OT Security Experts in Germany

Consulting and support in the areas of sales/business/technology/development/marketing:

• Sales, Key Account Management
• Business Development, business/corporate development
• Partner management
• Program/project management
• Product management & marketing
• Technical marketing, content marketing
• New business, innovation and technologies

Until July 2021 active as advisor and consultant for Mixed Mode in the areas of Key Account Management, Project Management and Business Development.

From Q3/2021 successful delivery of various customer projects in the area of Business Development, corporate development, consulting, coaching, technical content management, sales and marketing:

• EMS service provider and PCB test house, inspection systems: revision of company portfolio and presentation. Integration of specialized distribution for optical inspection systems from Japan: content management, marketing, communication, web, sales automation, lead generation
• Full service marketing agency – technology marketing for industry: expansion of the existing B2B and B2C marketing portfolio with industrial and technology topics: content management, presentation and focus on "technical marketing", web, target market and customer analysis, lead automation, consulting
• Software product manufacturer & software development in the field of security for Embedded & IoT: company alignment and portfolio definition for an IoT and Embedded Security company with a SaaS solution for IoT device management: building a partner network to offer complete Embedded/IoT security solutions, technical content, company alignment and portfolio definition, strategy & planning, target market and customer analysis, product marketing/USPs for the security device management tool "IoT-Suite", standards and regulations for cyber resilience (e.g. CRA, NIS2, RED), web content, SEO, management of marketing and sales agencies, CRM, sales, presentations, trade fairs, congresses, building company webinars & events
• Software engineering service provider/system house for IoT, Embedded, web, mobile and desktop applications: business development, content creation, customer acquisition and sales
• Manufacturer of memory products with security features as an add-on: memory products in standard form factors (SD, CF, SSD...) are extended with security modules such as HSM, TPM or secure elements and thus offer users secure data storage, transfer and access. Also interesting as an upgrade or retrofit solution to meet the coming new regulations and requirements regarding cybersecurity such as CRA, RED and NIS2. Business & New Business Development for the area "Embedded IoT Solutions & Security", sales & marketing. Expansion of the pure semiconductor business to include security solutions and services. Interface between management, marketing, sales and product management. Building business partners, technology partners, system integrators and resellers from the Embedded, IoT, OT and IT environment. Creating reference designs/demos/lighthouse cases and proof of concepts for cross- and reference selling. Co-marketing with security partners. Technical content creation for web, sales and marketing, webinars, social media etc. Networking, participation in trade fairs, congresses and events. Lead generation, qualification, follow-up and conversion to customer. Product definition, USPs, features. Analysis of competitors, market positioning, target markets - strategy, concept and measures - go to market.
• Marketing agency group with sales and management consulting: consulting for companies on restructuring, market analysis and market entry, go-to-market concepts, customer acquisition and expansion, new customer generation, lead generation and management, concepts and execution of campaigns (web, mail, social media, phone outreach in person or with AI voice assistant, webinars...). Processing and managing customer product data for PIM product information and DAM data asset management systems. Focus on customers in the industrial and technology environment with products and services that need explanation.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Built and successfully certified the Information Security Management System (ISMS) according to ISO 27001 in seven country organizations (Ghana, India, Bangladesh, Uzbekistan, Serbia, Kosovo, Albania).
• Full implementation of the ISMS from kick-off phase to certification, including defining the governance structure and process landscape.
• Developed and delivered target-group-specific trainings, workshops, and coaching sessions for local responsible persons on the basics of information security and ISMS operations.
• Designed and continuously improved training concepts and content to increase understanding and acceptance.
• Identified and implemented improvements in processes and tools, including risk management for international projects.
• Optimized central ISMS core processes from the idea through pilot operation and fine-tuning to global rollout.
• Optimized knowledge management, as well as work aids and methods for the global ISMS team.
• Built and moderated cross-functional coordination with key interfaces to the ISMS.
• Microsoft Teams, Excel, SharePoint Lists, Power Apps.

