ServiceNow Experts in Germany

• Conducted security assessments for supplier qualification, business unit onboarding, and ongoing reviews of service providers and partners (Ongoing Assurance).
• Assessed technical and organizational measures (TOMs) against GDPR and information security requirements.
• Handled security reviews and approval processes in the Global Approval Navigator (OneTrust).
• Advised business units and IT on information security, security requirements, and risk-appropriate measures.
• Supported the development of SOC/SIEM processes and tools as part of the ISMS in line with ISO/IEC 27001.
• Analyzed cyber threats and coordinated security objectives and measures to address Security Findings with the SOC team.
• Monitored and assessed current security advisories and security-related metrics (KPIs).
• Reviewed, assessed risks, and approved exception requests (Security Exceptions).
• Independently analyzed and handled Security Events and supported the handling of security incidents.
• Planned and supported awareness initiatives to strengthen security awareness.
• Created, implemented, and reviewed information security policies and standards.
• Conducted protection needs analyses and gap assessments to identify security gaps and risk deviations.
• Defined and reviewed technical and organizational risk treatment measures.
• Advised on Third Party Governance with consideration of DORA, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, and BCM in line with ISO 22301.

Project: Digital Sovereignty – Toll Collect

Workshop: Digital Sovereignty Recognize dependencies, reduce risks, remain capable of acting

Format

• One-day practical seminar

Target group

• Executive management
• IT managers
• Data protection officers
• Compliance functions

Content and objectives

• Systematic analysis of digital dependencies
• Assessment of legal and operational risks
• Development of a concrete plan to increase digital sovereignty
• Mapping of the entire IT infrastructure by participants
• Identification of critical dependencies on non-European providers
• Creation of a prioritized risk matrix based on:
• GDPR
• NIS2
• EU AI Act
• Joint development of options for action – from a hybrid model to complete migration to European solutions
• Development of an individual sovereignty roadmap with:
• Responsibilities
• Milestones
• Budget framework

Agenda

• Preliminary self-assessment (current infrastructure)
• Digital sovereignty? Nothing but an illusion
• Digital sovereignty 2026 – Germany’s dangerous dependency in focus
• Digital sovereignty & open source
• What is digital sovereignty?
• Three questions raised by digital sovereignty
• Reflection: Digital sovereignty in your own life
• Why is digital sovereignty existential now?
• Practical examples of digital sovereignty
• Schleswig-Holstein initiative
• Benefits of digital sovereignty for your company
• Assessing strategy options (cost-benefit matrix)
• Sovereign provider? 10 questions
• What does digital sovereignty specifically mean for your company?
• How do you shape digital sovereignty?
• Digital sovereignty and psychological safety
• Psychological safety: The key to high-performing teams
• Why psychological safety in your company?
• Benefits of psychological safety
• Invitation to group work: PsySafety Check (PS-C)
• The “Braintrust” experiment
• Creating a risk matrix
• Creating a roadmap & project plan
• European alternatives to US Big Tech
• 10-point plans:
• NIS2
• EU AI Act
• GDPR
• ISO 27001

As part of preparing and providing operational support for a company succession:

• Company analysis: Analysis of the overall economic, organizational and structural situation (current status, strengths/weaknesses, potential risks)
• Process analysis: Recording and documentation of all relevant business processes (BPMN, UML) in the areas of management, finance, purchasing, sales and operations
• Process optimization: Identification of weaknesses and inefficiencies, development and operational implementation of improvement measures
• Stakeholder management: Identification and analysis of all relevant internal and external stakeholders; structured communication and coordination with former and future owners, shareholders and employees
• Change management: Supporting employees and management throughout the handover process; building acceptance and trust among all parties involved
• Governance & documentation: Preparation and handover of structured operating manuals, process documentation and an organizational manual for the new business owner
• Risk & weakness analysis: Assessment of operational and strategic risks in the handover process and development of recommendations for action
• Operational support: Interim assumption of management responsibilities; ensuring business continuity during the transition phase

Led the end-to-end integration and migration architecture for decommissioning SAP IS-U market communication and transitioning to Salesforce Marketing Cloud (SFMC) with E.ON IT Services — covering regulated EDIFACT market messaging, a three-phase data migration (transfer of market message inventory after cutover), redesign of market communication processes, and full GDPR and German energy-market compliance.

