Security Awareness Training Expert in Germany
in minutes from over 15,000 CVs with the power of AI.Hire experts who design targeted phishing simulations, build custom security culture programs, and ensure compliance with European privacy standards. Partner with vetted, available freelance professionals matched precisely to your organization's risk profile through our AI platform.
Meet FRATCH Experts in Germany, who have recently used Security Awareness Training
Dirk Peter
Last position:
Freelance Cyber Defense Lead & KRITIS/NIS2 Consultant | AI Security Architect at Self-Employed
Situation: Increasing demand for privacy-compliant AI solutions for clients in the KRITIS and mid-market sector that need to analyze sensitive media content (audio, video, documents) without sending data to public cloud LLMs.
Task: Design, deployment, and secure operation of a fully self-hosted AI infrastructure including a custom-built digital management platform for automated media analysis.
Action: Architected and implemented a multi-tier platform on hardened Proxmox infrastructure with frontend (Nuxt 3, Vue 3, TypeScript, Tailwind 4), backend (Laravel 13, PHP 8.4, Sanctum), data storage (PostgreSQL 16, MongoDB 7), caching/queuing (Redis 7, Laravel Queue), AI workers (Python 3.11, Whisper, DeepFace, Librosa), scheduling (Laravel Scheduler/Cron), and local LLMs (Gemma, DeepSeek, Qwen, Mistral, LLaMA, Phi) via OpenWebUI with segmented network access, API hardening, and audit logging following BSI recommendations.
Result: Fully GDPR-compliant, on-premises AI platform with zero data leakage to third parties.
Task: Overall responsibility as an external Head of Cyber Security / CISO-as-a-Service for the design, implementation, and continuous improvement of ISMS according to ISO 27001, BSI IT-Grundschutz, and NIS2.
Action: Built and managed Cyber Defense Centers (CDC) with SOC operations, integrated SIEM solutions (Splunk, Graylog), established risk-based vulnerability management (Qualys, Nessus, OpenVAS), and conducted regular infrastructure, application, and physical penetration tests.
Result: Audit-ready ISMS for multiple clients and a 60% reduction in critical vulnerabilities within 90 days.
Task: Design and execution of NIS2 assessments and operational roll-out plans for KRITIS operators.
Action: Developed an online assessment tool for automated identification of individual weakness profiles, implemented ISMS optimizations, penetration testing, awareness programs, GRC suite deployment, and delivered C-level presentations.
Result: Accelerated the consulting process by 50% and successfully prepared multiple clients for NIS2 compliance.
Task: Incident commander for crisis response, forensics, and business recovery in ransomware attacks and APT campaigns.
Action: Coordinated with state and federal police (LKA, BKA), performed forensic analysis (OSForensics, Wireshark, Kali Linux), executed disaster recovery and BCM strategies, and developed BTC extortion response strategies.
Result: 100% recovery rate within defined RTO windows and sustainable post-incident security architectures.
Action: Planned, built, and operated a hardened multi-VM infrastructure (Proxmox, 15+ VMs) with web and mail servers, Graylog, OPNsense firewalls, CRM/ERP and LLM instances, network segmentation, DDoS mitigation, automated patch management, and backup strategies.
Result: >99.5% uptime over 20+ years and zero compromises.
Action: Designed coordinated phishing campaigns with five levels of difficulty, developed e-trainings and webinars in a PDCA cycle, and led red and blue teams.
Result: Phishing click rate reduced from 35% to under 5% within three campaign cycles.
