorecards for measuring KPIs related to optimization-driven project results
Onur K.
Last position:
Project Manager & Outsourcing Manager at SENEC GmbH (EnBW Group)
- Built a scalable nearshore IT developer hub (Croatia, Czech Republic, Poland) as an independent company through a BOT model (Build – Operate – Transfer)
- Identified, selected, and managed full-service agencies; introduced management and control mechanisms, including KPIs, SLAs, and regular service reviews
- Prepared and reviewed data processing agreements and framework contracts in coordination with Legal & Compliance; integrated regulatory requirements (including KRITIS) into process design
- Advised on cloud vs. on-premise strategies, data storage, and authorization concepts; supported Procurement with tendering and service provider evaluations
- Managed change and process harmonization between internal teams and nearshore partners; reported to executive management, CFO, and CIO
Result: Scalable IT developer hub with an audit-ready governance model, reduced operating costs, and accelerated product development.
Reza N.
Last position:
Senior IT-Security Expert at Teambank AG
- Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
- Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
- Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
- Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
- Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
- Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
- Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR
Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK
Manfred P.
Last position:
Senior IT Project Manager EfA / OZG Online Services at Senatskanzlei ITD Hamburg, Dataport, Police Hamburg
The online service "Special Use of Streets and No-Parking Zone" was in a partially completed state. The following tasks had to be carried out to reach final completion:
- Preparation of an expert report on the status of the online service, and recommendations for action
- Ensuring that all LEIKAS to be used are available (service catalog / service descriptions of the authorities)
- Creating and aligning concepts for complex IT projects (business/IT concepts, architecture, interfaces, roadmaps)
- Requirements management
- Multi-project management with 3 stakeholders (Police, Dataport, development company)
- Determining resource needs
- Coordination to identify technical requirements through the IT architects
- Creating use cases and test cases
- Creating action items
- Managing external IT service providers
- Coordination and management of all activities
- Conflict resolution / business mediation
- User Acceptance Test (UAT) and acceptance by Hamburg Police (Traffic Directorate, Policy Department, Central Road Traffic Authority)
Technical environment: .NET, EfA minimum requirements, Leikas, Administrative Procedure Act (VwVfG), HWG (Hamburg Roads Act), Atlassian Jira, Confluence, MS Office
Günther E.
Last position:
IT Security & Governance Consulting (DORA & NIS2): at Freelance Assignment
Strategic consulting for the development and strengthening of ISMS structures (ISO 27001 / BSI IT-Grundschutz), including onboarding, gap analyses, and preparation of the IT organization for DORA requirements (ICT third-party risk) and NIS2 compliance. Auditing compliance requirements in a regulated environment.
Firas J.
Last position:
Interim Management Group Head of IT Governance & IAM at French-German Private Bank
- Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
- Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
- Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
- Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
- Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
- Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
- Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
- Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.
Dustin D.
Last position:
External consultant at Deutsche Leasing
2nd LoD/Change the Bank (CtB)
- CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).
Robert K.
Last position:
Interim Manager | Group Leader in the IT Operations & Digitalization Division "Databases, Operations & Support" (DOS) at Landwirtschaftliche RentenBank
- Technical leadership and further development of a team of 28 IT staff (internal & external) in the areas HelpDesk/HelpLine, RHEL (Red Hat), MUREX (trading system & applications), SAP basis operations
- Managing external service providers (including FI-TS for SAP basis operations)
- Personnel, resource and budget planning for the IT department and projects
- Introducing and establishing regular communication formats (weekly status meetings, team and cross-department meetings)
- Ensuring application operations in a hybrid environment (Windows/Linux with database and web/application servers)
- Supporting transformation projects to modernize the application landscape (e.g. DevOps approaches)
- Setting up and implementing a digital IT procurement for hardware & software (e.g. with DELL)
- Developing and managing the "IT Operations DOS" department based on corporate strategy
- Preparing management reports & decision papers on IT projects, optimization potential and automation opportunities
- Representing the department in the advisory boards of the Rentenbank and ensuring regulatory compliance (BaFin §44, GDPR, BSI, MaRisk)
Florian B.
Last position:
Business Architect — Project Organization Blueprint for Restructuring
Tasks & results:
- Developed measures to improve management steering during a restructuring program (approx. 80 participants)
- Set up a PMO to ensure transparency, reporting and data-driven decisions
- Created an integration template to transfer team s...
Justina K.
Last position:
Freelance Consultant for Change & Data Transformation at Freelance Fast Data Consulting
Project, Strategic Consulting – building the Data Strategy and Data Governance Policy for the German branch, client (private bank Julius Bär, headquarters Zurich), March 2026 – present
- Design and negotiation of the data strategy with key stakeholders, including obtaining board sign-off (strategic consulting) – in this context, regulatory advice on data regulations in the EU and specifically for Germany. The data strategy includes: Data Lifecycle Management: data capture, data storage, data usage, data retention policy, data quality incident management
- Definition of milestones and technical feasibility for implementing TOM for the data strategy, data quality checks, metrics, and a metadata inventory to ensure the bank’s compliance with DORA, BCBS239, and MaRisk requirements.
