OT Security Experts in Germany

• Conceptual consulting for securing business processes
• Consulting for planning and implementing IT and IT security projects
• Security and policy checks, process optimization, contingency planning
• Project management and interim management in IT infrastructure and information security

Overview of relevant projects:

• 2025: Consulting on a DLP concept and for Digid GmbH.
• 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
• 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
• 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
• 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
• 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
• 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
• 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
• 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
• 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
• 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
• 2022: Development of a network segmentation concept for DZ Hyp AG.
• 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
• 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
• 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
• 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
• 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
• 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
• 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
• 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
• 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
• 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
• 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
• 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
• 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
• Recording and analysis of the current network architecture, including project initiation.
• Development of a concept for micro-segmentation in the data center and access network.
• 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
• Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
• 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
• 2020: Security architecture consulting for customer Datagroup SE.
• Development of a future IT infrastructure and IT security architecture.
• Analysis of the current IT architecture of all 23 companies.
• Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
• Preparation of a security zone concept.
• Preparation of an IT infrastructure architecture in coordination with all companies.
• 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
• Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
• Project area: Network Segmentation and Access Control.
• Project area: Security Architecture.
• Project area: Privileged, Identity & Access Management.
• Project area: Simplify User Authentication (MFA).
• Project area: Mobile & Endpoint Security.
• Project area: OT Security.
• Project area: E-enabled Aircraft.
• 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
• Project management for the development, evaluation and management of the company-wide information security architecture.
• Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
• Evaluation of security solutions, services and tools available on the market.
• Definition of requirements for RfPs and evaluation of offers.
• Development, maintenance and monitoring of security architecture artifacts.
• Conducting security assessments of existing and new IT systems and security services.
• 2018: ISMS consulting for customer GLS IT Services GmbH.
• Consulting on introducing and initially operating an ISMS based on ISO27001.
• Auditing the IT environments of the GLS country companies.
• Analysis and assessment of IT security risks and derivation of required measures.
• Development of proposed solutions in coordination with the relevant stakeholders.
• Project management and transition of the ISMS to later operations.
• 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
• Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
• 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
• Conducting various BIAs and GAP analyses.
• Preparation of security policies based on ISO 2700x.
• Assumption of the interim role of Information Security Officer.
• 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
• Review and update of the IT contingency manual.
• 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
• Analysis and optimization of the sell-build-run process.
• Preparation of detailed-level designs for cloud products.

• Innovation/pilot project eGesundheit Deutschland
• SaaS company in the media sector, NRW
• Secure software development lifecycle, NRW
• BSI IT-Grundschutz expert opinions for several clinics

• Planning, managing and implementing IT security projects with a focus on Palo Alto solutions (e.g. next-generation firewalls, Prisma Access, Cortex, SASE, Zero Trust)
• Coordinating interdisciplinary teams and resources across all project phases
• Managing project scope, schedule, budget and quality in line with customer objectives
• Active stakeholder management and ensuring transparency and communication
• Risk management: identifying, assessing and managing project-related risks
• Creating and maintaining project plans, budget overviews and reports
• Ensuring customer satisfaction through high-quality project and relationship management
• Applying established project management methods such as PMI, PRINCE2 or SCRUM for structured project implementation

• Built and successfully certified the Information Security Management System (ISMS) according to ISO 27001 in seven country organizations (Ghana, India, Bangladesh, Uzbekistan, Serbia, Kosovo, Albania).
• Full implementation of the ISMS from kick-off phase to certification, including defining the governance structure and process landscape.
• Developed and delivered target-group-specific trainings, workshops, and coaching sessions for local responsible persons on the basics of information security and ISMS operations.
• Designed and continuously improved training concepts and content to increase understanding and acceptance.
• Identified and implemented improvements in processes and tools, including risk management for international projects.
• Optimized central ISMS core processes from the idea through pilot operation and fine-tuning to global rollout.
• Optimized knowledge management, as well as work aids and methods for the global ISMS team.
• Built and moderated cross-functional coordination with key interfaces to the ISMS.
• Microsoft Teams, Excel, SharePoint Lists, Power Apps.

I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.

