Security by Design Experts in Germany
in minutes from vetted, available freelancers with the power of AI.Hire experts who design secure systems from the start, harden cloud and application architectures, and build threat modeling into delivery. They also align SDLC practices, review controls, and help teams ship with less risk. Fast, precise matching with vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used Security by Design
Frédéric Klein
Last position:
Project Manager (Enterprise Cloud Governance) at CompuGroup Medical SE & Co. KGaA
Short description: Leading a group-wide project to establish standardized cloud governance for Microsoft Azure, including policies, security and compliance controls, automation, and cost and operations management while preserving the autonomy of decentralized business units within regulatory frameworks.
Tasks and activities:
Overall responsibility for designing, building, and implementing a company-wide cloud governance structure (Azure), including target picture, roadmap, and operating model.
Managing internal and external stakeholders (C-level, IT, Security, Compliance, Cloud Architecture, DevOps), including decision and escalation management.
Planning and facilitating workshops on cloud strategy, governance principles, and the design of areas such as identity, connectivity, and platform management.
Defining, implementing, and rolling out cloud policies (Azure Policy / custom policies), security standards, and compliance requirements (including GDPR, ISO 27001, BSI C5).
Building a cloud governance framework based on the Azure Cloud Adoption Framework (CAF), including landing zone and guardrail concepts.
Introducing automation solutions for governance, security, and cost control (policy/control automation, IaC, CI/CD-based control mechanisms).
Implementing cloud security and compliance monitoring mechanisms as well as continuous improvement processes.
Establishing and operationalizing FinOps in an enterprise environment (central and decentralized FinOps teams), including cost management strategies, reporting, and guardrails.
Integrating governance policies into DevOps processes (e.g. CI/CD principles for security and compliance checks, GitLab Runner concept in spokes, GitLab CI/CD for CAF landing zones).
Implementing access concepts including RBAC design and breaking-glass mechanisms (emergency access) as well as certificate automation (ACME / step-ca).
Achievements:
Created a unified, auditable governance and control set for Azure (policies, standards, compliance mapping) and thus laid the foundation for scalable cloud use in a regulated environment.
Established repeatable automation for governance, security, and cost control (IaC + CI/CD), reducing manual effort and implementation risk.
Improved operational and decision-making capability across central and decentralized units (clearer roles, responsibilities, escalation paths, balance between autonomy and group requirements).
Significantly increased workload compliance during lift-and-shift migrations.
Technologies used:
Microsoft Azure Policy, custom policies.
Terraform, OpenTofu, Terragrunt.
step-ca (ACME).
Entra ID.
Azure Firewall.
Azure Networking, hub-and-spoke architecture.
Azure vWAN (evaluation).
Azure Front Door, Azure Application Gateway.
Azure ExpressRoute.
Azure Key Vault.
NetBox.
GitLab (on-premises).
Infrastructure, concepts used:
Cloud shared responsibility model.
Hub-and-spoke connectivity / central shared services (from hub-spoke context).
Central governance with decentralized delivery (business unit autonomy with guardrails).
Methods used:
Scrum.
Stakeholder management (C-level to engineering).
Cloud governance, Azure Cloud Adoption Framework (CAF).
DevOps, CI/CD.
Cost and FinOps approaches: tagging/chargeback models, budget/alert concepts, reserved instances/savings plans vs. on-demand scenarios, sensitivity analyses.
RBAC, breaking-glass concepts.
ACME / certificate automation.
GitLab Runner concept in spokes, GitLab CI/CD pipelines for CAF landing zones.
Uwe Schwarz
Last position:
Technical Program Lead IPv6 Migration at Deutsche Rentenversicherung (RP, BW)
- Technical program ownership for the IPv6 migration at DRV RP and DRV BW, with a focus on migration planning, execution structure, and cross-functional technical coordination.
- Designed and implemented an operational control model with dashboard, action board, KPI portfolio, risk register, and decision index to translate technical topics into structured delivery artifacts.
- Coordinated technical groundwork for architecture and rollout across IPv6 addressing, segmentation, dual-stack target design, test-lab planning, and cross-team dependencies.
- Supported security and compliance-related requirements in the context of BSI, NIS2, and critical infrastructure, translating them into traceable evidence, risks, and management reporting.
- Achievement: Established a reusable intake-to-governance workflow for systematically capturing technical actions, risks, open issues, and evidence requirements.
