NIS2 Expert in Berlin
for resilient, compliant operations with precise AI matchingHire experts who turn the NIS2 Directive into practical security measures, supplier controls and incident processes. Work with vetted, available freelancers matched quickly to your requirements and project context.
Meet FRATCH Experts in Berlin, who have recently used NIS2
Andreas R.
Last position:
Freelance Consultant for Information Security at A-R-C Andreas RĂĽhl Consulting
Development and implementation of tailored information security strategies
Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards
Risk management and creation of security concepts
Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000
Building and improving security organizations
Creation and implementation of guidelines, policies, work instructions, and process descriptions
Audit support and certification preparation
Conducting trainings, workshops, and awareness campaigns
Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies
Conducting penetration tests and vulnerability analyses
Consulting on the selection, integration, and management of security architectures in complex IT environments
Consulting on ITSM and managed security services and SOC
Leading and managing complex projects to improve information security
Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics
Introduction and quality assurance of management, documentation, and knowledge management systems
Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)
Development and implementation of risk analysis procedures
Organizing initial response, forensic investigations, and organizational measures in the event of security incidents
Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios
Awareness campaigns to promote security culture in companies
Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards
Simulations and exercises to prepare for information security incidents
Interim management for leading information security projects or IT security organizations
Taking on the role of an external CISO (Chief Information Security Officer)
Support in developing and implementing IT security and corporate strategies
Coaching and mentoring of managers in the field of information security
Building and leading security departments as well as recruiting and qualifying employees
Temporary assumption of management responsibility in critical situations
Daria B.
Last position:
Senior Consultant Strategy, Risk & Resilience Management at Antharas
- Creating guidelines
- Conducting Business Impact Analyses (BIA), assessing risks, and identifying time-critical business processes
- Process management
- Creating emergency plans and crisis management plans, including cyber response and IT emergency plans with special consideration of a cyberattack
- Conducting awareness trainings
- Planning and carrying out tests and exercises
- Developing tailor-made solutions to reduce risks and ensure business continuity
Piet Q.
Last position:
IT Project Manager at no release
Industry: Publishing, media Project management for the concept of a RAG-based archive access solution: a secure on-prem or hybrid compute architecture for LLM and embedding operations, pipeline for transcription and automatic tagging, semantic search across audio and video archives. Use case evaluation and make-or-buy together with editorial team, archive, and legal department, taking into account copyright, broadcasting law, and the AI Act. Differentiator: practical LLM infrastructure experience from two own productive platforms combined with C-level program management in regulated industries.
André B.
Last position:
External Attack Surface Assessment & Cybersecurity Readiness Checks at Graydaxe Cybersecurity GmbH
- Conducting cybersecurity readiness checks based on an in-house assessment methodology
- Analyzing the external attack surface using the Graydaxe EASM platform
- Assessing maturity levels and deriving prioritized recommendations for action
Flamur A.
Last position:
Fractional Chief Information Security Officer at VR Smart Guide GmbH
- Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
- Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
- Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
- Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
- Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
- Implement continuous monitoring solutions to detect and respond to threats in real time.
- Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
- Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
- Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
- Collaborate with project teams to address findings and ensure that security risks are managed effectively.
- Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
- Facilitate a culture of security awareness throughout the organization through training and regular communication.
- Lead security initiatives that align with the organization’s long-term strategic goals.
- Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
- Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.
Matthias S.
Last position:
Senior Security Consultant (freelance) at DVZ M-V
- ISMS and security concept for the Fabasoft e-file according to BSI 200-1/2, among others
- Structural analysis (A.1), modeling (A.3), and baseline protection checks (A.4)
- Preparation for OWASP penetration test, incident response plan, risk analysis
- DevOps Bitbucket, ARC42, IAM with Keycloak/AD, multi-tenant setup, DMS, SOC
- Emergency preparedness concept (BSI 200-4), operations and service concept (BSK), ITSM
Mohamed G.
Last position:
Lead / Principal Cloud, AI & Security Architect at Freelancer / CC Conceptualise GmbH
Projects:
Project: RWE – Development of a company-wide Zero Trust cybersecurity architecture (CITADEL) Role: Senior Enterprise Cybersecurity Architect / Zero Trust Architect Company: RWE AG Description: Concept and implementation of the strategic CITADEL cybersecurity target architecture at RWE, based on the Zero Trust architecture principle and aligned with regulatory requirements such as NIS2, ISO 27001 and company-wide security governance policies. The goal was to build a measurable, auditable and scalable security architecture with a strong focus on Identity Governance, compliance transparency and operational manageability. Responsibilities & Achievements:
- Zero Trust architecture design: Developed a company-wide Zero Trust reference architecture (Identity, Device, Network, Application, Data) including trust zones, control points and enforcement mechanisms according to NIS2.
- Identity & Access Governance (IGA): Designed and introduced IGA governance structures including role models, recertification processes, segregation of duties (SoD) and lifecycle management for identities and access.
