Security Awareness Training Experts in Germany

• Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.

• Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.

• Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.

• Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.

• Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.

• Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.

• Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.

• Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.

• Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.

• Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.

• Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.

• Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.

• Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.

• Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.

• Result: >99.5% uptime over 20+ years and zero compromises.

• Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.

• Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.

• Privacy by Design and by Default
• Working with OneTrust: creating and managing records for requesters
• Interface role: mediation and communication between the DPO and the specialist departments, including clarifying data protection questions
• Handling data protection incidents: analysis, documentation, and coordination of measures
• General advice on data protection topics: support with data protection-related questions
• Process optimization: identifying room for improvement in processes and implementing changes
• Documentation & reporting: creating reports on data protection incidents or general data protection topics for the DPO and weekly reports for the line manager for presentation in the performance board
• Risk assessment & compliance: support in assessing data protection risks in new projects or processes
• Distribution and independent handling of email requests or requests from the DPO: all incoming tickets are divided among team members, with no specialization in the tasks. Tickets are created and tracked in Jira.

Approach/Methods:

• Stakeholder management
• Communication at C-level
• Timeline and implementation plan

Self-employed consulting, implementation, and support of IT infrastructures with a focus on IT security, network and server administration, virtualization, backup & recovery, IT documentation, asset management, and business continuity management.

• IT security consulting and implementation of technical protective measures
• Windows server and client support, patch management, user support
• M365 – Entra ID – MS Azure administration
• Planning, installation, and operation of LAN, WAN, WLAN, and VLAN infrastructures, Cisco, HP, Netgear, Sophos, Securepoint
• Support of virtual systems based on Hyper-V, VMware, and Proxmox
• Backup and recovery concepts including test recovery, documentation, and handover
• Introduction and maintenance of IT documentation, asset management, and inventory tracking
• Implementation of measures related to IT baseline protection, emergency manuals, and BCM
• On-/offboarding concepts with a focus on permissions, devices, data access, and handover processes

Security awareness and practical sensitization of users and IT staff

• Creating guidelines
• Conducting Business Impact Analyses (BIA), assessing risks, and identifying time-critical business processes
• Process management
• Creating emergency plans and crisis management plans, including cyber response and IT emergency plans with special consideration of a cyberattack
• Conducting awareness trainings
• Planning and carrying out tests and exercises
• Developing tailor-made solutions to reduce risks and ensure business continuity

• New development of project room functions
• Connection of REST API of a self-developed web service (.NET 7/8) as Azure App Service
• UI tests with Playwright
• Extension of Azure DevOps pipelines
• Migration to Azure SQL Server
• Software / technology: SharePoint Online, PowerShell scripts, SharePoint Framework, MobX, C#, Logic Apps, Playwright, Azure SQL Server, Graph API

• Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
• Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
• Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
• Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
• Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
• Implement continuous monitoring solutions to detect and respond to threats in real time.
• Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
• Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
• Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
• Collaborate with project teams to address findings and ensure that security risks are managed effectively.
• Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
• Facilitate a culture of security awareness throughout the organization through training and regular communication.
• Lead security initiatives that align with the organization’s long-term strategic goals.
• Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
• Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.

• Executed post-carve-out stabilization, system consolidation and cybersecurity uplift. Re-assessed system landscape and assets and designed new IT strategy for future. Implemented new IT operating model focusing on product-centric organization and re-internalization of critical resources.
• Successfully designed new IT operating model of the company, based on massive reduction of external dependencies, insourcing of key positions and upskilling of employees.
• Massive reduction of IT cost in the first three years (-40m$), bringing IT spend level below Gartner industry benchmark (1.27%).
• Introduced new product-centric organization based on fusion teams between business and IT across the company.
• Administered implementation of corporate-wide IT/OT cybersecurity program with more than 60 projects.
• Continuous improvement of enterprise IT/OT cybersecurity maturity level with significant increase in the first two years (CMMI >3.5, C2M2 >2.5).
• Governed successful implementation of the business transformation program within IT area by overachieving the savings target by $8m.
• Initiated and created new cloud-based data management platform based on best-in-class technology.
• Implemented first company-wide Microsoft Copilot AI program based on various business cases, leveraging GenAI and AgenticAI.

