SASE Experts in Germany
matched in minutes with vetted, available freelancers and the power of AIHire experts who design zero-trust access, cloud-delivered network security and secure SD-WAN architectures, while integrating identity, endpoint and policy controls. Get fast, precise matching with vetted, available freelancers for your SASE initiative.
Meet FRATCH Experts in Germany, who have recently used SASE
Michael K.
Last position:
Senior Program Manager at Pronetz Consulting GmbH
Project management and process consulting in the field of Building Information Modelling (BIM)
Vicenco K.
Last position:
ITSM Project Manager (self-employed)
Unified ITSM framework
- Definition of a company-wide ITSM target picture
- Introduction of a uniform service structure across all business units
SLA and OLA management
- Building a standardized SLA framework
- Definition of service classes (Business Critical, Standard, Low Priority)
- Introduction of OLAs between internal teams
- Building meaningful SLA reporting
- Definition of KPI and service dashboards for business units
Service portfolio management
- Definition of service descriptions
- If needed, preparing possible cost and service billing
Ticketing & processes
- Incident management
- Uniform ticket categories
- Standardized prioritization
- Escalation matrix
- Automations
- Self-service optimization
Request fulfillment
- Service catalog across all business units
- Approval workflows
Problem management
- Introduction of root cause analysis
- Known error database
- Problem review process
Complete asset management concept
- Hardware lifecycle management
- Software lifecycle management
- Leasing lifecycle
- Mobile device lifecycle
- Monitor lifecycle
- Phone lifecycle
Processes
- Procurement
- Goods receipt
- Inventory
- Assignment
- Return
- Disposal
- Leasing return Goal: single source of truth for all assets
CMDB design
- Definition of all configuration items:
- Workplace
- Notebooks
- Monitors
- Mobile phones
- Printers
Infrastructure
- Servers
- Firewalls
- Switches
- WLAN
- Storage
- Backup systems
Cloud
- Azure resources
- Microsoft 365
- SaaS services
Relationships
- User ↔ Asset
- Asset ↔ Service
- Service ↔ Infrastructure
- Location ↔ Asset
- Goal: make all service dependencies visible
Software asset & license management
- License management concept
- License balancing
- Compliance reporting
- Microsoft license management
- Adobe license management
- SaaS management
- Contract management
- Renewal management
Interfaces & automation Existing systems
- Workday
- Joiner
- Mover
- Leaver
TESMA
- Leasing data
- Contract data
Matrix42
- Asset synchronization
- User synchronization
Active Directory / Entra ID
- User management
Microsoft 365
- License assignment
- Group management
Dormakaba
Access processes
Lifecycle services
Monitoring platforms
- PRTG
- Palo Alto
- Cisco
Reporting & KPI framework
- Definition of a management dashboard
- KPIs
- Ticket volume
- SLA fulfillment
- MTTR
- First resolution rate
- Asset accuracy
- License compliance
- Change success rate
- Service availability
- Degree of automation
Network redesign support
- Governance
- Support of the network redesign from an ITSM point of view
- Definition of affected services
- Change management structure
- Communication concept
CMDB integration
- Recording of all network components
- Service mapping
- Dependency analysis
Validation of documentation and knowledge base articles
- Network documentation
- Operations documentation
- Standard changes
Monitoring & event management
- Target picture
- Central monitoring concept
- Event management process
- Alerting strategy
- Escalation model
Systems
Cisco
Palo Alto
Fortinet
Rubrik
Veeam
Matrix42
Azure
Microsoft 365 Automation
Ticket creation from monitoring
Escalations
Standard actions
Audit, compliance & information security
- ISO 27001 consulting
- TISAX consulting
- NIS2 preparation - consulting
- Audit-ready processes
- Documentation structure
- Evidence tracking in Matrix42
Roadmap
- 12-month roadmap
- Prioritization of all measures
- Quick wins
- Medium-term projects
- Long-term target picture
- Documentation
Christian D.
Last position:
Managing Director and Senior Consultant at business-security (b-sec®) GmbH
- Conceptual consulting for securing business processes
- Consulting for planning and implementing IT and IT security projects
- Security and policy checks, process optimization, contingency planning
- Project management and interim management in IT infrastructure and information security
Overview of relevant projects:
- 2025: Consulting on a DLP concept and for Digid GmbH.
- 2025: Consulting for a customer after a cybersecurity attack in which the IT infrastructure was compromised and the attacker gained M365 tenant admin rights. Investigation and recovery of the IT infrastructure. Preparation of recommendations for increasing IT security.