- Security governance & KPIs: Defined and implemented security KPIs and metrics to manage Zero Trust maturity, identity risks and compliance at the management level.
- Compliance & reporting: Built standardized compliance reports and dashboards to support internal audits, external assessments and regulatory evidence (e.g. NIS2).
- Architecture & stakeholder alignment: Worked closely with Enterprise Architecture, IT operations and business units to integrate the CITADEL architecture into existing IT and security landscapes.
- Strategic security consulting: Advised programs and projects on Zero Trust compliance, identity centricity and regulatory requirements in the energy and critical infrastructure (KRITIS) environment. Technologies & Methods: Zero Trust Architecture, NIS2, Identity Governance & Administration (IGA), IAM, RBAC, SoD, Entra ID, SailPoint, Zscaler, Terraform / IaC, Policy as Code, security KPIs, compliance reporting, NIST 2.0, ISO 27001, Enterprise Security Architecture, governance frameworks, risk & control management
Project: Scalable AI Workbench Platform on Microsoft Azure Role: Cloud Architect & Engineer Company: Siemens Energy Description: Design, development and operation of a secure, modular cloud infrastructure to support Data Science, Machine Learning and AI applications for various engineering teams at Siemens Energy. Responsibilities & Achievements:
- Cloud architecture: Designed and implemented an Infrastructure-as-Code solution (Terraform) for automated provisioning of Azure resources (Resource Groups, Storage Accounts, Cosmos DB, Application Insights, networking, PostgreSQL Flexible Server, Azure Container Apps, Azure Container Registry).
- Developer portal: Used Backstage with custom frontend and backend plugins (Node.js, TypeScript, React.js, PostgreSQL, Container Apps) to enable self-service and empower developers, data scientists and AI/ML engineers.
- Role-based access control: Implemented Azure RBAC to grant targeted access (e.g. Storage Blob Data Contributor, Reader) to engineering groups (e.g. AI Engineers) for relevant resources.
- Data platform engineering: Built and configured a multi-layered storage landscape (Raw, Curated, Vector data), including automated container creation and access control for advanced analytics and AI workloads.
- DevOps integration: Integrated with Azure DevOps for CI/CD pipelines to automate deployment, monitoring and compliance.
- Security & compliance: Implemented Private Endpoints, network policies and Managed Identities to ensure data protection and regulatory compliance.
- Collaboration: Worked closely with cross-functional teams to align the cloud infrastructure with business and technical requirements and drive digital transformation at Siemens Energy. Technologies: Azure, Terraform, Azure DevOps, Cosmos DB, Application Insights, Azure Storage, Private Endpoints, Azure Synapse, Azure Machine Learning, Azure Entra ID, RBAC, Backstage, Node.js, React.js, PostgreSQL, Python (automation), Git
Henryk O.
Last position:
Security Consultant at Daimler AG
- Development of a cloud security strategy
- Implementation of cloud security governance to comply with ISO/IEC 27017 and the CSA CCM
- Creation of a management system to control cloud security with a focus on process design as well as roles and responsibilities
- Definition of security measures to safeguard cloud solutions
- Conducting requirements analyses and defining the scope for cloud security projects
- Achievements: Established an effective NIS2-compliant cloud security governance that meets industry-specific requirements and effectively minimizes cloud security risks
Norbert S.
Last position:
Customer Journey Lead and Product Owner at Deutsche Glasfaser
Led the customer journey for all products to implement them in target systems (Salesforce, Mulesoft, and ServiceNow)
Served as Product Owner for integrations, process mapping, and data protection on TMF standard APIs
Built the end-to-end customer journey in close collaboration with the respective business units, adhering to the out-of-the-box philosophy
Mapped legacy and technical migration portfolios
Markus W.
Last position:
KRITIS Consultant at Oil Company
- Preparing an oil company for KRITIS auditing
- KRITIS consulting
- Creating necessary policies, processes, and guidelines in line with KRITIS requirements
- Tools and methodologies used: ISO/IEC 27001, BSI IT Baseline Protection, KRITIS-V
Discover over 15,000 top freelancers
Statistics of experts using NIS2
Aggregated from the professional profiles of matched freelancers.
Experience
23 years (Germany: 20 years)
Position duration
1.6 years (Germany: 2.1 years)
Positions per freelancer
21 (Germany: 15)
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Professional Services, Banking and Finance
Certification focus areas
Information Technology, Audit, Project Management
Bachelor's degree or higher
100% (Germany: 83%)
Master's degree or higher
67% (Germany: 46%)
Certifications per freelancer
11 (Germany: 7)
Most common languages
German, English, French
Speak two or more languages
100% (Germany: 95%)
Based on our profile pool as of 19 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Berlin are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Berlin using NIS2
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 19 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
NIS2 experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (100%)
- Professional Services (80%)
- Banking and Finance (60%)
- Manufacturing (60%)
- Automotive (50%)
- Education (50%)
- Media and Entertainment (50%)
- Energy (40%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
NIS2 in practice
NIS2 is the EU Network and Information Security Directive. It strengthens cybersecurity obligations for essential and important entities, covering risk management, incident handling, business continuity, supply-chain security and management accountability. Companies use it to turn security expectations into documented controls, tested processes and clear ownership.