- Achievement: Created an operational baseline for technical program execution with measurable KPIs, clear ownership, and transparent decision support.
Baris Ekici
Last position:
Founder / Product & Security Architect at Pirpirik
- Perform secure code reviews and provide secure-coding guidance across the application and platform architecture.
- Engineer infrastructure security and design security-monitoring architecture, incident-response playbooks and Security-by-Design controls.
M. S.
Last position:
Security consulting, audits & assessments
- Innovation/pilot project eHealth Germany
- SaaS company in the media sector, NRW
- Secure software development lifecycle, NRW
- BSI IT baseline protection assessments for multiple clinics
Detlev Spierling
Last position:
Freelance ICT journalist and communications consultant at Freiberuflich
- Working as a freelance ICT journalist for print and online media, as well as a communications consultant for medium-sized German and Dutch IT companies.
- Creating specialist publications, white papers, and journalistic articles on topics such as AI, IT sustainability, climate protection through low-code development, and the introduction of the electronic invoice, etc. (>100 work samples in the original can be viewed at [link])
- Analyzing and reporting on cybersecurity trends, including the NIS-2 directive, Security by Design, and the development of associative computers.
- Conducting expert interviews with specialists and executives on technological innovations such as digital shadows in production and predictive maintenance.
- Numerous publications in trade media such as Wirtschaftsinformatik & Management, IM+io, IT&Production, Digital Business Magazin, eGovernment Computing, etc.
Cedric Bergermann-Bißlich
Last position:
Enterprise & Cloud Security Architect at ---
Enterprise & Cloud Security Architect supporting the modernization of the SDK application landscape as part of the KVNeo transformation program. Responsible for enterprise architecture, cloud governance, security architecture, and the definition of technical standards for strategic business applications.
Key responsibilities include architecture governance, target architecture development, cloud and integration architecture, security-by-design, and the translation of regulatory requirements into sustainable technical solutions across multiple business domains.
Responsibilities and achievements
- Designed and reviewed target architectures for strategic insurance applications and enterprise services.
- Developed architecture documentation based on Arc42 and Architecture Decision Records (ADRs).
- Defined governance models, architecture principles, and technical guidelines for cross-domain initiatives.
- Supported the modernization of archive, document management, and output management platforms.
- Designed integration architectures using REST APIs and event-driven communication patterns.
- Led architecture discussions with enterprise architects, development teams, product owners, and business stakeholders.
- Translated regulatory requirements such as DORA and ISO/IEC 27001 into practical architecture decisions.
- Designed security concepts covering Identity & Access Management, authorization, authentication, auditability, and logging.
- Supported SIEM integration, security monitoring, and enterprise logging concepts.
- Evaluated technical risks, technical debt, and architecture improvements while providing decision papers for architecture boards.
- Established architecture governance processes and contributed to enterprise-wide transformation initiatives.
- Supported cloud governance activities and the definition of secure cloud architecture standards.
- Facilitated architecture workshops and coordinated cross-functional stakeholders across business and IT.
Technologies & Methods Microsoft Azure • Arc42 • Architecture Decision Records (ADR) • REST APIs • Event-Driven Architecture • Microsoft Entra ID • Active Directory • IAM • SIEM • Cloud Governance • Enterprise Architecture • Security Architecture • Azure API Management • Jira • Confluence • Draw.io • DORA • ISO/IEC 27001 • Agile • Scrum
Patrick Eichler
Last position:
Honorary Lecturer at SRH University Berlin
- Cloud Computing Fundamentals & Architecture: Expertise in core cloud concepts, including the three main Service Models (IaaS, PaaS, SaaS) and diverse Deployment Models (Public, Private, Hybrid, Multi-cloud).
- Modern Application Deployment Strategies (GCP Focus): Instruction on the GCP Application Hosting Spectrum, covering Virtual Machines, Containers (Kubernetes and Cloud Run), Platform as a Service (App Engine), and Serverless Computing (Functions as a Service - FaaS).
- Data Management & Big Data Analytics: Comprehensive coverage of Cloud Storage options (Object, Block, File) and Database solutions, including Relational (Cloud SQL), NoSQL (Firestore, BigTable, Memorystore), and serverless enterprise data warehousing (BigQuery).
