MaRisk Experts in Germany
matched in minutes with the power of AIWork with specialists who master BaFin regulatory audits, risk governance architectures, and internal control frameworks, precisely matched from vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used MaRisk
Paul K.
Last position:
Program Manager – Multi-Project Operational Stabilization (Operational Excellence) at ITDZ - IT Service Center Berlin
- Overall leadership of several strategic operations projects focusing on Workplace Services, SLA Framework, access management, certificate management, e-learning, backup & recovery, test management, and capacity management, as well as the introduction of system monitoring and feasibility studies for 24x7 operations, in some cases including implementation in ServiceNow
- Creation of various ServiceNow operating concepts covering training, access rights, and emergency management as part of a new cloud hosting initiative for the ServiceNow platform
- Executive board reports and leadership of steering committees as part of company-wide strategic objectives, as well as the establishment of new balanced scorecards for measuring KPIs related to optimization-driven project results
Katarzyna G.
Last position:
Interim Financial Accountant / Accounts Payable at Consulting for an alcoholic beverage manufacturer
- Supported monthly and annual closing activities
- Checked incoming invoices for formal and factual accuracy
- Posted incoming invoices
- Contact person for internal departments on accounting matters
- Created and maintained vendor master data
- Processed open items
- Took on additional accounting-related special tasks
- Managed the functional mailbox
- Performed payment runs
Training and knowledge transfer – Accounts Payable:
In addition to the tasks above, I was responsible for training and transferring knowledge to 8 employees of an external service provider in India who took over the accounts payable activities:
- Conducted structured training and practical guidance throughout the accounts payable process
- Trained employees in checking and posting incoming invoices, including formal and factual checks
- Taught vendor master data maintenance, open-item processing and payment runs
- Trained employees in using the functional mailbox and communicating effectively with internal departments
- Explained accounting procedures, controls and company-specific accounts payable requirements
- Conducted “Training on the Job” using practical posting cases and real business transactions
- Supported the team in independently carrying out accounts payable processes and resolving accounting questions
- Checked the quality and accuracy of work results and provided continuous feedback and coaching
- Supported the transfer of accounts payable processes to the external service provider and ensured structured knowledge transfer and an orderly handover
- Supported a smooth transition by documenting processes, clarifying responsibilities and ensuring consistent application of accounting requirements
Software: JDE, ELO, SAP Concur
Onur K.
Last position:
Project Manager & Outsourcing Manager at SENEC GmbH (EnBW Group)
- Built a scalable nearshore IT developer hub (Croatia, Czech Republic, Poland) as an independent company through a BOT model (Build – Operate – Transfer)
- Identified, selected, and managed full-service agencies; introduced management and control mechanisms, including KPIs, SLAs, and regular service reviews
- Prepared and reviewed data processing agreements and framework contracts in coordination with Legal & Compliance; integrated regulatory requirements (including KRITIS) into process design
- Advised on cloud vs. on-premise strategies, data storage, and authorization concepts; supported Procurement with tendering and service provider evaluations
- Managed change and process harmonization between internal teams and nearshore partners; reported to executive management, CFO, and CIO
Result: Scalable IT developer hub with an audit-ready governance model, reduced operating costs, and accelerated product development.
Reza N.
Last position:
Senior IT-Security Expert at Teambank AG
- Completed the integration of log sources into Microsoft Sentinel, including GCP workloads – centralized consolidation of all security-relevant events from Azure and GCP environments for complete end-to-end telemetry and comprehensive compliance evidence
- Developed custom rules and use cases based on the GFG Use-Case Library and the MITRE ATT&CK Matrix to cover company-specific threats and GFG-relevant scenarios with precise, mapped detection rules
- Tuned detection rules to minimize false positives, optimized detection thresholds, and modeled exceptions – enabling the SOC to work with relevant, prioritized alerts while reducing Mean Time to Detect/Respond
- Built SOAR capabilities in Sentinel by developing playbooks to automate recurring response processes such as containment, user and host isolation, and ticketing – shorter response times and 24/7 scalability
- Designed and built a log transformation solution to normalize and enrich incoming raw logs (GeoIP, CMDB, threat intelligence) and convert them into a consistent schema for high-performance KQL queries, use case logic, and correlations
- Managed Azure security through Azure Policies to enforce security and compliance standards, prevent drift, and continuously remediate deviations
- Operated the Defender XDR portal to link endpoint, identity, email, and SaaS signals with Sentinel findings, enable holistic incident triage, and orchestrate measures directly from XDR
Technologies: Microsoft Sentinel, Microsoft Defender XDR, Azure Policy, KQL, GCP, MITRE ATT&CK
Michael S.