• Executed post-carve-out stabilization, system consolidation and cybersecurity uplift. Re-assessed system landscape and assets and designed new IT strategy for future. Implemented new IT operating model focusing on product-centric organization and re-internalization of critical resources.
• Successfully designed new IT operating model of the company, based on massive reduction of external dependencies, insourcing of key positions and upskilling of employees.
• Massive reduction of IT cost in the first three years (-40m$), bringing IT spend level below Gartner industry benchmark (1.27%).
• Introduced new product-centric organization based on fusion teams between business and IT across the company.
• Administered implementation of corporate-wide IT/OT cybersecurity program with more than 60 projects.
• Continuous improvement of enterprise IT/OT cybersecurity maturity level with significant increase in the first two years (CMMI >3.5, C2M2 >2.5).
• Governed successful implementation of the business transformation program within IT area by overachieving the savings target by $8m.
• Initiated and created new cloud-based data management platform based on best-in-class technology.
• Implemented first company-wide Microsoft Copilot AI program based on various business cases, leveraging GenAI and AgenticAI.

• Led SampleManager LIMS 21.x & LabWare LIMS v8 implementation, reducing manual lab errors by 40% and improving data traceability.
• Configured LW LIMS & SM LIMS 21.2: workflow design, role-based access control (RBAC), and master data management.
• Designed and configured LES workflows: sample lifecycle management, test assignments, approvals, and result review processes.
• Managed Master Menu and CI configuration, ensuring consistency, data integrity, and regulatory compliance.
• Integrated LIMS 21.2 with MES, ERP, EM, WinKQCL (Lonza MODA), SoftMax Pro, Empower, and Chromeleon CDS via REST APIs and web services.
• Implemented PAS-X MES: architecture design, multi-platform implementation (PAS-X, Siemens Opcenter), and integration with PLC, SCADA, and DCS systems.
• Executed IQ/OQ/PQ qualification protocols and Validation Summary Reports (VSR) for QC analytical and utility systems in aseptic and sterile production environments.
• Developed and reviewed Risk Assessments, Traceability Matrices, and Data Integrity evaluations in accordance with ALCOA+, 21 CFR Part 11, and EU Annex 11.
• Led EMA/FDA/WHO inspection readiness, standardized CQV SOPs, enabled digital CQV integration (LIMS/CDS/MES/SCADA/ERP/SDMS), and ensured 21 CFR Part 11 & Annex 11 compliance.
• Managed secure OT cybersecurity: network configuration and access control.
• Configured NuGenesis SDMS for document/data management, CDS/LIMS integration, workflow automation, and reporting.

• Industry: metal processing industry
• Revenue: 740 million EUR
• Employees: 4,400
• Budget: 7 million EUR, 15 staff
• Designing and operating technical services
• Ensuring IT security
• Managing the central support organization (first, second, and third level)
• Digital transformation: strategic support / project management for OT platform and OT security
• Developing and introducing ITIL processes (incident management, problem management, service request fulfillment, change management, access management, service level management)
• Supporting and coordinating external service providers (provider management)
• Project management: planning and delivering IT services for a new main plant
• Promoting IT-OT convergence / OT asset management / OT security
• Organization: mediating and supporting reorganization

Achievements:

• Improving IT operations maturity (introducing and stabilizing processes, KPIs, ensuring transition)
• Replacing the ticket system with ServiceNow
• Stabilizing and developing IT security / ensuring resilience
• Successfully introducing OT segmentation (architecture, remote access control, micro-segmentation, OT asset management)
• Supporting introduction of manufacturing execution system (technical services / SaaS provider management)
• Integrating foreign sites (rollout of central IT services)
• Migrating on-premises server environment to MS Azure
• Rolling out Windows 11
• Supporting migration of on-premises SAP environment to SAP RISE
• Creating planning basis for IT network infrastructure of the new main plant
• Planning web shop
• Organizational development "From Operating to Designing" (target SIAM organization)
• Supporting BCM

• Specialized in development and implementation of IT and OT security strategies
• Conducting risk analyses, vulnerability management and security assessments
• Administration of Microsoft Cloud and server solutions
• Establishment and maintenance of ISMS according to ISO 27001, NIS2, BSI and IEC 62443
• Planning and management of security projects in industrial and production environments
• Ensuring regulatory compliance with incident response, emergency management and awareness
• Collaboration with business units, management and external service providers
• Preparation of IT infrastructure for audits

• Conducted OT security assessments at European manufacturing facilities
• Analyzed and improved IT security processes and infrastructure
• Revised SOC processes in conjunction with the internal SOC team
• Conducted OT incident training and tabletop exercises
• Facilitated C-level workshops to align European OT security strategy
• Evaluated regulatory changes related to NIS2 and their relevance to the client