NIS2 Expert in Berlin

Following the Vaillant engagement, established independent practice focused on senior SAP advisory and building ASTRA — a methodology, not a tool. ASTRA is independent and unbiased: the same four pillars serve CIO / Business Leadership, SI / SAP Practice, and Programme Director / Principal with equal weight. No audience is primary.

ASTRA serves three audiences with equal weight — CIO / Business Leadership · SI / SAP Practice · Programme Director / Principal. ASTRA is independent and unbiased — it does not sit inside any SI practice and does not serve any single audience as primary customer. Each audience receives a role-calibrated output from the same analysis.

One methodology, two outcomes:

OUTCOME 1 — SAP TRANSFORMATION GOVERNANCE:

Any active SAP programme: ECC→S/4HANA Greenfield, Brownfield, Global Rollout, AMS. The four pillars answer the four questions that determine whether a transformation succeeds — for any of the three audiences.

• Are business requirements clean — or is the SI building what SAP standard already covers? (Functional Auditor → all three audiences)
• Is the custom object inventory healthy — or accumulating debt that blocks upgrades? (RICEFW Auditor → Director and CIO)
• Is the SteerCo reporting accurate — or is leadership seeing a Watermelon? (Truth Engine → CIO and Director)
• Are people ready for the system they are receiving? (Human Signal → CIO and Director)

OUTCOME 2 — AUTONOMOUS ENTERPRISE READINESS:

Any programme deploying Joule, pursuing RISE, or planning an AE migration. The same four pillars answer the questions SAP does not — again, calibrated per audience.

• Which custom objects block the 224 Joule AI agents? (RICEFW Auditor → SI gets remediation paths, Director gets verdicts, CIO gets financial impact)
• Is the Fiori deployment complete enough to activate Joule? (Truth Engine → all three audiences)
• Is the workforce trained for AI-native working? (Human Signal → CIO and Director)

Four pillars (each serves all three audiences):

• Functional Auditor: Clean Core Score 0–100. Section A (CIO): KG fidelity risk in €. Section B (Director): SI challenge questions, man-day saving. Section C (SI): Language Translation Ledger, SAP alternatives.
• RICEFW Auditor: Joule API Pathway Audit, Clean Core Level A–D, Technical Debt Index 1–10. Section A: financial impact of blocked AI agents. Section B: RETIRE/MIGRATE/REDESIGN/KEEP verdicts. Section C: BTP remediation paths.
• Truth Engine: Watermelon Detection, Fiori Deployment check, Programme Truth Score 0–100. Section A: 3 SteerCo questions. Section B: 48-hour action list. Section C: vendor friction map.
• Human Signal: three-stage Fiori adoption model, HITL Policy readiness, Human Signal Score 0–100. Section A: GUI training weight, AE adoption financial risk. Section B: go-live recommendation, stakeholder resistance map.

On-Demand SAP Advisory:

• SAP Programme Management — end-to-end governance, factory management, multi-stream delivery, vendor oversight, SteerCo reporting for Greenfield, Brownfield, Rollout and AMS programmes.
• Delivery Management — RICEFW oversight, Data Migration governance, Release & Cutover management, Hypercare, SLA/KPI management.
• Due Diligence & Landscape Assessment — SAP landscape review, AS-IS/TO-BE roadmap, RFP structuring, SI selection advisory.
• IT Strategy & CIO Advisory — transformation roadmap, Clean Core strategy, Autonomous Enterprise readiness planning.
• Programme Recovery — distressed programme assessment, rapid governance setup, escalation resolution.

Operating through senior professional networks across EMEA.

• Development and implementation of tailored information security strategies

• Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards

• Risk management and creation of security concepts

• Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000

• Building and improving security organizations

• Creation and implementation of guidelines, policies, work instructions, and process descriptions

• Audit support and certification preparation

• Conducting trainings, workshops, and awareness campaigns

• Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies

• Conducting penetration tests and vulnerability analyses

• Consulting on the selection, integration, and management of security architectures in complex IT environments

• Consulting on ITSM and managed security services and SOC

• Leading and managing complex projects to improve information security

• Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics

• Introduction and quality assurance of management, documentation, and knowledge management systems

• Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)

• Development and implementation of risk analysis procedures

• Organizing initial response, forensic investigations, and organizational measures in the event of security incidents

• Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios

• Awareness campaigns to promote security culture in companies

• Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards

• Simulations and exercises to prepare for information security incidents

• Interim management for leading information security projects or IT security organizations

• Taking on the role of an external CISO (Chief Information Security Officer)

• Support in developing and implementing IT security and corporate strategies

• Coaching and mentoring of managers in the field of information security

• Building and leading security departments as well as recruiting and qualifying employees

• Temporary assumption of management responsibility in critical situations

• Creating guidelines
• Conducting Business Impact Analyses (BIA), assessing risks, and identifying time-critical business processes
• Process management
• Creating emergency plans and crisis management plans, including cyber response and IT emergency plans with special consideration of a cyberattack
• Conducting awareness trainings
• Planning and carrying out tests and exercises
• Developing tailor-made solutions to reduce risks and ensure business continuity

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action

• Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
• Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
• Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
• Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
• Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
• Implement continuous monitoring solutions to detect and respond to threats in real time.
• Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
• Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
• Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
• Collaborate with project teams to address findings and ensure that security risks are managed effectively.
• Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
• Facilitate a culture of security awareness throughout the organization through training and regular communication.
• Lead security initiatives that align with the organization’s long-term strategic goals.
• Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
• Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