Last position:
Establishment of Compliance/TPRM at Haftpflichtkasse
Establishment of Compliance Department & DORA Operationalization
- Establishment of a complete compliance organization in accordance with DORA
- Development and operationalization of the SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, newsfeeds)
- Establishment of a decentralized risk and action register
- Preparation of GAP analyses and derivation of measures
- Establishment and maintenance of the Outsourcing Information Register
- Use of proprietary TPRM frameworks, checklists and process models
Establishment of Compliance Department & DORA Operationalization
- Establishment of a complete compliance organization in accordance with DORA
- Development and operationalization of the SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, newsfeeds)
- Establishment of a decentralized risk and action register
- Preparation of GAP analyses and derivation of measures
- Establishment and maintenance of the Outsourcing Information Register
- Use of proprietary TPRM frameworks, checklists and process models
- Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
- Overall responsibility for establishing a Compliance, Governance and Risk organization
- Establishment of an integrated GRC model and executive reporting for the Management Board.
Manfred P.
Last position:
Senior IT Project Manager EfA / OZG Online Services at Senatskanzlei ITD Hamburg, Dataport, Police Hamburg
The online service "Special Use of Streets and No-Parking Zone" was in a partially completed state. The following tasks had to be carried out to reach final completion:
- Preparation of an expert report on the status of the online service, and recommendations for action
- Ensuring that all LEIKAS to be used are available (service catalog / service descriptions of the authorities)
- Creating and aligning concepts for complex IT projects (business/IT concepts, architecture, interfaces, roadmaps)
- Requirements management
- Multi-project management with 3 stakeholders (Police, Dataport, development company)
- Determining resource needs
- Coordination to identify technical requirements through the IT architects
- Creating use cases and test cases
- Creating action items
- Managing external IT service providers
- Coordination and management of all activities
- Conflict resolution / business mediation
- User Acceptance Test (UAT) and acceptance by Hamburg Police (Traffic Directorate, Policy Department, Central Road Traffic Authority)
Technical environment: .NET, EfA minimum requirements, Leikas, Administrative Procedure Act (VwVfG), HWG (Hamburg Roads Act), Atlassian Jira, Confluence, MS Office
Florian B.
Last position:
Project Management / PMO Consultant
PMO & Project Organization Blueprint for Restructuring
Renewable Energy / Solar Equipment
Technologies / Methods: PMO setup, KPI tracking, project organization, Jira, Confluence
- Developed measures to improve management control during a restruct...
Günther E.
Last position:
IT Security & Governance Consulting (DORA & NIS2): at Freelance Assignment
Strategic consulting for the development and strengthening of ISMS structures (ISO 27001 / BSI IT-Grundschutz), including onboarding, gap analyses, and preparation of the IT organization for DORA requirements (ICT third-party risk) and NIS2 compliance. Auditing compliance requirements in a regulated environment.
Dustin D.
Last position:
External consultant at Deutsche Leasing
2nd LoD/Change the Bank (CtB)
- CtB: External consultant and workstream lead for rectifying findings by BaFin following a special IT audit in the 2nd LoD, management of the work package for revising the ICT Risk Management & ICT Asset Classification in accordance with DORA Chapter 2, the processes for structural analysis, protection requirements, and control assessments (4 FTEs).
Ronald F.
Last position:
Senior IT Consultant – Requirement Engineer at Deutsche Bank - Strivion
Methodology: Agile project management
Goal: Digitization and implementation of CCD2 requirements within the Consumer Finance systems.
Analysis, identification, and assessment of business requirements, as well as their transfer into technical implementation requirements. Coordination and status reporting of the various requirements. Documentation and process management using UML and BMPN. Cross-functional stakeholder management, UAT testing, data management, API architecture management.
Tools: Jira, Confluence, Visual Code, Sql Developer, Enterprise Architect, MsOffice, Bruno, ALM, Camunda, Figma
Justina K.
Last position:
Freelance Consultant for Change & Data Transformation at Freelance Fast Data Consulting
Project, Strategic Consulting – building the Data Strategy and Data Governance Policy for the German branch, client (private bank Julius Bär, headquarters Zurich), March 2026 – present
- Design and negotiation of the data strategy with key stakeholders, including obtaining board sign-off (strategic consulting) – in this context, regulatory advice on data regulations in the EU and specifically for Germany. The data strategy includes: Data Lifecycle Management: data capture, data storage, data usage, data retention policy, data quality incident management
- Definition of milestones and technical feasibility for implementing TOM for the data strategy, data quality checks, metrics, and a metadata inventory to ensure the bank’s compliance with DORA, BCBS239, and MaRisk requirements.