- 2025: Continuation of the projects listed below for Thyssenkrupp Marine Systems and Norddeutsche Landesbank.
- 2024: Preparation of a DNS concept including consulting on DNS strategy and technology, DNS design, DNS security, load balancing, reverse lookup zones and automation. Preparation of a DHCP concept including consulting on DHCP design, the central DHCP management system and automation. Consulting on the operation of the products mentioned, operating processes, and adapting the IT documentation and IT service description for Thyssenkrupp Marine Systems.
- 2024: Analysis and assessment of the network and security infrastructure established by the providers with regard to the overall architecture, consisting of the design and components. Development of proposed solutions to improve current operations, maximize performance and security, and reduce complexity. Presentation of the results, their causes and possible solutions to C-level management, including the required decision templates. Development of a SASE concept based on a Zero Trust architecture for Norddeutsche Landesbank.
- 2024: Continuation of the projects listed below for Atlas GmbH and Deutsche Vermögensberatung AG.
- 2023: Consulting on resolving findings from an IT security assessment of the IT infrastructure, conducting proof-of-concepts for DDoS protection and Digital Experience Monitoring (DEM) with Zscaler (ZIA, ZPA & ZDX), creating a new security architecture based on Zero Trust, redesigning a Cisco ISE implementation and designing a DNS security solution to protect guests and financial advisors for Atlas GmbH / Deutsche Vermögensberatung AG.
- 2023: Continuation of the projects listed below for Digid GmbH, Vaillant Group GmbH (until 09/2023), Bundesanstalt für Geowissenschaften und Rohstoffe (until 05/2023) and Union Investment IT-Services GmbH (until 07/2023).
- 2022: Preparation and review of white papers for infrastructure and security architectures, planning new network infrastructures for Deutsches Luft- und Raumfahrtzentrum.
- 2022: Development of a concept for the technical and process-related modernization of a disaster recovery plan for United Nations Volunteers.
- 2022: Development of a concept for moving measurement data to a cloud environment, introducing Network Access Control and conducting an awareness training session for Digid GmbH.
- 2022: Development of a network segmentation concept for DZ Hyp AG.
- 2022: Development of a network segmentation concept for Bundesagentur für Arbeit.
- 2021: Development of a new load balancer architecture for Bundeswehr Fuhrparkservices GmbH.
- 2021: Vulnerability scan and penetration test of a web frontend, including evaluation and preparation of recommendations for remediation, taking risk and probability of occurrence into account, for customer ifi GmbH.
- 2021: Consulting, concept development and sub-project management for introducing a Network Access Control solution (certificate authentication and MAC address bypass) and macro-segmentation (area and zone concept based on dynamic assignment of endpoints) in office and production IT for customer Vaillant Group GmbH.
- 2021: Upgrade and optimization of the LAN and WLAN infrastructure for customer United Nations Volunteers.
- 2021: Development of a target concept for modernizing the IT security infrastructure consisting of the DMZ (Cisco switches, firewalls, WSA, ESA, SMA), internet access, admin and management networks and wireless LAN, including support during implementation, for Bundesanstalt für Geowissenschaften und Rohstoffe.
- 2021: Creation of a micro-segmentation concept based on Cisco DNA and SGT and Zero Trust for Union Investment IT-Services GmbH.
- 2021: Review and update of ISMS Level-3 policies and preparation of process instructions for customer Software AG.
- 2021: Project management for the global Tec-Refresh project Meraki WLAN 2.0, coordination of outsourcing the LAN/WLAN infrastructure to a managed service provider and preparation of a WLAN concept for automated guided vehicles for customer Heraeus Infosystems GmbH.
- 2021: Project management and technical support for the “Transition of SIEM/SOC Services” project of a customer into a shared environment and assumption of the interim role of Head of Security Operations at customer Datagroup SE.
- 2021: Workshop for a future implementation of Mobile Device Management at customer Allgeier Experts Go GmbH.
- 2021: Sub-project management for introducing a rule management tool for firewalls and recertifying NAC endpoints based on 802.1x and MAB at customer Union Investment IT-Services GmbH.
- 2020: Development of a network segmentation concept for two data centers based on Cisco and VMware for Aareon AG.
- Recording and analysis of the current network architecture, including project initiation.
- Development of a concept for micro-segmentation in the data center and access network.
- 2020: Infrastructure and security architecture audit for customer Stuttgarter Versicherung AG.
- Analysis of the IT infrastructure and IT security architecture with regard to the configuration of network and security components. Additional review of contracts, process descriptions and manuals for completeness. Development of recommendations to improve the stability and operation of the infrastructure. Preparation of a network segmentation concept and project management for implementing the measures from the analysis project.