Core project data change, client: (ING Bank, Frankfurt am Main), March – December 2025
- Concept development and solution design for new end-to-end processes including technical interfaces
- Definition of synchronization logic and data flows between legacy and target systems (decommissioning of legacy systems)
- Analysis and validation of data models
- Stakeholder communication with product owners, feature engineers, UX designers, and operational teams for decision-making
- Analytics and impact assessments, e.g. to assess downstream effects and regulatory requirements
- Documentation and comments on technical and business requirements to support implementation in agile squads
Project digitalization of a user group, client: (ING Bank, Frankfurt am Main), as Interim Product Owner, Jan 2025 – present
- Co-shaping key decisions on data architecture and process logic in the context of historized data and user login functionality
- Development of business solution concepts for migration to the target system, including system integration and data flows
- Support with analytics and impact analyses, especially regarding the ability to provide information to law enforcement authorities
- Active coordination with stakeholders from different squads to support decision-making and ensure regulatory requirements are met
- Creation of test scenarios for operational teams and backend systems in the area of API management using Postman and Bruno.
Peter K.
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Matthias M.
Last position:
Project Manager at HSBC
- Project Manager for banking projects
- Management and coordination of the projects 'XONTRO T7 Migration' and 'UNO – Unified for New Opportunities'. Management of international stakeholders, preparation and leadership of steering committees, and coordination between departments, exchanges, and external partners.
- Project management of the strategic projects 'XONTRO T7 Migration' and 'UNO – Unified for New Opportunities'
- Management of international stakeholders including exchanges, custodians, and external project partners
- Coordination of functional and technical test activities at the exchanges between trading, IT, accounting, and mid-/back office
- Facilitation of steering committees at management level
- Preparation of decision papers, status reports, and risk analyses
- Conduct analyses in the areas of reporting (compliance, regulatory reporting, etc.), taxes on securities transactions & custody accounts, process analysis
- Enforcement of required requirements/specifications
- Coordination between business, IT, operations, and external market participants
- Coordination and alignment with external market participants, service providers, exchanges, and other project stakeholders
Pierre G.
Last position:
Ansible Automation, Windows Third Level Support at DB InfraGO AG
- PRISMA project
- Ansible automation
- Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019
Noel L.
Last position:
Founder & Lead Engineer at ausbildung-in-der-it.de
- Platform established and running stably; deliberately reducing my involvement to refocus on an engineering mandate in the financial sector.
- Built an own SaaS learning platform from the ground up and scaled it to over 20,000 users (over 6,000 courses sold, B2C and B2B); end-to-end ownership from development through infrastructure to operations.
- Built a lab environment that provisions an isolated Linux container per user (Docker, Traefik, Go), including automatic provisioning and a dedicated subdomain per user.
- Integrated LLM features into the product and accelerated development end-to-end with AI-assisted workflows (Claude Code, Codex); CI/CD with automated tests.
Achim K.
Last position:
Portfolio Manager, Consultant, Leadership Coach at Abbvie Deutschland GmbH &Co. KG
- Management and optimization of a portfolio of about 100 projects (launches, in-field solutions, data & analytics, digital solutions, digital products)
- Optimization of the existing project standard (playbook) and alignment with the European and global organization (USA)
- Coaching project managers on setup, planning, cooperation with business, GDPR, GxP, data security and launches
- Preparing projects for works council information and project closeout communication
- Optimization of resource management (tracking, allocation, prioritization)
- Taking over individual project leads (off-/transboarding, event management, checking whether WhatsApp is allowed on a business smartphone)
- Supporting the hiring of external project managers
- Optimization of meeting structure, project controlling (KPIs), change and demand management
- Optimization of risk, issue, dependency and quality management and support during internal audits (GxP)
- Optimization of the portfolio steering tool (Smartsheet) on national, European and global level
- Design and implementation of a Business Value Complexity Scoring
- Building a strategic PMO with a sister department and optimizing cross-functional teams
- Reporting, communication and escalation at management level
- Leadership coaching for several future leaders (short-time assignment)
- Development of the concepts "PPM as a Service" and "Internal Customer Approach"
- Development and review of a concept "AI Data Governance" including roles and processes
- Selection and onboarding of the successor
Discover over 15,000 top freelancers
Statistics of experts using MaRisk
Aggregated from the professional profiles of matched freelancers.
Experience
24 years
Position duration
2.5 years
Positions per freelancer
17
Top business areas
Information Technology, Project Management, Operations
Top industries
Banking and Finance, Information Technology, Professional Services
Certification focus areas
Information Technology, Project Management, Quality Assurance
Bachelor's degree or higher
91%
Master's degree or higher
56%
Doctorate
11%
Certifications per freelancer
6
Most common languages
German, English, French
Speak two or more languages
98%
Based on our profile pool as of 19 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Discover detailed MaRisk rate benchmarks:
Explore rate insightsAverage rates of experts in Germany using MaRisk
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 19 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
MaRisk experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Banking and Finance (88%)
- Information Technology (81%)
- Professional Services (62%)
- Insurance (40%)
- Government and Administration (39%)
- Energy (36%)
- Manufacturing (33%)
- Automotive (26%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
Regulatory Framework for German Financial Institutions
MaRisk, short for Mindestanforderungen an das Risikomanagement, defines the administrative standards issued by BaFin for risk management in financial institutions. The framework operationalizes Section 25a of the German Banking Act (Kreditwesengesetz or KWG). It enforces structural requirements across corporate governance, internal controls, and risk control functions.