• Planning, directing, and implementing IT security projects focused on Palo Alto solutions (e.g., Next-Gen Firewalls, Prisma Access, Cortex, SASE, Zero Trust)
• Coordinating interdisciplinary teams and resources throughout all project phases
• Managing project scope, schedule, budget, and quality according to client goals
• Active stakeholder management and ensuring transparency and communication
• Risk management: identifying, assessing, and controlling project-related risks
• Creating and maintaining project plans, budget overviews, and reports
• Ensuring customer satisfaction through high-quality project and relationship management
• Applying established project management methods such as PMI, PRINCE2, or SCRUM for structured project execution

• Conceptual consulting for securing business processes
• Consulting on planning and implementation of IT and IT security projects
• Security and policy checks, process optimizations, emergency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept for Digid GmbH.
• 2025: Consulting a client after a cybersecurity attack that compromised the IT infrastructure and where the attacker obtained M365 tenant admin rights. Investigated the IT infrastructure and restored it. Developed recommendations to improve IT security.
• 2025: Continued the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Created a DNS concept including advice on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones, and automation. Created a DHCP concept including advice on DHCP design, a central DHCP management system and automation. Advised on operating the mentioned products, the operational processes, and updated IT documentation and IT service descriptions for Thyssenkrupp Marine Systems.
• 2024: As-is analysis and assessment of the network and security infrastructure established by providers in terms of overall architecture including design and components. Designed solution proposals to improve current operations for performance and security maximization as well as complexity reduction. Presented the results to C-level, their causes and possible solutions including required decision templates. Developed a SASE concept based on a zero-trust architecture for Norddeutsche Landesbank.
• 2024: Continued the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proofs of concept for DDoS protection and digital experience monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on zero trust, redesigning a Cisco ISE implementation, and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continued the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Federal Institute for Geosciences and Natural Resources (until 05/2023), and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Created and reviewed whitepapers for infrastructure and security architectures, and planned new network infrastructures for the German Aerospace Center.
• 2022: Developed a concept for the technical and procedural modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Developed a concept for migrating measurement data to a cloud environment, introduced network access control, and conducted an awareness training for Digid GmbH.
• 2022: Developed a network segmentation concept for DZ Hyp AG.
• 2022: Developed a network segmentation concept for the Federal Employment Agency.
• 2021: Developed a new load balancer architecture concept for Bundeswehr Fuhrparkservices GmbH.
• 2021: Conducted a vulnerability scan and penetration test of a web frontend including analysis and recommendations for remediation considering risk and likelihood for the client ifi GmbH.
• 2021: Consulting, design, and subproject management for implementing a network access control solution (certificate authentication and MAC address bypass) and macro segmentation (area and zone concept based on dynamic device assignment) in office and production IT for Vaillant Group GmbH.
• 2021: Upgraded and optimized LAN and WLAN infrastructure for United Nations Volunteers.
• 2021: Developed a target concept for modernizing the IT security infrastructure including the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet connections, admin and management networks, and the wireless LAN, including overseeing implementation for the Federal Institute for Geosciences and Natural Resources.
• 2021: Created a micro-segmentation concept based on Cisco DNA, SGT, and zero trust for Union Investment IT-Services GmbH.
• 2021: Reviewed and updated ISMS level 3 policies and created procedure instructions for Software AG.
• 2021: Project lead for the global tech refresh project Meraki WLAN 2.0, coordinated the outsourcing of LAN/WLAN infrastructure to a managed service provider, and created a WLAN concept for automated guided vehicles for Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the 'Transition of SIEM/SOC Services' project migrating a client to a shared environment, and took on the interim role of Head of Security Operations at Datagroup SE.
• 2021: Conducted a workshop for the future implementation of mobile device management for Allgeier Experts Go GmbH.
• 2021: Subproject management for implementing a firewall rule management tool and recertifying NAC endpoints based on 802.1x and MAB for Union Investment IT-Services GmbH.
• 2020: Developed a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recorded and analyzed the current network architecture including project initiation.
• Designed a micro-segmentation concept in the data center and access network.
• 2020: Infrastructure and security architecture audit for Stuttgarter Versicherung AG.
• Analyzed the IT infrastructure and security architecture regarding network and security component configurations. Also reviewed contracts, process documents, and manuals for completeness. Developed recommendations to improve the stability and operation of the infrastructure. Created a network segmentation concept and led the project to implement the measures from the audit.
• 2020: Consulting on setting up an ISMS-light for Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for Datagroup SE.
• Developed a future IT infrastructure and IT security architecture.
• Documented the current IT architecture of all 23 entities.
• Made recommendations to optimize the IT infrastructure and drafted a comparison of a traditional perimeter security concept versus a zero trust model.
• Created a security zone concept.
• Designed an IT infrastructure architecture in coordination with all entities.
• 2018 - 2019: Stream lead in the cybersecurity program at Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network segmentation and access control.
• Project area: Security architecture.
• Project area: Privileged, identity & access management.
• Project area: Simplify user authentication (MFA).
• Project area: Mobile & endpoint security.
• Project area: OT security.
• Project area: E-enabled aircraft.
• 2018: Security architecture consulting for Deutsche Lufthansa AG.
• Project management for the development, evaluation, and management of the company-wide information security architecture.
• Developed a security strategy and a roadmap to align the security architecture with the zero trust model.
• Evaluated market security solutions, services, and tools.
• Defined requirements for RFPs and assessed proposals.
• Developed, maintained, and monitored security architecture artifacts.
• Conducted security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for GLS IT Services GmbH.
• Advised on implementing and initially operating an ISMS based on ISO27001.
• Audited the IT environments of GLS country subsidiaries.
• Analyzed and assessed IT security risks and derived necessary measures.
• Developed solution proposals in coordination with relevant stakeholders.
• Managed the project and handed over the ISMS to operations.
• 2016 - 2018: Security pre-sales consultant for Cisco Systems GmbH.
• Provided nationwide strategic and conceptual consulting to major enterprise and financial and insurance clients on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch, and ISE.
• 2017 - 2018: Designed and implemented an ISMS for Verivox GmbH.
• Conducted various BIAs and gap analyses.
• Developed security policies based on ISO 2700x.
• Served as interim information security officer.
• 2017: Developed an emergency concept for VPV Lebensversicherungs-AG.
• Reviewed and updated the IT emergency manual.
• 2016: Consulting and project management for designing cloud & hosting services for Vodafone Group Services GmbH.
• Analyzed and optimized the sell-build-run process.
• Created detailed level designs for cloud products.