- 2020: Consulting on setting up an ISMS-Light for customer Josera foodforplanet GmbH & Co. KG.
- 2020: Security architecture consulting for customer Datagroup SE.
- Development of a future IT infrastructure and IT security architecture.
- Analysis of the current IT architecture of all 23 companies.
- Recommendations for optimizing the IT infrastructure and preparation of a comparison between a classic perimeter security concept and the Zero Trust model.
- Preparation of a security zone concept.
- Preparation of an IT infrastructure architecture in coordination with all companies.
- 2018 - 2019: Stream Lead in the Cyber Security program of Deutsche Lufthansa AG.
- Responsible for designing and implementing 9 projects in IT security infrastructure and user access management, as well as managing project managers and experts.
- Project area: Network Segmentation and Access Control.
- Project area: Security Architecture.
- Project area: Privileged, Identity & Access Management.
- Project area: Simplify User Authentication (MFA).
- Project area: Mobile & Endpoint Security.
- Project area: OT Security.
- Project area: E-enabled Aircraft.
- 2018: Security architecture consulting for customer Deutsche Lufthansa AG.
- Project management for the development, evaluation and management of the company-wide information security architecture.
- Development of a security strategy and roadmap to align the security architecture with the Zero Trust model.
- Evaluation of security solutions, services and tools available on the market.
- Definition of requirements for RfPs and evaluation of offers.
- Development, maintenance and monitoring of security architecture artifacts.
- Conducting security assessments of existing and new IT systems and security services.
- 2018: ISMS consulting for customer GLS IT Services GmbH.
- Consulting on introducing and initially operating an ISMS based on ISO27001.
- Auditing the IT environments of the GLS country companies.
- Analysis and assessment of IT security risks and derivation of required measures.
- Development of proposed solutions in coordination with the relevant stakeholders.
- Project management and transition of the ISMS to later operations.
- 2016 - 2018: Security Pre-Sales Consultant for customer Cisco Systems GmbH.
- Nationwide strategic and conceptual consulting for major enterprise customers and financial and insurance customers on Cisco and Meraki security products and services such as Firepower, WSA, ESA, Stealthwatch and ISE.
- 2017 - 2018: Design and implementation of an ISMS for customer Verivox GmbH.
- Conducting various BIAs and GAP analyses.
- Preparation of security policies based on ISO 2700x.
- Assumption of the interim role of Information Security Officer.
- 2017: Preparation of a contingency concept for VPV Lebensversicherungs-AG.
- Review and update of the IT contingency manual.
- 2016: Consulting and project management for the design of cloud and hosting services for customer Vodafone Group Services GmbH.
- Analysis and optimization of the sell-build-run process.
- Preparation of detailed-level designs for cloud products.
Volker L.
Last position:
Project Manager at Schaeffler
Schaeffler: SASE Harmonization (SD-WAN/Zscaler Client Rollout)
- Overall project planning (including planning, preparation, and execution of the migrations)
- Project Management Office (PMO) – preparing status reports, monitoring progress with dashboards, preparing and conducting steering boards
- Coordination with the regions and departments to prepare the migrations
- Coordinating the execution of the migrations (cut-over)
- Coordination with the managed service provider for SD-WAN
Ulf H.
Last position:
Configuration Manager (Interim) at In-house Development
- Requirements analysis and replacement of local SharePoint as CMDB with open source NetBox to prepare for deploying Cisco ACI (SD-WAN) with Microsoft Azure
- Coordination with systems like Checkmk and Grasp
- Introduction and coordination of cmdbsyncer as CMDB data hub; further development of the syncer with Kuhn & Ruess GmbH
- Implementation of SNMPv3 on AIX LPAR/VIO, Linux, Windows, SAN/storage, network components (Cisco switches, F5 load balancers, Palo Alto and CheckPoint firewalls, iLO boards)
- Deployment and further development of the network scanner JDisc in cooperation with the vendor (Utimaco HSMs, Linux detection)
- Integration of NetBox, JDisc, and cmdbsyncer into the infrastructure using Docker containers
- End-user training: preparation, creation of materials, and delivery
- Creation of data flow and network diagrams
- Population and planning of IPv4/IPv6 with NetBox including VLAN import
- Dual-stack setup of servers and clients with IPv4 and IPv6
- Connection of REST interfaces for Checkmk, JDisc, vSphere, HMC, i-doit, NetBox Software: Confluence, Jira, MS Office 365, Teams, i-doit, NetBox, JDisc, cmdbsyncer, DB Visualizer, vSphere, HMC
Sascha P.