• ISMS and security concept for the Fabasoft e-file according to BSI 200-1/2, among others
• Structural analysis (A.1), modeling (A.3), and baseline protection checks (A.4)
• Preparation for OWASP penetration test, incident response plan, risk analysis
• DevOps Bitbucket, ARC42, IAM with Keycloak/AD, multi-tenant setup, DMS, SOC
• Emergency preparedness concept (BSI 200-4), operations and service concept (BSK), ITSM

Projects:

Project: RWE – Development of a company-wide Zero Trust cybersecurity architecture (CITADEL) Role: Senior Enterprise Cybersecurity Architect / Zero Trust Architect Company: RWE AG Description: Concept and implementation of the strategic CITADEL cybersecurity target architecture at RWE, based on the Zero Trust architecture principle and aligned with regulatory requirements such as NIS2, ISO 27001 and company-wide security governance policies. The goal was to build a measurable, auditable and scalable security architecture with a strong focus on Identity Governance, compliance transparency and operational manageability. Responsibilities & Achievements:

• Zero Trust architecture design: Developed a company-wide Zero Trust reference architecture (Identity, Device, Network, Application, Data) including trust zones, control points and enforcement mechanisms according to NIS2.
• Identity & Access Governance (IGA): Designed and introduced IGA governance structures including role models, recertification processes, segregation of duties (SoD) and lifecycle management for identities and access.
• Security governance & KPIs: Defined and implemented security KPIs and metrics to manage Zero Trust maturity, identity risks and compliance at the management level.
• Compliance & reporting: Built standardized compliance reports and dashboards to support internal audits, external assessments and regulatory evidence (e.g. NIS2).
• Architecture & stakeholder alignment: Worked closely with Enterprise Architecture, IT operations and business units to integrate the CITADEL architecture into existing IT and security landscapes.
• Strategic security consulting: Advised programs and projects on Zero Trust compliance, identity centricity and regulatory requirements in the energy and critical infrastructure (KRITIS) environment. Technologies & Methods: Zero Trust Architecture, NIS2, Identity Governance & Administration (IGA), IAM, RBAC, SoD, Entra ID, SailPoint, Zscaler, Terraform / IaC, Policy as Code, security KPIs, compliance reporting, NIST 2.0, ISO 27001, Enterprise Security Architecture, governance frameworks, risk & control management

Project: Scalable AI Workbench Platform on Microsoft Azure Role: Cloud Architect & Engineer Company: Siemens Energy Description: Design, development and operation of a secure, modular cloud infrastructure to support Data Science, Machine Learning and AI applications for various engineering teams at Siemens Energy. Responsibilities & Achievements:

• Cloud architecture: Designed and implemented an Infrastructure-as-Code solution (Terraform) for automated provisioning of Azure resources (Resource Groups, Storage Accounts, Cosmos DB, Application Insights, networking, PostgreSQL Flexible Server, Azure Container Apps, Azure Container Registry).
• Developer portal: Used Backstage with custom frontend and backend plugins (Node.js, TypeScript, React.js, PostgreSQL, Container Apps) to enable self-service and empower developers, data scientists and AI/ML engineers.
• Role-based access control: Implemented Azure RBAC to grant targeted access (e.g. Storage Blob Data Contributor, Reader) to engineering groups (e.g. AI Engineers) for relevant resources.
• Data platform engineering: Built and configured a multi-layered storage landscape (Raw, Curated, Vector data), including automated container creation and access control for advanced analytics and AI workloads.
• DevOps integration: Integrated with Azure DevOps for CI/CD pipelines to automate deployment, monitoring and compliance.
• Security & compliance: Implemented Private Endpoints, network policies and Managed Identities to ensure data protection and regulatory compliance.
• Collaboration: Worked closely with cross-functional teams to align the cloud infrastructure with business and technical requirements and drive digital transformation at Siemens Energy. Technologies: Azure, Terraform, Azure DevOps, Cosmos DB, Application Insights, Azure Storage, Private Endpoints, Azure Synapse, Azure Machine Learning, Azure Entra ID, RBAC, Backstage, Node.js, React.js, PostgreSQL, Python (automation), Git

• Development of a cloud security strategy
• Implementation of cloud security governance to comply with ISO/IEC 27017 and the CSA CCM
• Creation of a management system to control cloud security with a focus on process design as well as roles and responsibilities
• Definition of security measures to safeguard cloud solutions
• Conducting requirements analyses and defining the scope for cloud security projects
• Achievements: Established an effective NIS2-compliant cloud security governance that meets industry-specific requirements and effectively minimizes cloud security risks

Led the customer journey for all products to implement them in target systems (Salesforce, Mulesoft, and ServiceNow)

Served as Product Owner for integrations, process mapping, and data protection on TMF standard APIs

Built the end-to-end customer journey in close collaboration with the respective business units, adhering to the out-of-the-box philosophy

Mapped legacy and technical migration portfolios

• Preparing an oil company for KRITIS auditing
• KRITIS consulting
• Creating necessary policies, processes, and guidelines in line with KRITIS requirements
• Tools and methodologies used: ISO/IEC 27001, BSI IT Baseline Protection, KRITIS-V