SOX Expert

• Development and implementation of tailored information security strategies

• Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards

• Risk management and creation of security concepts

• Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000

• Building and improving security organizations

• Creation and implementation of guidelines, policies, work instructions, and process descriptions

• Audit support and certification preparation

• Conducting trainings, workshops, and awareness campaigns

• Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies

• Conducting penetration tests and vulnerability analyses

• Consulting on the selection, integration, and management of security architectures in complex IT environments

• Consulting on ITSM and managed security services and SOC

• Leading and managing complex projects to improve information security

• Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics

• Introduction and quality assurance of management, documentation, and knowledge management systems

• Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)

• Development and implementation of risk analysis procedures

• Organizing initial response, forensic investigations, and organizational measures in the event of security incidents

• Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios

• Awareness campaigns to promote security culture in companies

• Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards

• Simulations and exercises to prepare for information security incidents

• Interim management for leading information security projects or IT security organizations

• Taking on the role of an external CISO (Chief Information Security Officer)

• Support in developing and implementing IT security and corporate strategies

• Coaching and mentoring of managers in the field of information security

• Building and leading security departments as well as recruiting and qualifying employees

• Temporary assumption of management responsibility in critical situations

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

• Operation and further development of the network and security infrastructure.

• Monitoring, analysis and resolution of network and security incidents.

• Cross-department collaboration with other specialist teams for operations, further development and reporting.

• Firewall vulnerability analysis.

• Firewall rule approvals.

• Troubleshooting IP communication issues in the network and firewall infrastructure.

• Security-critical IT infrastructure, processing of personal data, compliance with legal regulations.

• Products: Palo Alto Networks Firewalls, Cisco ACI, Checkpoint Firewalls, F5

• Technologies: SDN, SDWAN, Cisco EPIC, Cisco ACI

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

• Independent planning, coordination and operational counting of fixed asset inventories at SGS sites across Germany
• During the count, clarification of variances as well as posting of the new inventories in the fixed assets of the respective site and company

(parallel to freelance work)

• Setup and leadership of ESG, Internal Audit, and Risk Management for a listed company
• Setup and leadership of a CSRD / EU Taxonomy project including sustainability reporting
• Analysis and implementation of all relevant ESG product compliance regulations, including the introduction of ESG software
• Introduction of enterprise risk management and an internal audit system

• Support for one of the largest logistics service providers in handling ServiceNow tickets in the areas of SAP MDG, Business Partner (BP), customer and supplier master data
• Technical analysis and resolution of tickets through in-depth review of various database tables
• Creation and maintenance of accounting clerks in the system
• Deactivation of company codes using transports
• Carrying out mass changes with LSMW (Legacy System Migration Workbench)

• PRISMA project
• Ansible automation
• Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

• Design and implementation of a concept for assessing physical climate risks and mapping risks under the Supply Chain Act (LkSG)
• Effective communication

• Disciplinary and professional leadership of the IT and service team
• Definition and documentation of the Current Mode of Operation (CMO) in Confluence: application landscape, infrastructure, networks, backup & storage
• Development of the Future Mode of Operation (FMO) including process analysis & stakeholder interviews with all departments using BPMN and flowcharts
• Optimization of license management: reduction of ongoing software costs by approx. 17% p.a.
• Introduction and establishment of Jira as the central tool for project and service management
• Introduction and rollout of the HR software MindKey to digitize HR processes
• Introduction of a VoIP solution with Microsoft Teams incl. PSTN connection to replace classic telephony
• Introduction of the production and planning software OptiControl to digitize operational processes
• Rollout of Intune as a Mobile Device Management solution for Windows, iOS and Android
• Build-up of Power BI dashboards for machine park monitoring and financial reporting
• Planning and execution of the IT consolidation of two locations for 170 users
• Introduction of automated penetration testing with Pentera
• Coaching and mentoring the team in agile methods & project management
• Operational support in day-to-day business: administration, incident & change management
• Management of external service providers and assurance of the quality of outsourced IT services
• Responsibility for the IT budget incl. planning and controlling
• Direct reporting line to management with regular management reports on IT KPIs, budget and project status

Founded in 1968, MLD today employs over 350 people at various locations in and around Düsseldorf. The academic team, made up of 17 specialists, colleagues from biology, chemistry, pharmacy, drinking water hygiene, and medical training assistants, supports more than 1,500 office-based doctors and more than 30 hospitals with more than 5,000 beds in the Düsseldorf, Cologne and Lower Rhine regions as a reliable partner in laboratory medicine. It is a subsidiary of the Sonic Healthcare Group based in Sydney, Australia. Group: 37,000 employees, direct reporting line: Managing Director

Responsibilities:

• Disciplinary and technical management responsibility for 16 employees, sub-ledgers, general ledger, controlling, IT, purchasing, HR
• monthly reporting according to IFRS, consolidation of several domestic subsidiaries
• preparation of monthly, quarterly and annual financial statements of the companies according to IFRS and annual financial statements according to HGB of several companies, as well as preparation and support of the annual audits
• budgeting, forecasting
• accounting-related execution of incorporations, liquidations and transformations of the companies
• main contact person for auditors, tax advisors and tax authorities.

• Company FROX (Schweiz), end customer: Bundesamt für Informatik und Telekommunikation.
• Consulting and development. ITSM Suite, development of a semi-generic REST API interface solution. Performance tuning.

• The customer is undergoing a comprehensive transformation. All SAP ECC landscapes worldwide are being migrated to SAP S/4HANA, with the goal of introducing a standard template worldwide.

• The program also includes the “RISE with SAP” migration and modernization program, which may involve migrating the landscapes of selected country installations to the SAP Private Cloud.

• On the stakeholder side, the program reporting line extends to the company’s executive board and that of the implementation partner.

• Fiserv Germany’s ERP landscape currently includes several non-standard SAP tools and applications that extend the functionality of the ECC environment and can often be integrated into downstream systems. As part of the transition to SAP S/4HANA, it is essential to assess the core functionality, integration points and future viability of these applications in order to determine their alignment with the target architecture.

• The focus of the work is on providing expert advice and assessment to define the scope, strategy and roadmap for transitioning Fiserv Germany’s SAP ECC system to SAP S/4HANA.

• The recommended best practices from SAP are followed and a structured approach is used to ensure a smooth transition with minimal disruption while maximizing business value.

• This assessment forms the basis for a successful SAP S/4HANA transformation and ensures alignment with industry best practices, regulatory compliance and future scalability.

• Migration Strategy Definition – assessment of available transition approaches based on business objectives, technical feasibility and SAP Best Practices.

• Technical Readiness Assessment – conducting a system analysis to assess compatibility, custom code impact, data volume management, integration points and infrastructure readiness for SAP S/4HANA.

• Business Process Impact Analysis – reviewing the latest business process documentation to define the scope and effort required to implement the necessary functions in SAP S/4HANA and to identify opportunities for process optimization.

• Roadmap for Non-SAP Systems and Applications – assessment of third-party and legacy applications regarding their integration with SAP S/4HANA and recommendation of consolidation, migration or replacement strategies.

• Deployment & Implementation Planning – defining a phased approach for implementation, including project schedules, risk mitigation strategies and key milestones aligned with business priorities.

• This transformation takes place in phases: the Discovery phase leads to the Explore phase, which is followed by the Design phase and finally implementation.

• Program management

• Change management

• Requirements management

• Transition management

• Stakeholder management

• Risk management

• Comprehensive coordination