Last position:
Security Engineer at Kyndryl
- Operation and further development of a SASE infrastructure based on Netskope
Vladimir M.
Last position:
IT & Cybersecurity Project Manager at Technology company / IT security solutions
- Planning, managing and implementing IT security projects with a focus on Palo Alto solutions (e.g. next-generation firewalls, Prisma Access, Cortex, SASE, Zero Trust)
- Coordinating interdisciplinary teams and resources across all project phases
- Managing project scope, schedule, budget and quality in line with customer objectives
- Active stakeholder management and ensuring transparency and communication
- Risk management: identifying, assessing and managing project-related risks
- Creating and maintaining project plans, budget overviews and reports
- Ensuring customer satisfaction through high-quality project and relationship management
- Applying established project management methods such as PMI, PRINCE2 or SCRUM for structured project implementation
Enrique G.
Last position:
Security Architect at Capgemini
I implemented a Zero-Trust architecture for robust, military-grade maritime container mini data centers based on VMware & Tanzu to support containerized GIS workloads for ground forces. The main focus was on securing communications, workload protection, and data access in contested electronic battle environments affected by jamming, interception, signal manipulation, and constantly changing operational conditions. I designed and architected use cases so that every element of workload, identity, and system could continue to operate independently and securely even in degraded or disrupted scenarios. In parallel, I defined the enterprise and solution security architecture with LeanIX, Bizzdesign, and HOPEX as enterprise architecture, repository, and governance platforms to maintain architecture inventory, relationships, traceability, target pictures, and security governance in complex environments. For the architectural designs, I used Sparx Enterprise Architect to describe formal architecture views, interfaces, trust boundaries, and system architecture in both IT and OT environments. IriusRisk was used for threat modeling of the solution to identify architecture-driven risks, derive security requirements, and detect countermeasures and design gaps directly from the solution models. Risk and compliance management was supported with Archer. Architecture decisions, control gaps, and operational risks were translated into controlled governance and auditable compliance measures. For documentation, collaboration, and visual design, I used Confluence to maintain Architecture Decision Records, Security Blueprints, and workflows. I used Lucidchart and draw.io to create design artifacts tailored to stakeholders. I also defined OT security concepts with support from electrical and mechanical engineers in the areas of oil, vehicle onboard systems, rail, power plants, pharma, gas turbines, and nuclear technology. I created the end-to-end OT security strategy, starting with global policy, developed into standards and procedures, and finally aligned with Bell-LaPadula, Purdue Model, SABSA, TOGAF ADM, CENELEC 50701, IEC 62443, and NIST standards. In addition, I worked with engineering team leads to identify critical KBP assets and place them under protective measures that segmented SCADA, PLC, and HMI assets. I drove collaboration between Security, IT, and OT teams to create standardized workflows and use cases for the OT security solution catalog, while integrating Defense-in-Depth and Zero-Trust principles into operational environments. A key part of my work was integrating multidisciplinary engineering, security, and operations stakeholders into a unified security blueprinting strategy and ensuring that architecture, threat modeling, governance, and documentation were technically strong and operationally practical.
Discover over 15,000 top freelancers
Statistics of experts using SASE
Aggregated from the professional profiles of matched freelancers.
Experience
25 years
Position duration
2.4 years
Positions per freelancer
13
Top business areas
Information Technology, Project Management, Customer Service
Top industries
Information Technology, Professional Services, Telecommunication
Certification focus areas
Information Technology, Business Intelligence, Project Management
Bachelor's degree or higher
67%
Master's degree or higher
50%
Certifications per freelancer
13
Most common languages
German, English, French
Speak two or more languages
100%
Based on our profile pool as of 29 Oct 2026.
Daily rate distribution
The chart shows how the daily rates of experts in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows the share of experts charging within that range.
Average rates of experts in Germany using SASE
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 29 Oct 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
SASE experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (88%)
- Professional Services (63%)
- Telecommunication (63%)
- Automotive (50%)
- Banking and Finance (50%)
- Manufacturing (50%)
- Aerospace and Defense (38%)
- Healthcare (38%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
What SASE covers
SASE, or Secure Access Service Edge, combines wide-area networking with cloud-delivered security. Instead of routing every user and branch through a central data centre, it applies identity-aware controls close to the user, device, application or workload. Typical capabilities include secure web gateways, zero-trust network access, cloud access security brokers, firewall as a service and secure SD-WAN.
Where it is used
SASE supports distributed workforces, branch connectivity, SaaS adoption and hybrid cloud access. It helps companies replace fragmented remote-access tools with consistent policies across locations and devices.
