One Identity Manager Experts in Germany

• Create and lead roadmap forecasting of support opportunities, including colleague training, process design and improvement, and new hire onboarding.
• Collaborate seamlessly with cross-functional teams including Professional Services, Support, Product, Sales, and Solution Engineering.
• Manage business and financial KPIs in alignment with overall business objectives.
• Industrial IT & Data Integration: Implement, configure, and integrate OT/IT systems and data flows, connecting control-layer sources (DCS, PLC, SCADA) to historians, data platforms, and enterprise systems through APIs and standard interfaces.
• AVEVA PI & Historian: Configure, maintain, and extend AVEVA PI (PI Data Archive, Asset Framework, interfaces/connectors) to capture, contextualize, and serve real-time and historical operational data.
• Alarm Management: Support and optimize alarm management systems – e.g. Honeywell Alarm Management – including alarm rationalization, classification, and the analysis of alarm performance, critical alarms, and alarm floods.
• Connectivity & Protocols: Set up and troubleshoot industrial connectivity using OPC UA and OPC A&E, including the configuration of tunnelers / wrappers to bridge OT data sources securely and reliably.
• Production Data Flow: Ensure seamless, secure, and well-structured data flow across the industrial IT landscape, transforming raw operational data into meaningful information for operations and decision-making.
• System Support & Troubleshooting: Provide ongoing support for OT/IT applications, troubleshooting issues across networks, software, and data integrations to keep systems running efficiently.
• Knowledge Management & Best Practices: Contribute to internal documentation, best practices, and troubleshooting guides, and help continuously improve how we deliver industrial IT and data solutions.

Tools & Software: Aveva PI, Salesforce, Active Directory, Microsoft Dynamics 365, Jira, Microsoft, Scrum, DevOps, Docker, CI/CD, Jenkins, GitHub.

Business analysis / requirements engineering for the introduction of a central authorization platform:

• Analysis of existing requirements for the use of IGA solutions (NetIQ, MidPoint) in an existing IAM cluster
• Capturing requirements as epics and user stories (JIRA) to provide a comprehensive description of the use of an IGA solution for central access control across connected platforms and applications.
• Functional solution descriptions (Confluence) for various lifecycle processes, such as Identity Lifecycle (ILC), Role Lifecycle (RLC), Structure Lifecycle (SLC), and Application Lifecycle
• RBAC: Design of a role model in the IGA solution to automate access provisioning as much as possible, capturing application and business roles
• Approach for onboarding applications to the IGA tool, integrating Keycloak (ID Provider).
• Functions and processes for recertifying entitlement objects and roles, and for assigning / removing them from personalized identities.
• Functions and processes for audit-proof documentation and reporting of managed data and processes in the IGA / IAM environment.
• Planning, execution, and documentation of QA / testing for the 1st implementation phase of the MidPoint IGA solution in the IAM cluster.
• Planning a roadmap for the step-by-step testing and introduction of the IGA solution.

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models

Establishment of Compliance Department & DORA Operationalization

• Establishment of a complete compliance organization in accordance with DORA
• Development and operationalization of the SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, newsfeeds)
• Establishment of a decentralized risk and action register
• Preparation of GAP analyses and derivation of measures
• Establishment and maintenance of the Outsourcing Information Register
• Use of proprietary TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of project goals achieved as part of management reporting.
• Overall responsibility for establishing a Compliance, Governance and Risk organization
• Establishment of an integrated GRC model and executive reporting for the Management Board.

To achieve savings and optimize compliance, apps were restructured in line with the mappings in identity management, restrictions were defined and, above all, costs resulting from overuse were reduced. Communication with stakeholders, validation of authorizations with users and technical implementation in the SAP FI/CO and Sourcing & Procurement modules created significant added value for the group. This also included the corresponding documentation for the auditors.

Windows Administrator, software distribution, user support, Azure / Entra Administrator, hardware support, software packaging, defining and introducing processes

Tasks performed:

• Handling incidents, service requests and changes in the Matrix42 ticketing system
• Processing and resolving issues
• User creation / permissions
• Windows installation and patch management
• Entra permissions and license management
• Process optimization and documentation

Tools and methods used: Windows Server 2016 / 2019, Active Directory, Windows 11, Office 365, Azure / Entra, Ivanti, VMWare & ESX, Dell & Kyocera Minolta & Zeus hardware support

Interim Lead ITSM Transformation

Industry: Retail & Industry – Optics (partly critical infrastructure)

Mandate: Transition of ITSM governance to the product- and capability-oriented governance model already established across the Group, as well as acceleration and partial automation of service volumes through optimized entry channels. Design and system-based implementation of an ITSM target operating model.