- DevOps and Infrastructure Automation: Skills in DevOps principles, including Continuous Integration (CI), Continuous Delivery (CD), Infrastructure as Code (IaC) using tools like Terraform, and implementing effective Monitoring and Logging for system observability.
- Emerging Technologies & Responsible Cloud Use: Focus on crucial topics like Cloud and IoT Security, Identity and Access Management (IAM), data privacy, and the ethical considerations of cloud and massive data collection.
David Bleyer
Last position:
Acting Partner at Bliestal Consulting UG
- Redesigning cablewise infrastructure with CAT 8.1 keystones, measuring the speed and quality of the new installation with Pockethernet, documentation at a local saddlery
- CAT 8.1 installation and building a data center, site linking, VPN and VLAN configuration for a local car dealership, implementation of IT-Security standards like virus protection (G Data) and firewalling (OPNSense)
- Relocation of a tax office with redesign of the IT infrastructure, virus protection (G Data) and backup solutions (QNAP)
- Planning, conception and implementation of an inhouse data center, BSI-compliant for commercial laundry (including Proxmox-based virtualization of existing infrastructures, QNAP, G Data, OPNSense, APC)
- Implementation and conception of security solutions in the SME sector
- Collaboration on the IT-security concept for the Bremen network of authorities (in the dLAN network)
- Creation of IT-security concept VOIS (modules MESO, KFZ/iKFZ) including audit preparation for KBA
- Expansion of the IT-security concept for the online service for electronic residence registration (eWA) to include use as an eFA (one-for-all) service (nationwide)
- Expansion of the IT-security concept to include modules wos & wvp
- Concept development for the implementation of DIN SPEC 27076 at MSEs and SMEs
- Creation and evaluation of emergency concepts
- Creation and evaluation of response actions and BCM plans
- Assessment of existing business continuity management (ISO 22301)
- Development of BCM strategy options
- Conducting awareness training
Sergey Komarov
Last position:
Managing Director Cybersecurity at CBA-Cybersecurity and Business Advisory GmbH
- Development of comprehensive services in cybersecurity, IT governance, and AI
- Building and delivering strategic security solutions such as vCISO service, ISMS, SOC-as-a-Service (SIEM, SOAR, use cases, playbooks, threat hunting, incident response), AI-driven risk and compliance tools, and frameworks for outsourcing and third-party risks
- Supporting companies in meeting regulatory requirements and certifications (ISMS, NIS-2, DORA, CRA, KRITIS, ISO 27001, TISAX, BSI IT Baseline Protection, EU AI Act)
- Promoting innovations in cybersecurity automation, AI governance, and secure digital transformation
- Responsible for company growth, client relations, and strategic partnerships
Isabel Mundet
Last position:
NIS 2 Compliance Expert at SIEMENS Digital Industries Software
- Implemented comprehensive NIS 2 compliance programs through detailed gap analyses against ISO 27001, Siemens policies and controls
- Developed measurable success criteria for sustainable compliance structures
- Analyzed complex supply chains for systematic assessment of third-party risks
Fady Kuzman
Last position:
Senior Software Developer / Tech Lead at Specific Objects Technologies GmbH
- Project 1: Multi-Tenant SaaS Platform: Data Integration & Pricing Management
- Objective: New development of ELT pipeline (replacement for Java 6 legacy), integration of heterogeneous source systems (CSV, Excel, Email, external DBs), event-sourcing for complete auditability, multi-tenant architecture for tenant-capable data processing
- Challenge: Processing millions of records daily, audit compliance, data isolation between different tenants
- Solution: Stakeholder workshops for requirements analysis, event-driven architecture with Axon Framework and Apache Kafka, AWS services (EC2, S3, Lambda, SQS, API Gateway) for cloud integration, PostgreSQL with tenant-specific schemas for multi-tenant data isolation, REST API design with Spring Boot for external system integrations, comprehensive testing strategy (JUnit, Spring Test, Postman, PACT, ArchUnit)
- Results: ELT performance improved from 30+ min to 1-5 min; 2-3 hours daily saved through workflow automation; 10-20 hours/week saved through event-sourcing auditability; 100% audit compliance; secure multi-tenant data isolation for 10+ tenants
- Project 2: Multi-tenant CRM System Modernization
- Objective: Migration of CRM system (20+ years PHP/MySQL) to Java microservices, Domain-Driven Design implementation, establishment of Test-Driven Development, multi-tenant-capable SaaS architecture for multiple customer tenants
- Challenge: Remodeling complex business logic, no existing test culture, scalable tenant management with data isolation
- Solution: Comprehensive testing strategy (JUnit, Spring Test, Postman, PACT, ArchUnit), multi-tenant architecture with tenant-specific databases, REST API design with Spring Boot for cross-tenant integration, Kubernetes and Docker for container orchestration
- Results: 2× performance improvement; deployment time reduced from 40+ min to 5-7 min; migration without production outages; scalable multi-tenant solution for 15+ customer tenants
- Technologies: Java, Spring Boot 3.x, Angular, Apache Kafka, AWS (EC2, S3, Lambda, SQS, API Gateway), PostgreSQL, Axon Framework, Kubernetes, Docker, GitLab CI, REST API
Ales Loncar
Last position:
Senior DevOps Consultant (Freelance) at European Union Agency (via IBM)
- Worked as freelance Senior DevOps Consultant on-site for IBM at a European Union Agency, operating in a highly secure, air-gapped environment managing classified systems.