• Designed the three-tier target architecture (SAP IS-U → NScale B2B gateway → SFMC) processing 50,000–100,000 EDIFACT messages daily within sub-5-minute SLAs.
• Architected the three-phase data migration: 36 months of historical data, zero-loss cutover of in-flight market messages, and near-real-time CDC synchronization.
• Delivered secure, BDEW/GDPR-compliant integration (AS2/OFTP2, RFC/IDoc, REST APIs, OAuth 2.0, Azure AD, AWS S3) achieving >99.5% uptime, <0.1% migration discrepancy, and RTO <4 hours.
• Applied BPMN to model and optimize the market communication processes.

Technologies: SAP IS-U, NScale, Salesforce Marketing Cloud, EDIFACT, OAuth 2.0, Azure AD, AWS S3, BPMN, Jira, Confluence, Draw.io

• Established a cyber resilience framework for AI-accelerated threats in the Frontier AI Threat Endurance (FATE) program: capability assessments, maturity assessments and gap analyses covering cyber security, operational resilience, incident response, recovery and governance, followed by target concepts and improvement measures
• Supported action owners from specification through implementation: implementation roadmaps, decision papers, management presentations and governance reporting, as well as audit- and supervision-ready documentation; managed stakeholders from IT, Information Security, Risk Management, Operational Resilience, Business Continuity and the business units

• Project management and consulting services with a focus on IT interim management: digitalization of corporate management, including processes and applications
• Assessment of the entire IT infrastructure, including applications, core processes and contracts, including cost optimization
• Evaluation and implementation of solutions to promote digitalization in the company in the areas of property management, CRM, invoice review and approval processes, smart metering, DMS and time tracking
• Digitization of file folders and introduction of SharePoint and Microsoft Teams as central document and communication platforms
• Design and delivery of an AI workshop, including the rollout of AI tools to increase efficiency and transparency in key business processes
• Preparation of training materials and delivery of user training for newly introduced digital processes and solutions

Business analysis / requirements engineering for the introduction of a central authorization platform:

• Analysis of existing requirements for the use of IGA solutions (NetIQ, MidPoint) in an existing IAM cluster
• Capturing requirements as epics and user stories (JIRA) to provide a comprehensive description of the use of an IGA solution for central access control across connected platforms and applications.
• Functional solution descriptions (Confluence) for various lifecycle processes, such as Identity Lifecycle (ILC), Role Lifecycle (RLC), Structure Lifecycle (SLC), and Application Lifecycle
• RBAC: Design of a role model in the IGA solution to automate access provisioning as much as possible, capturing application and business roles
• Approach for onboarding applications to the IGA tool, integrating Keycloak (ID Provider).
• Functions and processes for recertifying entitlement objects and roles, and for assigning / removing them from personalized identities.
• Functions and processes for audit-proof documentation and reporting of managed data and processes in the IGA / IAM environment.
• Planning, execution, and documentation of QA / testing for the 1st implementation phase of the MidPoint IGA solution in the IAM cluster.
• Planning a roadmap for the step-by-step testing and introduction of the IGA solution.

• Electronics – Surface Solutions | Carve-out of IT, data and system landscape*

• Separation of a full business division's IT, data and system landscape following divestment across cloud, on-premises and connected laboratory systems; centrally governed investment envelope in the three-digit m€ range

• Laboratory notebook and laboratory analytics platform stream: Palantir Foundry, Snowflake, Signals Notebook, Power BI and connected laboratory instrumentation; SharePoint and JIRA; site transition completed without interruption to laboratory operations

• Decision authority and escalation point for business, IT infrastructure, IT security and vendors; separation executed across globally distributed users and systems and handed over on schedule, avoiding a contractual penalty for the client

• Managed the integrated SAP S/4HANA delivery plan for 12 BTS workstreams, including milestone, dependency, and governance management.
• Coordinated end-to-end delivery across Business, IT, and Operations, focusing on execution, readiness, and issue resolution.
• Responsible for RAID, test, cutover, and deployment management to ensure a successful go-live.
• Implemented KPI tracking, status reporting, and PMO governance to provide transparent management of performance, risks, and escalations.