Core project data change, client: (ING Bank, Frankfurt am Main), March – December 2025
- Concept development and solution design for new end-to-end processes including technical interfaces
- Definition of synchronization logic and data flows between legacy and target systems (decommissioning of legacy systems)
- Analysis and validation of data models
- Stakeholder communication with product owners, feature engineers, UX designers, and operational teams for decision-making
- Analytics and impact assessments, e.g. to assess downstream effects and regulatory requirements
- Documentation and comments on technical and business requirements to support implementation in agile squads
Project digitalization of a user group, client: (ING Bank, Frankfurt am Main), as Interim Product Owner, Jan 2025 – present
- Co-shaping key decisions on data architecture and process logic in the context of historized data and user login functionality
- Development of business solution concepts for migration to the target system, including system integration and data flows
- Support with analytics and impact analyses, especially regarding the ability to provide information to law enforcement authorities
- Active coordination with stakeholders from different squads to support decision-making and ensure regulatory requirements are met
- Creation of test scenarios for operational teams and backend systems in the area of API management using Postman and Bruno.
Peter K.
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Mahmoud Q.
Last position:
Information Security & GRC Expert at GLG (Gerson Lehrman Group)
As a Council Member at GLG (Gerson Lehrman Group), the world’s leading expert network, I provide organizations, investment firms, and consulting companies with expert discussions on demand – wherever specialized knowledge in information security, IT governance, and regulatory compliance is needed.
My assessments are based on many years of practical experience in highly regulated industries: from building and implementing information security management systems (ISMS according to ISO 27001), IT risk and vulnerability management, and business continuity (ISO 22301) to the practical implementation of European regulations such as DORA, NIS2, BAIT, and the Cyber Resilience Act (CRA).
The cooperation is project- and discussion-based. I provide decision-makers with a practical perspective gained from real-world experience on cyber risks, security governance, and operational resilience – exactly when it is needed.
Pierre G.
Last position:
Ansible Automation, Windows Third Level Support at DB InfraGO AG
- PRISMA project
- Ansible automation
- Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019
Henning K.
Last position:
Management Consultant, Senior Enterprise Architect at Self employed
- Establishment of enterprise architecture management in organizations, enterprise architecture (analysis, target architecture, and coordination) at the business, information systems, and infrastructure levels
- Project management
- Conducting tool selections
- Use of the following knowledge: Enterprise Architecture Management, EAM, TOGAF, ArchiMate, Capability Mapping, Application Portfolio Management, Architecture Governance, Target Architecture, Roadmap, LeanIX, Ardoq, Alfabet, BAIT, VAIT, DORA, IT Strategy, Cloud Transformation
Discover over 15,000 top freelancers
Statistics of experts using MaRisk
Aggregated from the professional profiles of matched freelancers.
Experience
24 years
Position duration
2.4 years
Positions per freelancer
16
Top business areas
Information Technology, Project Management, Operations
Top industries
Banking and Finance, Information Technology, Professional Services
Certification focus areas
Information Technology, Project Management, Quality Assurance
Bachelor's degree or higher
92%
Master's degree or higher
56%
Doctorate
10%
Certifications per freelancer
6
Most common languages
German, English, French
Speak two or more languages
98%
Based on our profile pool as of 9 Oct 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Discover detailed MaRisk rate benchmarks:
Explore rate insightsAverage rates of experts in Germany using MaRisk
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 9 Oct 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
MaRisk experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Banking and Finance (89%)
- Information Technology (82%)
- Professional Services (62%)
- Insurance (40%)
- Government and Administration (38%)
- Energy (36%)
- Manufacturing (33%)
- Telecommunication (26%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
Regulatory Framework for German Financial Institutions
MaRisk, short for Mindestanforderungen an das Risikomanagement, defines the administrative standards issued by BaFin for risk management in financial institutions. The framework operationalizes Section 25a of the German Banking Act (Kreditwesengesetz or KWG). It enforces structural requirements across corporate governance, internal controls, and risk control functions.