- Led automation and DevOps initiatives for a large-scale OpenShift platform (>400 nodes), driving deployment efficiency, GitOps adoption, and operational automation using Ansible, Python, and Bash while ensuring compliance with security requirements.
- Spearheaded automation of release and deployment workflows in a private cloud environment hosting 400+ OpenShift nodes, significantly improving deployment speed and reliability.
- Migrated existing playbooks, roles, and templates from Ansible Tower to Ansible Automation Platform (AAP), ensuring full compliance with fully-qualified collection names (FQCN) and preparing custom Execution Environments (EE) for containerized automation.
- Implemented GitOps Agent for AAP Controller Configuration as Code, enabling automated synchronization (CRUD) of Ansible Controller objects based on repository-stored configuration definitions using GitHub webhooks.
- Designed and automated complex multi-step operational workflows including environment cleanup, Helix cluster component re-creation, Kafka topic management, and OpenShift object lifecycle management across ~100 environments.
- Achieved a reduction of multi-day manual operations to under a few hours through automation improvements spanning multiple AAP clusters and OpenShift environments.
- Integrated Ansible Automation Platform with Thycotic (Delinea) Secret Server via lookup plugin to enhance secure credential management in automated processes.
- Managed deployment tasks, platform troubleshooting, and Istio network configurations while adhering to stringent EU PSC security and compliance standards.
- Collaborated with infrastructure and application teams to refine deployment procedures, develop naming conventions, and continuously improve automation coverage in an air-gapped, classified environment.
Kevin Engelhardt
Last position:
CISO as a Service at Joint Venture International Insurance
- Leading security operations and governance, ensuring continuous ISO 27001 conformity
- Enabling the secure integration of SaaS and AI tools across the organisation
- Driving AI strategy and governance to ensure responsible and compliant adoption
Daniel Carton
Last position:
Founder & Managing Director at BotCraft GmbH
- Building the company with a focus on connectivity for IIoT and Industry 4.0, iRPA/process automation, advanced robotics and smart systems, sensors and services
- Project management and software architecture for IoT gateway development (since 2020) with protocol translation, IT/OT convergence and GRC
- Developing RPA bots for automating and monitoring industrial processes with an agent-based AI approach (since 2020)
- Implementing unsupervised clustering and anomaly detection for time series data in big data streaming pipelines (since 2021)
- Introducing a Docker-based release train for OTA updates with DevSecOps and CI/CD (since 2018)
Nils Klawitter
Last position:
Vulnerability Management and Secure SDLC at DB InfraGO AG
- Successfully implemented vulnerability management with DefectDojo
- Advised on and implemented technical and procedural aspects of vulnerability management with DefectDojo
- Provided guidance on implementing a secure software development lifecycle
- Skills: GitLab, DefectDojo, Vulnerability Management, SCA, SAST, DAST, Python, Kubernetes, Argo CD, Docker, AWS, Azure, WhiteSource/Mend, Greenbone
Discover over 15,000 top freelancers
Statistics of experts using Security by Design
Aggregated from the professional profiles of matched freelancers.