• Overall leadership of several strategic operations projects focusing on Workplace Services, SLA Framework, access management, certificate management, e-learning, backup & recovery, test management, and capacity management, as well as the introduction of system monitoring and feasibility studies for 24x7 operations, in some cases including implementation in ServiceNow
• Creation of various ServiceNow operating concepts covering training, access rights, and emergency management as part of a new cloud hosting initiative for the ServiceNow platform
• Executive board reports and leadership of steering committees as part of company-wide strategic objectives, as well as the establishment of new balanced scorecards for measuring KPIs related to optimization-driven project results

• Strategic planning, detailed technical preparation and operational management of an email gateway migration in a security-critical government environment.
• Preparation of the technical specification and development of technical concepts and migration approaches in line with BSI requirements.
• Technical requirements management with business units, information security and operations.
• Coordination of external service providers, integrators and implementation partners; maintenance of project plans, milestones, resources, risks and dependencies.
• Regular reporting to project management, the program environment and internal stakeholders.

Overall business responsibility for a program-wide initiative to create a central, authoritative data foundation for business customer master data (contacts and locations) within an IT service management transformation program.

• Managed the Epic portfolio from exploration through launch; prioritization and quarterly planning in a SAFe environment
• Aligned business units, architecture, and IT delivery around a shared vision and clear rules for data ownership (Data Governance)
• Prepared and secured scope and key decisions with program leadership, including deliberate descoping
• Managed risks, dependencies, and escalations; reported to program leadership and the PMO
• Developed the 2027 roadmap as a basis for budget and portfolio planning

Result: a clear MVP scope, key decisions made, and a 2027 roadmap. The program continued after handover without any loss of knowledge.

Migration of an existing application to a new IT infrastructure.

• Managed all project activities (infrastructure, applications, data, security, architecture)
• Planned complex network architectures with security requirements
• Designed and coordinated firewall configurations
• Planned and managed interfaces between ERP, cloud, and third-party systems
• Coordinated middleware solutions (e.g. SAP Integration Suite, MuleSoft, Boomi)
• Defined data flows, mapping rules, and integration architectures
• Managed data migrations and master data harmonization
• Coordinated with business departments, IT teams, service providers, and external partners
• Team size: International team of 35 employees – Germany | Poland | India | USA
• Languages: English

Tools: Microsoft Office (Word, Excel, PowerPoint, Project), Brainloop, Jira, Confluence, MS SharePoint

• Requirements management, process planning, interface function, ISMS setup, and documentation
• Setup and establishment of an ISMS according to ISO 27001 and establishment of emergency management / ITSCM
• Coordination of the circumstances with the public-sector IT service provider
• Consideration of KRITIS relevance within the scope and implementation of a B3S
• Development of requirements for document control and the continuous improvement process
• Preparation of relevant project documents
• Analysis of existing processes and preparation of guidelines
• Requirements gathering for ISMS and ITSCM and coordination with the IT service provider, including definition of interfaces
• Analysis of communication processes and escalation paths
• Review of documents for risk management, ISMS, emergency preparedness, and emergency response
• Redesign of the complete documentation and preparation of new relevant documents
• Development of necessary rules, policies, and concepts
• Interface between customer and service provider to ensure document quality
• Coordination of protection needs with specialist departments, particularly regarding KRITIS relevance, and planning of resulting measures
• Development of preventive measures to minimize the risk of data center outages in scenarios such as pandemics or ransomware attacks
• Definition of the test strategy for IT emergency exercises
• Initiation of necessary awareness training measures for specialist departments
• External Information Security Officer
• Introduction of document control