Core Functional Pillars and Compliance Scope
- Internal governance structures, risk appetite frameworks, and organizational segregation
- Credit business processes, counterparty risk assessments, and loan processing controls
- Trading operations, market price risk measurement, and liquidity risk monitoring
- Operational risk governance, business continuity planning, and crisis management
Interface with Technical and Operational Standards
The framework closely aligns with technical supervisory standards, particularly BAIT for information risk and incoming DORA requirements. Organizations must integrate data aggregation mechanisms conforming to BCBS 239 into their reporting pipelines. Specialized professionals map technical system logs and access management controls back to overarching risk management workflows.
Outsourcing Governance and Third-Party Risk
Section AT 9 sets stringent requirements for outsourcing operational and technological activities. Regulated entities must maintain comprehensive third-party inventories, risk-rate multi-vendor dependencies, and establish enforceable exit strategies. Independent experts audit service agreements and verify continuous monitoring processes against evolving regulatory circulars.
When Institutions Engage Freelance Regulatory Specialists
Banks and financial services firms in Germany regularly bring in external professionals during supervisory audits, remediation programs, and major structural reorganizations. Independent talent guides Section 44 KWG special audits, resolves supervisory findings, and adjusts credit or market risk handbooks when BaFin issues updated circulars or novel guidance notes.
Core Competencies of Senior Risk Professionals
Leading practitioners combine thorough knowledge of German supervisory law with practical exposure to risk management software. They interpret circular provisions into actionable controls, conduct gap analyses against European Banking Authority guidelines, and prepare audit-proof documentation for internal auditors and external regulators.
Frequently asked questions
Before you brief your next project: the most common questions about MaRisk.
The primary objective of MaRisk is to enforce qualitative risk management standards across German financial institutions pursuant to the KWG. It ensures that credit institutions and financial services firms maintain an adequate internal control system, clear operational structures, and continuous risk monitoring mechanisms.
While Mindestanforderungen an das Risikomanagement governs broad enterprise risk, BAIT details specific supervisory expectations for IT infrastructure. Furthermore, the Digital Operational Resilience Act introduces unified European standards for cyber risk and third-party oversight, meaning experts must align domestic qualitative standards with European operational resilience mandates.
A senior MaRisk specialist needs practical expertise in the German Banking Act, risk classification methods, and internal audit standards. Familiarity with governance tools, core banking databases, and BCBS 239 data governance frameworks is equally critical for translating regulatory circulars into operational workflows.
Many documentation and gap analysis tasks for MaRisk can be completed remotely. However, institutions in Germany often prefer hybrid arrangements for interviews with process owners, coordination with executive boards, and direct participation during Section 44 KWG audits.
Working with MaRisk in Germany generally requires business-level German and English. While European guidelines and technical integrations often run in English, official BaFin correspondence, procedural handbooks, and board reporting are primarily documented in German.
Unlike quantitative capital requirement frameworks, MaRisk focuses on qualitative risk governance, structural organization, and procedural transparency. It establishes organizational segregation between front-office sales and back-office settlement rather than calculating mathematical capital ratios.
Institutions usually engage external MaRisk experts when facing BaFin special audits, receiving formal audit findings that need rapid remediation, or executing major corporate acquisitions. Urgent needs also arise when BaFin publishes updated circulars requiring extensive adjustments to internal policies.
Quality is evaluated through a track record of successfully managed BaFin audits, deep familiarity with Mindestanforderungen an das Risikomanagement, and the ability to produce audit-proof control designs. High-performing professionals deliver sustainable policies that satisfy regulatory scrutiny without stalling day-to-day banking operations.
The average hourly rate of freelancers in Germany who have used MaRisk in their recent projects is 116 €, which corresponds to a daily rate of about 926 € based on an 8-hour working day.
Of the freelancers in Germany who have used MaRisk in their recent projects, 92% hold at least a Bachelor's degree, 56% hold at least a Master's degree, and 10% hold a doctorate.
On average, freelancers in Germany who have used MaRisk in their recent projects have 24 years of professional experience, with a single engagement typically lasting around 2.4 years.
The most common languages among freelancers in Germany who have used MaRisk in their recent projects are German (100%), English (95%), and French (31%).
The most common industries among freelancers in Germany who have used MaRisk in their recent projects are Banking and Finance (89%), Information Technology (82%), and Professional Services (62%).
The most common business areas among freelancers in Germany who have used MaRisk in their recent projects are Information Technology (93%), Project Management (91%), and Operations (74%).
Main locations of FRATCH Experts, who have recently used MaRisk
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Cologne 
Frankfurt 
Dusseldorf Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