Florian Schröder
Last position:
Information Security Officer / Designated InfoSec Officer at Oil Company
- Complete overhaul of the ISMS according to ISO 27001
- Conducted a comprehensive gap analysis
- Reduced ISMS documentation by 30% through consolidation and process optimization
- Introduced a full PDCA cycle for continuous improvement
- Established the ISMS within the company
- Implemented the necessary processes
- Managed and conducted internal and external audits
- Developed and implemented a company-wide risk management system
- Deployed an ISMS tool including process design and training
- KRITIS compliance: Prepared and provided required evidence, liaised with regulatory authorities, planned, documented, and implemented an attack detection system (SIEM), co-led the BCMS/ITSCM implementation subproject
- NIS-2 implementation: Gap analysis, risk assessments, training for executives and staff
- Led a cybersecurity team of 3 members
- Conducted various internal and external audits, managed providers, introduced continuous improvement
- Project consulting: closely coordinated with business and system owners, launched an online shop, a mobile app, and a customer portal
- Redesigned the security architecture, reducing administrative efforts by 20%
- Implemented ITIL processes (e.g., change management)
- Revised service agreements with internal and external providers
- Developed a security awareness strategy, ran social engineering tests, introduced and monitored phishing simulations, created various awareness materials, gave presentations
- Managed a budget of one million euros
Ebru Bonetti
Last position:
Tech Legal Consultant at Telecommunications
- Privacy by Design and by Default
- Working with OneTrust: creating and managing records for requesters
- Interface role: mediation and communication between the DPO and the specialist departments, including clarifying data protection questions
- Handling data protection incidents: analysis, documentation, and coordination of measures
- General advice on data protection topics: support with data protection-related questions
- Process optimization: identifying room for improvement in processes and implementing changes
- Documentation & reporting: creating reports on data protection incidents or general data protection topics for the DPO and weekly reports for the line manager for presentation in the performance board
- Risk assessment & compliance: support in assessing data protection risks in new projects or processes
- Distribution and independent handling of email requests or requests from the DPO: all incoming tickets are divided among team members, with no specialization in the tasks. Tickets are created and tracked in Jira.
Approach/Methods:
- Stakeholder management
- Communication at C-level
- Timeline and implementation plan
Guido Krauß
Last position:
IT Consultant / Owner at Guido Krauß IT-Consulting
Self-employed consulting, implementation, and support of IT infrastructures with a focus on IT security, network and server administration, virtualization, backup & recovery, IT documentation, asset management, and business continuity management.
- IT security consulting and implementation of technical protective measures
- Windows server and client support, patch management, user support
- M365 – Entra ID – MS Azure administration
- Planning, installation, and operation of LAN, WAN, WLAN, and VLAN infrastructures, Cisco, HP, Netgear, Sophos, Securepoint
- Support of virtual systems based on Hyper-V, VMware, and Proxmox
- Backup and recovery concepts including test recovery, documentation, and handover
- Introduction and maintenance of IT documentation, asset management, and inventory tracking
- Implementation of measures related to IT baseline protection, emergency manuals, and BCM
- On-/offboarding concepts with a focus on permissions, devices, data access, and handover processes
Security awareness and practical sensitization of users and IT staff
Cedric Oettel
Last position:
Development at Construction industry
- New development of project room functions
- Connection of REST API of a self-developed web service (.NET 7/8) as Azure App Service
- UI tests with Playwright
- Extension of Azure DevOps pipelines
- Migration to Azure SQL Server
- Software / technology: SharePoint Online, PowerShell scripts, SharePoint Framework, MobX, C#, Logic Apps, Playwright, Azure SQL Server, Graph API
Peter Dittkuhn
Last position:
Security Consultant at Public Institution of the City Administration
- Requirements management, process planning, interface role, ISMS implementation and documentation
- Implementation and establishment of an ISMS according to ISO 27001 as well as setup of emergency management / ITSCM
- Coordination of conditions with the authority-affiliated IT service provider
- Consideration of KRITIS relevance in the scope and implementation of a B3S
- Development of guidelines for document control and the continuous improvement process (KVP)
- Creation of relevant project documents
- Analysis of existing processes and development of guidelines
- Collection of requirements for ISMS and ITSCM and coordination with the IT service provider including definition of interfaces
- Analysis of communication processes and escalation paths
- Review of documents for risk management, ISMS, emergency preparedness and emergency response
- Development of a complete rebuild of all documentation and creation of new relevant documents
- Development of necessary rules, policies and concepts
- Interface function between customer and service provider to ensure document quality
- Coordination of protection needs with departments, especially regarding KRITIS relevance, and planning resulting measures
- Development of preventive measures to minimize data center outages for various scenarios such as pandemics or ransomware attacks
- Defining the test strategy for IT emergency exercises
- Initiation of necessary training measures for raising awareness in departments
- External Information Security Officer (ISB)
- Introduction of document control
Flamur Abdyli
Last position:
Fractional Chief Information Security Officer at VR Smart Guide GmbH
- Enhance and develop the Information Security Management System (ISMS) in compliance with ISO 27001 and TISAX standards by continuously updating and refining the ISMS to align with evolving global standards.