• Redesigning cablewise infrastructure with CAT 8.1 keystones, measuring the speed and quality of the new installation with Pockethernet, documentation at a local saddlery
• CAT 8.1 installation and building a data center, site linking, VPN and VLAN configuration for a local car dealership, implementation of IT-Security standards like virus protection (G Data) and firewalling (OPNSense)
• Relocation of a tax office with redesign of the IT infrastructure, virus protection (G Data) and backup solutions (QNAP)
• Planning, conception and implementation of an inhouse data center, BSI-compliant for commercial laundry (including Proxmox-based virtualization of existing infrastructures, QNAP, G Data, OPNSense, APC)
• Implementation and conception of security solutions in the SME sector
• Collaboration on the IT-security concept for the Bremen network of authorities (in the dLAN network)
• Creation of IT-security concept VOIS (modules MESO, KFZ/iKFZ) including audit preparation for KBA
• Expansion of the IT-security concept for the online service for electronic residence registration (eWA) to include use as an eFA (one-for-all) service (nationwide)
• Expansion of the IT-security concept to include modules wos & wvp
• Concept development for the implementation of DIN SPEC 27076 at MSEs and SMEs
• Creation and evaluation of emergency concepts
• Creation and evaluation of response actions and BCM plans
• Assessment of existing business continuity management (ISO 22301)
• Development of BCM strategy options
• Conducting awareness training

• Development of comprehensive services in cybersecurity, IT governance, and AI
• Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
• Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
• Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
• Responsible for company growth, client relations, and strategic partnerships

• Enterprise and IT strategy
• Digital transformation
• Process and portfolio management
• Interim IT management

• Improvement of the Information Security Management System (ISMS) based on ISO 27001, NIS2, DORA, B3S, TISAX and BSI IT Baseline Protection
• Conducting comprehensive gap analyses to identify gaps and derive action plans according to the above standards and regulations; management and KPIs
• Data Loss Prevention strategy and implementation using MS Purview
• Vulnerability and patch management, security monitoring
• Risk analysis and threat modeling using the STRIDE methodology
• Development of vendor risk assessments, implementation of risk classifications, conducting supplier assessments and implementing technical monitoring solutions (e.g. Security ScoreCard)
• Securing cloud environments (AWS and Azure); expertise in CSPM/CNAPP (Wiz), cloud migration, secure CI/CD pipelines, container security and best practices in AWS, Azure and Office 365
• Application security: penetration testing, DevSecOps, OWASP, pre-commit hooks, key and secret management, IDE plugins, static source code analysis, dependency checks, container scanning, vulnerability management, CIS benchmarks and compliance
• Security assessment and hardening according to CIS benchmarks and cloud conformity in AWS, Office 365 and Azure

• Developing the concept for a cyber security awareness campaign for end customers
• Supporting the implementation of the international campaign
• Planning the roll-out

• Complete overhaul of the ISMS according to ISO 27001
• Conducted a comprehensive gap analysis
• Reduced ISMS documentation by 30% through consolidation and process optimization
• Introduced a full PDCA cycle for continuous improvement
• Established the ISMS within the company
• Implemented the necessary processes
• Managed and conducted internal and external audits
• Developed and implemented a company-wide risk management system
• Deployed an ISMS tool including process design and training
• KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
• NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
• Led a cybersecurity team of 3 members
• Conducted various internal and external audits, managed providers, introduced continuous improvement
• Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
• Redesigned the security architecture, reducing administrative efforts by 20%
• Implemented ITIL processes (e.g., change management)
• Revised service agreements with internal and external providers
• Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
• Managed a budget of one million euros

• Defined and executed a comprehensive security roadmap: integrated Shift-Left Security, CNAPP, and DevSecOps principles to streamline secure product development and reduce risk exposure.
• Established a robust threat modeling framework: embedded security into design processes, enabling early identification of vulnerabilities and reducing potential risks.
• Developed a scalable Vulnerability Management program: accelerated detection and remediation of new vulnerabilities, significantly shortening the risk response cycle.
• Enhanced cloud and container security: leveraged advanced tools such as Tetragon to achieve deeper visibility and implement a defense-in-depth strategy.
• Automated security controls within CI/CD pipelines: integrated security measures into the development lifecycle to maintain continuous delivery with robust safeguards.
• Championed cross-functional collaboration: partnered with developers and infrastructure teams to prioritize threats and align remediation efforts, fostering a unified security culture.
• Ensured regulatory compliance and audit readiness: collaborated closely with the InfoSec team to adhere to internal policies and successfully support audits for standards like PCI-DSS and SOC2.