• Industry: metal processing industry
• Revenue: 740 million EUR
• Employees: 4,400
• Budget: 7 million EUR, 15 staff
• Designing and operating technical services
• Ensuring IT security
• Managing the central support organization (first, second, and third level)
• Digital transformation: strategic support / project management for OT platform and OT security
• Developing and introducing ITIL processes (incident management, problem management, service request fulfillment, change management, access management, service level management)
• Supporting and coordinating external service providers (provider management)
• Project management: planning and delivering IT services for a new main plant
• Promoting IT-OT convergence / OT asset management / OT security
• Organization: mediating and supporting reorganization

Achievements:

• Improving IT operations maturity (introducing and stabilizing processes, KPIs, ensuring transition)
• Replacing the ticket system with ServiceNow
• Stabilizing and developing IT security / ensuring resilience
• Successfully introducing OT segmentation (architecture, remote access control, micro-segmentation, OT asset management)
• Supporting introduction of manufacturing execution system (technical services / SaaS provider management)
• Integrating foreign sites (rollout of central IT services)
• Migrating on-premises server environment to MS Azure
• Rolling out Windows 11
• Supporting migration of on-premises SAP environment to SAP RISE
• Creating planning basis for IT network infrastructure of the new main plant
• Planning web shop
• Organizational development "From Operating to Designing" (target SIAM organization)
• Supporting BCM

• Specialized in development and implementation of IT and OT security strategies
• Conducting risk analyses, vulnerability management and security assessments
• Administration of Microsoft Cloud and server solutions
• Establishment and maintenance of ISMS according to ISO 27001, NIS2, BSI and IEC 62443
• Planning and management of security projects in industrial and production environments
• Ensuring regulatory compliance with incident response, emergency management and awareness
• Collaboration with business units, management and external service providers
• Preparation of IT infrastructure for audits

• Conducted OT security assessments at European manufacturing facilities
• Analyzed and improved IT security processes and infrastructure
• Revised SOC processes in conjunction with the internal SOC team
• Conducted OT incident training and tabletop exercises
• Facilitated C-level workshops to align European OT security strategy
• Evaluated regulatory changes related to NIS2 and their relevance to the client

• Operation manager, plant and project manager
• Project and change management
• Restructuring & crisis management
• Process optimization
• Establishment of shopfloor management
• Implementation of lean management
• Technology integration and automation

• Enhanced quality assurance of documents, processes and required evidence in preparation for the upcoming KRITIS audit 2025.
• Reviewing and commenting on all relevant documents.
• Advising authors and document owners on inquiries and during the creation process.
• Supporting departments with IT security inquiries.
• Used tools/Frameworks MS Office, SharePoint, Jira, Confluence, ISO27001+, NIS-2 (EU 2022/2555), B3S (Statutory Health & Private Health Insurance), BSIG / IT-SIG 2.0, BSI-KritisV, BSI-C5, BSI Baseline Protection (200-2, 200-4), ServiceNow, RCE (EU 2022/2557), SGB, GDPR