Scope and obligations
The directive affects organisations in sectors such as energy, transport, health, digital infrastructure, public administration and manufacturing. Applicability depends on the organisation’s sector, size, role and services. Strong specialists help establish whether an organisation is in scope, map critical services and translate legal duties into an achievable security programme.
Security workstreams
- Assess current controls against NIS2 requirements
- Build risk management and incident response processes
- Define supplier, access and business continuity controls
- Prepare evidence, policies and management reporting
- Coordinate vulnerability handling and resilience tests
NIS2 work often connects governance with hands-on security operations. Useful deliverables include a gap assessment, risk register, control catalogue, incident playbooks, supplier questionnaires, training material and an implementation roadmap.
Connected frameworks
NIS2 specialists work across information security, privacy, resilience and IT operations. Their toolkit may include ISO 27001 controls, CIS guidance, security information and event management, identity and access management, vulnerability management, backup platforms and cloud security services. They also need to understand the relationship between NIS2, the GDPR and the Critical Entities Resilience Directive without treating them as interchangeable.
When to bring in expertise
Companies often seek freelance support before a regulatory assessment, during a merger, after a security incident or when internal teams lack capacity for a structured readiness programme. Signs include unclear ownership, inconsistent supplier reviews, untested recovery plans, weak evidence or uncertainty about whether German operations fall within scope. In Berlin, remote collaboration is common, while workshops with legal, risk and technology teams may still benefit from on-site sessions.
What strong specialists deliver
The best professionals combine regulatory interpretation with practical security experience. They ask how services actually run, identify controls that can be evidenced and adapt recommendations to the organisation’s risk profile. Look for clear assumptions, traceable requirements, useful documentation and the ability to explain NIS2 to management, operational teams and suppliers. German and English communication can be valuable for organisations working across Berlin and wider European operations.
Frequently asked questions
Need clarity? These are the questions we hear most often about NIS2.
NIS2 is used to raise cybersecurity and operational resilience across organisations that provide important services in the European Union. It covers risk management, incident reporting, supply-chain security, continuity planning and accountability at management level.
NIS2 is a cybersecurity directive focused on covered entities and the resilience of their services, while the GDPR focuses on personal data protection. ISO 27001 is a voluntary management-system standard in many contexts, so its controls can support NIS2 readiness but do not automatically prove compliance.
A strong NIS2 specialist usually understands information security governance, risk assessment, incident response, supplier assurance and business continuity. Experience with ISO 27001, cloud security, identity management, vulnerability management and privacy coordination is also useful.
The right level depends on whether the assignment is a scope assessment, a control redesign or an organisation-wide implementation. A specialist should be able to show relevant work with regulated services, evidence-based controls and stakeholder coordination rather than relying only on familiarity with the directive’s text.
NIS2 projects can often be delivered remotely through document reviews, interviews, workshops and secure collaboration tools. Berlin-based organisations may still prefer on-site sessions for executive alignment, facility reviews or coordination with teams that handle critical infrastructure.
NIS2 does not apply to every company automatically. Scope depends on the organisation’s sector, services, size and role, and German implementation rules must be considered alongside the directive; a qualified specialist can help document that assessment.
A useful NIS2 readiness review should produce a clear scope decision, requirements mapping, risk and control gaps, prioritised actions and evidence requirements. It should also explain dependencies across suppliers, incident response, continuity planning and management responsibilities.
Ask how the specialist would connect legal requirements to operating controls, measurable evidence and realistic ownership. Good NIS2 professionals explain trade-offs clearly, test whether processes work in practice and leave documentation that internal teams can maintain after the engagement.
The average hourly rate of freelancers in Berlin, Germany who have used NIS2 in their recent projects is 132 €, which corresponds to a daily rate of about 1,054 € based on an 8-hour working day.
Of the freelancers in Berlin, Germany who have used NIS2 in their recent projects, 100% hold at least a Bachelor's degree and 67% hold at least a Master's degree.
On average, freelancers in Berlin, Germany who have used NIS2 in their recent projects have 23 years of professional experience, with a single engagement typically lasting around 1.6 years.
The most common languages among freelancers in Berlin, Germany who have used NIS2 in their recent projects are German (100%), English (100%), and French (30%).
The most common industries among freelancers in Berlin, Germany who have used NIS2 in their recent projects are Information Technology (100%), Professional Services (80%), and Banking and Finance (60%).
The most common business areas among freelancers in Berlin, Germany who have used NIS2 in their recent projects are Information Technology (100%), Project Management (100%), and Operations (70%).
Main locations of FRATCH Experts, who have recently used NIS2
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Munich 
Cologne 
Frankfurt 
Essen Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