• ITSM target process design based on the capability owner model: target processes and ownership for Incident, Service Request, Problem, Change Enablement, CMDB, Service Level, Supplier and Knowledge Management, derived from the Group-wide target operating model
• AI-supported Enterprise Service Management: Reorganization of currently mixed requests into a structured, cross-functional service model including a new self-service portal. AI-supported classification and automation considered in the architecture model
• Migration & Cloud Architecture: Planning and management of the end-to-end migration, coordination of cutover management and go-live support; ensuring productive stability during the hypercare phase. Consideration of a multi-source CMDB (~500,000 assets), connection of go-live-critical field service and vendor interfaces
• Scaling & Blueprint: Central instance for headquarters and production, designed as a blueprint for additional international retail and production sites
• Delivery and Stakeholder Management: End-to-end management from target vision to go-live with regard to time, budget & quality. Building consensus and balancing interests between independently managed IT units up to CIO level

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation

• Integration of Post-Quantum Cryptography (PQC) algorithms into high level protocols.
• Security of implementations of Post-Quantum Cryptography algorithms.
• Transition to Post-Quantum public key infrastructures.
• Security evaluations of Post-Quantum Cryptography (PQC) primitives.
• Drone Cybersecurity
• Satellite Cybersecurity
• AI Security

• Software development
• Technical design of software architecture and design (considering functional and non-functional requirements)
• Frontend and Backend
• Refactorings
• Code reviews
• Unit tests
• Automated integration tests
• E2E tests

Global Identity Services (GIS) is the identity provider for the Digital Services Platform (DSP). GIS is responsible for authenticating and authorizing end users and other DSP services by issuing security tokens. This includes:

• Identity management (e.g., user registration, password reset and change, user profiles)
• Management of roles and permissions
• Single Sign-On (SSO) across DSP services
• Management of OAuth resources and terms and conditions

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

• Planning and control: Responsible for the timely integration of 50 applications into the company-wide GIAM platform
• Stakeholder workshops: Organizing and moderating workshops with technical and business contacts (application owners, compliance, QA, GIAM core team)
• Technical analysis: Review and analysis of existing role and permission models, mapping to the GIAM structure, selection of the right onboarding track
• Concept adaptation: Further development of the GIAM onboarding framework while taking regulatory requirements and individual application needs into account
• Process integration: Embedding the new IAM processes into existing operations, release, and support processes without service interruption
• Communication and reporting: Ongoing coordination with stakeholders, management of feedback and changes, progress and risk reporting
• Quality assurance: Definition of test strategies, execution of functional and interface tests, documentation of all onboarding steps

• Introduction of giro card with Visa Debit card payment function (Combocard) for Commerzbank
• Support for the Card Processing Team (card processing; Clearing & Settlement incl. Dispute Management teams) in project work
• Creation of requirements for the Clearing & Settlement team, Authorization team (AZ) and Card Production team (KP) as part of a requirements catalog
• Requirements engineering (requirements management) with business contact person
• Participation in workstream meetings between VISA Inc., SRC Security Research & Consulting GmbH, Commerzbank AG and consulting firms (PwC and Senacor Technologies AG)
• Sprint planning with Jira tickets of type Task and use of Confluence
• Creation and presentation of weekly status reports for the Clearing & Settlement, Dispute Management and Reporting & GUI workstreams
• Coordination with network and file transfer teams for connection tests of new interfaces, e.g. setup of host keys, use of VPN or sipnet connections
• Coordination of the delivery of test files, e.g. exchange rates (FX rates; TC 56 of VISA rates), VISA Debit and Credit transactions (format Base II) and EANSS/ISS Base II clearing files to the Debit Clearing System (DCS)
• Conducting coordination meetings on the use of Visanet Settlement Service (VSS) and PSD2 reports and payment traffic statistics (ZVS)
• Organizing workshops with FiServ (First Data) on Dispute Management and complaint handling
• Setup and maintenance of Open Point List (OPL) in Confluence
• Technologies/methods: Jira, Confluence, giro card, VISA Debit card, payments, Kanban board, BIN, routing, CIQ, VPAY, ScalaTest, Dispute Management

• Developing and approving authorization concepts
• Onboarding high privileged users (HPU) via CyberArk
• Onboarding non-personal accounts (NPA)

• Setup and monitoring of critical authorization combinations in the SAP BW environment
• Analysis and management of users with privileged access
• Quality control through regular review of authorization assignments and role structures
• Design and adaptation of SAP Fiori roles to meet specific requirements from the ticket system
• Implementation of efficient identity management processes