Experience
19 years
Position duration
2.5 years
Positions per freelancer
12
Top business areas
Information Technology, Project Management, Product Development
Top industries
Information Technology, Manufacturing, Education
Certification focus areas
Information Technology, Audit, Product Development
Bachelor's degree or higher
83%
Master's degree or higher
50%
Doctorate
8%
Certifications per freelancer
3
Most common languages
German, English, Spanish
Speak two or more languages
94%
Based on our profile pool as of 30 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Germany using Security by Design
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 30 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the technology
Secure by default
Security by Design means building security into the architecture, code, and operating model from the first sketch onward. It is used for applications, APIs, cloud platforms, embedded systems, and internal tools where weak choices create risk later. Strong experts think in controls, data flow, and failure modes.
Common work
- Threat modeling and attack surface review
- Secure architecture and design reviews
- Identity, access, and privilege design
- Secure SDLC guidance for product teams
- Cloud and API security patterns
Where it fits
This approach shows up in regulated services, enterprise software, SaaS, and systems that handle sensitive data. In Germany, it is often part of larger digital transformation, cloud migration, and platform modernization work. Experts help teams keep security practical, not bolted on after release.
What strong experts do
A strong Security by Design professional knows how to turn policy into concrete decisions. They understand risk, secure defaults, input handling, authentication, authorization, logging, and dependency hygiene. They can explain tradeoffs clearly to product, engineering, and security stakeholders.
When to bring help
Bring in freelance expertise when a team lacks security design depth, faces a new architecture, or needs a review before launch. It also helps when product and security teams disagree on controls, or when legacy systems need safer patterns without a full rewrite. Short, focused support can remove blockers fast.
Tools and methods
Security by Design work often uses threat modeling workshops, security checklists, design review templates, and cloud security controls. Experts may work with OWASP guidance, zero trust ideas, secure coding standards, and IAM tooling. The best specialists adapt these methods to the system, not the other way around.
Frequently asked questions
Not sure where to start with Security by Design? These answers cover the essentials.
Security by Design is used to make systems safer before they ship, not after an incident. It covers architecture decisions, trust boundaries, identity flows, data protection, and secure defaults across web apps, APIs, cloud services, and internal platforms.
A Security by Design expert looks at the whole system, while a code review focuses on implementation. Good reviews still matter, but they come later and catch fewer structural issues than early design work. The best projects use both.
A strong Security by Design specialist usually brings threat modeling, cloud security, IAM, secure SDLC knowledge, and clear communication. Depending on the project, they may also need experience with API security, data classification, and compliance-oriented design.
A good Security by Design freelancer needs enough context to understand the system, data types, users, and major risks. They do not need every detail on day one, but they do need architecture diagrams, current controls, and the delivery constraints. With that, they can be useful quickly.
Most Security by Design work can be done remotely if the expert has access to architecture material and key stakeholders. On-site workshops can help for threat modeling, cross-team alignment, or sensitive environments in Germany. Many teams use a mix of both.
A strong Security by Design expert gives concrete recommendations, not vague warnings. They should be able to explain risk in plain language, connect it to the business impact, and suggest workable controls that fit the product and delivery pace.
No, Security by Design is broader. DevSecOps is about bringing security into delivery pipelines and operations, while secure coding focuses on implementation practices. Security by Design sets the safer shape of the system before those later steps start.
Before hiring a Security by Design freelancer, prepare the current architecture, main data flows, known risks, and any existing security standards. It also helps to name the decision makers who can approve changes. That makes the engagement focused and productive.
The average hourly rate of freelancers in Germany who have used Security by Design in their recent projects is 107 €, which corresponds to a daily rate of about 857 € based on an 8-hour working day.
Of the freelancers in Germany who have used Security by Design in their recent projects, 83% hold at least a Bachelor's degree, 50% hold at least a Master's degree, and 8% hold a doctorate.
On average, freelancers in Germany who have used Security by Design in their recent projects have 19 years of professional experience, with a single engagement typically lasting around 2.5 years.
The most common languages among freelancers in Germany who have used Security by Design in their recent projects are German (100%), English (94%), and Spanish (25%).
The most common industries among freelancers in Germany who have used Security by Design in their recent projects are Information Technology (100%), Manufacturing (50%), and Education (44%).
The most common business areas among freelancers in Germany who have used Security by Design in their recent projects are Information Technology (100%), Project Management (81%), and Product Development (69%).
Main locations of FRATCH Experts, who have recently used Security by Design
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