- Connect offices, remote users and cloud workloads
- Control access to private applications without broad network exposure
- Inspect web and SaaS traffic under central policy
- Segment users, devices and workloads by risk and identity
Ecosystem and tooling
SASE programmes span networking, security and operations. Specialists work with secure SD-WAN, identity providers, endpoint management, DNS security, web filtering, DLP, SIEM and API integrations. Vendor ecosystems may include platforms from Palo Alto Networks, Zscaler, Netskope, Cisco or Fortinet, but the right design depends on existing systems and policy needs.
When companies need support
Freelance expertise is useful when a company is defining its target architecture, selecting a vendor or replacing legacy VPN and perimeter controls. It also helps during migrations, policy redesigns, acquisitions and rollouts across offices or remote teams in Germany. Strong planning must cover traffic flows, identity lifecycle, device posture, logging, resilience and operational ownership.
- Assess the current network and security estate
- Build a phased SASE migration plan
- Configure policies, connectors and monitoring
- Test user access, application reachability and failover
Skills that matter
Good professionals understand both network behaviour and security policy. They can map business applications, classify data, define least-privilege access and troubleshoot latency across internet, cloud and branch links. Experience with automation, infrastructure as code, incident response and compliance documentation adds practical value. Clear communication matters when security, infrastructure and business teams must agree on exceptions.
Choosing the right specialist
Look for evidence of completed SASE or Secure Access Service Edge transitions, not only familiarity with a vendor interface. Ask how the professional handled identity integration, legacy applications, certificate management, endpoint posture and rollback planning. For remote collaboration, shared diagrams, decision logs and regular workshops keep work moving; on-site sessions can help when branches, appliances or local teams need direct assessment. German and English communication may both be relevant for teams operating across Germany and international locations.
Frequently asked questions
Curious about SASE? Here are the answers that come up again and again.
Companies use SASE to secure access for remote users, branches, SaaS services and cloud workloads through consistent, identity-aware policies. It brings networking and security functions into a cloud-delivered model instead of relying only on a central perimeter.
Secure Access Service Edge can apply access decisions based on identity, device posture, application and context, rather than granting broad network access after login. A traditional VPN and firewall can still be appropriate, but they often require more central routing and separate controls for web, cloud and private-application access.
SASE includes security service edge capabilities alongside networking functions such as SD-WAN. SSE, or Security Service Edge, generally refers to the security part alone, so a company can adopt SSE without replacing its wide-area network architecture.
A strong SASE specialist usually combines network design with zero-trust principles, identity and access management, endpoint security, cloud networking and security operations. Knowledge of SIEM integration, DLP, DNS security, automation and vendor-specific policy models is also useful.
The required depth depends on the scope, from a focused policy review to a company-wide migration. For a complex programme, look for a professional who has handled discovery, pilot design, legacy application access, phased rollout, monitoring and operational handover rather than only product configuration.
SASE work is often suitable for remote collaboration because architecture, policy design and cloud configuration can be reviewed through shared documentation and controlled access. On-site work can still help with branch assessments, appliance changes, workshops or teams that need direct support; German or English may be expected depending on the organisation.
Secure Access Service Edge projects may involve Palo Alto Networks, Zscaler, Netskope, Cisco or Fortinet, among others. Vendor choice should follow the company’s identity stack, endpoint controls, cloud environment, network requirements and operating model rather than brand familiarity alone.
Ask the SASE professional to explain policy design, identity integration, device trust, traffic steering, logging and failure handling in concrete terms. Review architecture decisions, migration safeguards and documentation from comparable work, and test whether they can explain complex security trade-offs clearly to technical and non-technical stakeholders.
The average hourly rate of freelancers in Germany who have used SASE in their recent projects is 105 €, which corresponds to a daily rate of about 836 € based on an 8-hour working day.
Of the freelancers in Germany who have used SASE in their recent projects, 67% hold at least a Bachelor's degree and 50% hold at least a Master's degree.
On average, freelancers in Germany who have used SASE in their recent projects have 25 years of professional experience, with a single engagement typically lasting around 2.4 years.
The most common languages among freelancers in Germany who have used SASE in their recent projects are German (100%), English (100%), and French (50%).
The most common industries among freelancers in Germany who have used SASE in their recent projects are Information Technology (88%), Professional Services (63%), and Telecommunication (63%).
The most common business areas among freelancers in Germany who have used SASE in their recent projects are Information Technology (100%), Project Management (100%), and Customer Service (75%).
Main locations of FRATCH Experts, who have recently used SASE
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