- Ensure that security practices and policies are integrated into all business processes to achieve and maintain certifications.
- Lead the effort to identify, evaluate and mitigate risks across the organization, setting benchmarks for security measures.
- Oversee and refine security processes, with an emphasis on incident management and rapid response by developing and enforcing policies for rapid detection, investigation and remediation of security incidents.
- Train and lead the incident response team to handle breaches effectively, minimizing impact and ensuring swift recovery.
- Implement continuous monitoring solutions to detect and respond to threats in real time.
- Conduct comprehensive security assessments for internal and external IT projects, ensuring adherence to GDPR, DORA and other relevant standards.
- Oversee security evaluations for all IT projects to ensure they comply with legal and regulatory requirements.
- Integrate security measures from the planning phase through deployment to ensure all projects uphold the organization’s security standards.
- Collaborate with project teams to address findings and ensure that security risks are managed effectively.
- Serve as the principal security advisor to the IT department and senior management, offering insights on potential security challenges.
- Facilitate a culture of security awareness throughout the organization through training and regular communication.
- Lead security initiatives that align with the organization’s long-term strategic goals.
- Establish and oversee a robust third-party risk management framework to mitigate external security threats by regularly assessing third-party security practices and compliance and developing contingency plans and mitigation strategies.
- Provide regular updates and security briefings to the executive leadership and relevant committees, highlighting recent security incidents, responses, lessons learned and recommending strategic improvements.
David Bleyer
Last position:
Acting Partner at Bliestal Consulting UG
- Redesigning cablewise infrastructure with CAT 8.1 keystones, measuring the speed and quality of the new installation with Pockethernet, documentation at a local saddlery
- CAT 8.1 installation and building a data center, site linking, VPN and VLAN configuration for a local car dealership, implementation of IT-Security standards like virus protection (G Data) and firewalling (OPNSense)
- Relocation of a tax office with redesign of the IT infrastructure, virus protection (G Data) and backup solutions (QNAP)
- Planning, conception and implementation of an inhouse data center, BSI-compliant for commercial laundry (including Proxmox-based virtualization of existing infrastructures, QNAP, G Data, OPNSense, APC)
- Implementation and conception of security solutions in the SME sector
- Collaboration on the IT-security concept for the Bremen network of authorities (in the dLAN network)
- Creation of IT-security concept VOIS (modules MESO, KFZ/iKFZ) including audit preparation for KBA
- Expansion of the IT-security concept for the online service for electronic residence registration (eWA) to include use as an eFA (one-for-all) service (nationwide)
- Expansion of the IT-security concept to include modules wos & wvp
- Concept development for the implementation of DIN SPEC 27076 at MSEs and SMEs
- Creation and evaluation of emergency concepts
- Creation and evaluation of response actions and BCM plans
- Assessment of existing business continuity management (ISO 22301)
- Development of BCM strategy options
- Conducting awareness training
Sergey Komarov
Last position:
Managing Director Cybersecurity at CBA-Cybersecurity and Business Advisory GmbH
- Development of comprehensive services in cybersecurity, IT governance, and AI
- Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
- Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
- Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
- Responsible for company growth, client relations, and strategic partnerships
Jens Brennscheidt
Last position:
Senior Cyber Security Consultant at Brennscheidt IT Consulting
ISMS consulting
Interim management
Conducting security analyses & audits
BCM consulting
Executive management
Felix Golla
Last position:
Software Engineer at WesortAI
- Trained computer-vision models end-to-end with ClearML & Python on GCP, reducing iteration time by 40%.
- Developed Python pipelines to generate synthetic datasets.
- Built Angular dashboards for data-quality insights; utilized PostgreSQL to persist metadata and metrics.
- Collaborated with data-science and DevOps teams to implement CI/CD for model versioning and scalable deployments.