Core Functional Pillars and Compliance Scope
- Internal governance structures, risk appetite frameworks, and organizational segregation
- Credit business processes, counterparty risk assessments, and loan processing controls
- Trading operations, market price risk measurement, and liquidity risk monitoring
- Operational risk governance, business continuity planning, and crisis management
Interface with Technical and Operational Standards
The framework closely aligns with technical supervisory standards, particularly BAIT for information risk and incoming DORA requirements. Organizations must integrate data aggregation mechanisms conforming to BCBS 239 into their reporting pipelines. Specialized professionals map technical system logs and access management controls back to overarching risk management workflows.
Outsourcing Governance and Third-Party Risk
Section AT 9 sets stringent requirements for outsourcing operational and technological activities. Regulated entities must maintain comprehensive third-party inventories, risk-rate multi-vendor dependencies, and establish enforceable exit strategies. Independent experts audit service agreements and verify continuous monitoring processes against evolving regulatory circulars.
When Institutions Engage Freelance Regulatory Specialists
Banks and financial services firms in Germany regularly bring in external professionals during supervisory audits, remediation programs, and major structural reorganizations. Independent talent guides Section 44 KWG special audits, resolves supervisory findings, and adjusts credit or market risk handbooks when BaFin issues updated circulars or novel guidance notes.
Core Competencies of Senior Risk Professionals
Leading practitioners combine thorough knowledge of German supervisory law with practical exposure to risk management software. They interpret circular provisions into actionable controls, conduct gap analyses against European Banking Authority guidelines, and prepare audit-proof documentation for internal auditors and external regulators.
Frequently asked questions
Before you brief your next project: the most common questions about MaRisk.
The primary objective of MaRisk is to enforce qualitative risk management standards across German financial institutions pursuant to the KWG. It ensures that credit institutions and financial services firms maintain an adequate internal control system, clear operational structures, and continuous risk monitoring mechanisms.
While Mindestanforderungen an das Risikomanagement governs broad enterprise risk, BAIT details specific supervisory expectations for IT infrastructure. Furthermore, the Digital Operational Resilience Act introduces unified European standards for cyber risk and third-party oversight, meaning experts must align domestic qualitative standards with European operational resilience mandates.
A senior MaRisk specialist needs practical expertise in the German Banking Act, risk classification methods, and internal audit standards. Familiarity with governance tools, core banking databases, and BCBS 239 data governance frameworks is equally critical for translating regulatory circulars into operational workflows.
Many documentation and gap analysis tasks for MaRisk can be completed remotely. However, institutions in Germany often prefer hybrid arrangements for interviews with process owners, coordination with executive boards, and direct participation during Section 44 KWG audits.
Working with MaRisk in Germany generally requires business-level German and English. While European guidelines and technical integrations often run in English, official BaFin correspondence, procedural handbooks, and board reporting are primarily documented in German.
Unlike quantitative capital requirement frameworks, MaRisk focuses on qualitative risk governance, structural organization, and procedural transparency. It establishes organizational segregation between front-office sales and back-office settlement rather than calculating mathematical capital ratios.
Institutions usually engage external MaRisk experts when facing BaFin special audits, receiving formal audit findings that need rapid remediation, or executing major corporate acquisitions. Urgent needs also arise when BaFin publishes updated circulars requiring extensive adjustments to internal policies.
Quality is evaluated through a track record of successfully managed BaFin audits, deep familiarity with Mindestanforderungen an das Risikomanagement, and the ability to produce audit-proof control designs. High-performing professionals deliver sustainable policies that satisfy regulatory scrutiny without stalling day-to-day banking operations.
The average hourly rate of freelancers in Germany who have used MaRisk in their recent projects is 115 €, which corresponds to a daily rate of about 921 € based on an 8-hour working day.
Of the freelancers in Germany who have used MaRisk in their recent projects, 91% hold at least a Bachelor's degree, 56% hold at least a Master's degree, and 11% hold a doctorate.
On average, freelancers in Germany who have used MaRisk in their recent projects have 24 years of professional experience, with a single engagement typically lasting around 2.5 years.
The most common languages among freelancers in Germany who have used MaRisk in their recent projects are German (100%), English (95%), and French (32%).
The most common industries among freelancers in Germany who have used MaRisk in their recent projects are Banking and Finance (88%), Information Technology (81%), and Professional Services (62%).
The most common business areas among freelancers in Germany who have used MaRisk in their recent projects are Information Technology (92%), Project Management (91%), and Operations (75%).
Main locations of FRATCH Experts, who have recently used MaRisk
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Cologne 
Frankfurt 
Dusseldorf Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