Gunnar Wulf
Last position:
IT-Consultant at Independent Freelancer
- Enterprise and IT strategy
- Digital transformation
- Process and portfolio management
- Interim IT management
Valeri Milke
Last position:
Associate Partner - Information Security Consulting at Insentis GmbH
- Improvement of the Information Security Management System (ISMS) based on ISO 27001, NIS2, DORA, B3S, TISAX and BSI IT Baseline Protection
- Conducting comprehensive gap analyses to identify gaps and derive action plans according to the above standards and regulations; management and KPIs
- Data Loss Prevention strategy and implementation using MS Purview
- Vulnerability and patch management, security monitoring
- Risk analysis and threat modeling using the STRIDE methodology
- Development of vendor risk assessments, implementation of risk classifications, conducting supplier assessments and implementing technical monitoring solutions (e.g. Security ScoreCard)
- Securing cloud environments (AWS and Azure); expertise in CSPM/CNAPP (Wiz), cloud migration, secure CI/CD pipelines, container security and best practices in AWS, Azure and Office 365
- Application security: penetration testing, DevSecOps, OWASP, pre-commit hooks, key and secret management, IDE plugins, static source code analysis, dependency checks, container scanning, vulnerability management, CIS benchmarks and compliance
- Security assessment and hardening according to CIS benchmarks and cloud conformity in AWS, Office 365 and Azure
Carsten Hagemann
Last position:
Consultant at Automotive OEM
- Developing the concept for a cyber security awareness campaign for end customers
- Supporting the implementation of the international campaign
- Planning the roll-out
Ali Yazdani
Last position:
Principal Product Security Engineer at Payrails GmbH
- Defined and executed a comprehensive security roadmap: integrated Shift-Left Security, CNAPP, and DevSecOps principles to streamline secure product development and reduce risk exposure.
- Established a robust threat modeling framework: embedded security into design processes, enabling early identification of vulnerabilities and reducing potential risks.
- Developed a scalable Vulnerability Management program: accelerated detection and remediation of new vulnerabilities, significantly shortening the risk response cycle.
- Enhanced cloud and container security: leveraged advanced tools such as Tetragon to achieve deeper visibility and implement a defense-in-depth strategy.
- Automated security controls within CI/CD pipelines: integrated security measures into the development lifecycle to maintain continuous delivery with robust safeguards.
- Championed cross-functional collaboration: partnered with developers and infrastructure teams to prioritize threats and align remediation efforts, fostering a unified security culture.
- Ensured regulatory compliance and audit readiness: collaborated closely with the InfoSec team to adhere to internal policies and successfully support audits for standards like PCI-DSS and SOC2.
Discover over 15,000 top freelancers
Statistics of experts using Security Awareness Training
Aggregated from the professional profiles of matched freelancers.
Experience
20 years
Position duration
2.5 years
Positions per freelancer
13
Top business areas
Information Technology, Project Management, Quality Assurance
Top industries
Information Technology, Professional Services, Manufacturing
Certification focus areas
Information Technology, Audit, Legal
Bachelor's degree or higher
78%
Master's degree or higher
28%
Certifications per freelancer
6
Most common languages
German, English, Spanish
Speak two or more languages
92%
Based on our profile pool as of 30 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Germany using Security Awareness Training
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 30 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the technology
Cultivating a Human Firewall Against Cyber Threats
Security Awareness Training focuses on educating employees to recognize and mitigate digital risks. Freelance specialists in this field build programs that transform staff from a vulnerability into a strong line of defense. They address threats like social engineering, executive impersonation, and physical security leaks.
Essential Security Training Deliverables
Professional specialists design structured education campaigns that fit specific corporate environments. They deliver tangible materials and test systems to verify organizational readiness. Key outputs include:
- Custom spear phishing simulations to test employee vigilance
- Interactive e-learning modules on data protection and password hygiene
- Tailored security policies and incident reporting guidelines
- Executive-level briefing sessions on targeted social engineering tactics
Modern Training Platforms and Simulation Tools
Experts leverage specialized software to deploy, track, and analyze training campaigns. They configure phishing simulation engines, content delivery networks, and learning management systems. Common platforms include KnowBe4, SoSafe, Phished, and Hoxhunt, which are integrated into corporate communication tools like Microsoft Teams and Slack.
Navigating German Regulatory and Cultural Standards
In Germany, deploying employee tracking or phishing simulations requires deep familiarity with local legal frameworks. Specialists ensure all training initiatives comply with the Federal Data Protection Act and GDPR. They collaborate closely with local works councils to structure campaigns that protect employee privacy while meeting security objectives.
When Companies Onboard Awareness Specialists
Organizations seek dedicated freelance support when internal IT teams lack the time or educational expertise to run continuous campaigns. Typical triggers include:
- Preparing for strict audits like ISO 27001, TISAX, or NIS2 compliance
- Experiencing a recent security incident or near-miss phishing attempt
- Moving from static annual slideshows to continuous, adaptive learning
- Standardizing training across multiple regional offices and languages
Profile of an Elite Awareness Specialist
Top-tier professionals combine technical cybersecurity knowledge with adult learning psychology and communication skills. They do not just deploy off-the-shelf content; they analyze a company's specific threat landscape to design relevant scenarios. They are adept at measuring behavioral change over time rather than just tracking course completion rates.
Frequently asked questions
Everything clients usually want to know about Security Awareness Training, in one place.
A specialist in Security Awareness Training designs, implements, and manages educational campaigns to reduce human-error cyber risks. They set up realistic phishing simulations, write policy guidelines, and teach staff how to spot social engineering. Their goal is to build a lasting culture of cybersecurity across the entire organization.
Annual briefings often fail to change long-term behavior because employees quickly forget the rules. In contrast, continuous Security Awareness Training uses bite-sized learning modules and frequent phishing tests to keep cybersecurity top of mind. This continuous approach helps staff build natural habits for identifying active threats.
Experts rely on specialized software suites like KnowBe4, SoSafe, and Hoxhunt to automate simulations and track educational progress. They also integrate these tools with corporate directories and Learning Management Systems to streamline enrollment. For custom requirements, they may build tailored content using interactive e-learning authoring tools.
In Germany, conducting simulated attacks requires early alignment with the works council (Betriebsrat) to protect employee rights. A skilled Security Awareness Training professional will draft clear agreements detailing how data is pseudonymized and ensuring that test failures do not lead to disciplinary action. This collaborative approach ensures legal safety and high employee participation.
Yes, regular Security Awareness Training is a mandatory requirement for key security frameworks such as ISO 27001, TISAX in the automotive sector, and the NIS2 directive. Freelancers ensure your curriculum directly addresses the control objectives of these standards. They also generate the detailed compliance reports and audit trails needed to satisfy certification bodies.
Beyond technical cybersecurity knowledge, look for expertise in change management, corporate communications, and pedagogical design. The specialist should also understand data privacy laws to keep all testing compliant. Strong presentation skills are essential for delivering engaging workshops to both executives and non-technical staff.
Success is measured by tracking key behavioral metrics, such as a decreasing phishing click rate and an increasing reporting rate when suspicious emails arrive. A professional in Security Awareness Training sets up reporting buttons within your email client to capture this data. Over time, you should see faster incident detection times and fewer actual security breaches.
While most campaign planning and simulation management can be done remotely, having an expert in Germany is highly beneficial for understanding local compliance and holding on-site workshops. A German-speaking Security Awareness Training specialist can better write realistic phishing templates that mimic local German business correspondence. They also bring the native language skills needed to deliver high-impact training sessions directly to your local workforce.
The average hourly rate of freelancers in Germany who have used Security Awareness Training in their recent projects is 127 €, which corresponds to a daily rate of about 1,019 € based on an 8-hour working day.
Of the freelancers in Germany who have used Security Awareness Training in their recent projects, 78% hold at least a Bachelor's degree and 28% hold at least a Master's degree.
On average, freelancers in Germany who have used Security Awareness Training in their recent projects have 20 years of professional experience, with a single engagement typically lasting around 2.5 years.
The most common languages among freelancers in Germany who have used Security Awareness Training in their recent projects are German (96%), English (92%), and Spanish (15%).
The most common industries among freelancers in Germany who have used Security Awareness Training in their recent projects are Information Technology (92%), Professional Services (50%), and Manufacturing (46%).
The most common business areas among freelancers in Germany who have used Security Awareness Training in their recent projects are Information Technology (100%), Project Management (85%), and Quality Assurance (65%).
Main locations of FRATCH Experts, who have recently used Security Awareness Training
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
