SOX Experts in Germany

• Development and implementation of tailored information security strategies

• Introduction and further development of ISMS according to ISO 27001, BSI baseline protection, and other standards

• Risk management and creation of security concepts

• Consulting for KRITIS, PCI DSS, TISAX, and VdS 3473/10000

• Building and improving security organizations

• Creation and implementation of guidelines, policies, work instructions, and process descriptions

• Audit support and certification preparation

• Conducting trainings, workshops, and awareness campaigns

• Selection and consulting on the introduction of IT security solutions such as SIEM, DLP, IDS/IPS, firewalls, and encryption technologies

• Conducting penetration tests and vulnerability analyses

• Consulting on the selection, integration, and management of security architectures in complex IT environments

• Consulting on ITSM and managed security services and SOC

• Leading and managing complex projects to improve information security

• Process analysis, optimization, and management according to ITIL, ISO 27001, and cybernetics

• Introduction and quality assurance of management, documentation, and knowledge management systems

• Support in complying with regulatory information security requirements (e.g. GDPR, HIPAA, SOX, GMP, KRITIS)

• Development and implementation of risk analysis procedures

• Organizing initial response, forensic investigations, and organizational measures in the event of security incidents

• Designing and running targeted workshops on topics such as ISMS, IT risks, and current threat scenarios

• Awareness campaigns to promote security culture in companies

• Special trainings on ISO 27001, BSI baseline protection, KRITIS, and other relevant standards

• Simulations and exercises to prepare for information security incidents

• Interim management for leading information security projects or IT security organizations

• Taking on the role of an external CISO (Chief Information Security Officer)

• Support in developing and implementing IT security and corporate strategies

• Coaching and mentoring of managers in the field of information security

• Building and leading security departments as well as recruiting and qualifying employees

• Temporary assumption of management responsibility in critical situations

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

• Operation and further development of the network and security infrastructure.

• Monitoring, analysis and resolution of network and security incidents.

• Cross-department collaboration with other specialist teams for operations, further development and reporting.

• Firewall vulnerability analysis.

• Firewall rule approvals.

• Troubleshooting IP communication issues in the network and firewall infrastructure.

• Security-critical IT infrastructure, processing of personal data, compliance with legal regulations.

• Products: Palo Alto Networks Firewalls, Cisco ACI, Checkpoint Firewalls, F5

• Technologies: SDN, SDWAN, Cisco EPIC, Cisco ACI

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

• Independent planning, coordination and operational counting of fixed asset inventories at SGS sites across Germany
• During the count, clarification of variances as well as posting of the new inventories in the fixed assets of the respective site and company

(parallel to freelance work)

• Setup and leadership of ESG, Internal Audit, and Risk Management for a listed company
• Setup and leadership of a CSRD / EU Taxonomy project including sustainability reporting
• Analysis and implementation of all relevant ESG product compliance regulations, including the introduction of ESG software
• Introduction of enterprise risk management and an internal audit system

• Support for one of the largest logistics service providers in handling ServiceNow tickets in the areas of SAP MDG, Business Partner (BP), customer and supplier master data
• Technical analysis and resolution of tickets through in-depth review of various database tables
• Creation and maintenance of accounting clerks in the system
• Deactivation of company codes using transports
• Carrying out mass changes with LSMW (Legacy System Migration Workbench)

• PRISMA project
• Ansible automation
• Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019

• Design and implementation of a concept for assessing physical climate risks and mapping risks under the Supply Chain Act (LkSG)
• Effective communication

• Disciplinary and professional leadership of the IT and service team
• Definition and documentation of the Current Mode of Operation (CMO) in Confluence: application landscape, infrastructure, networks, backup & storage
• Development of the Future Mode of Operation (FMO) including process analysis & stakeholder interviews with all departments using BPMN and flowcharts
• Optimization of license management: reduction of ongoing software costs by approx. 17% p.a.
• Introduction and establishment of Jira as the central tool for project and service management
• Introduction and rollout of the HR software MindKey to digitize HR processes
• Introduction of a VoIP solution with Microsoft Teams incl. PSTN connection to replace classic telephony
• Introduction of the production and planning software OptiControl to digitize operational processes
• Rollout of Intune as a Mobile Device Management solution for Windows, iOS and Android
• Build-up of Power BI dashboards for machine park monitoring and financial reporting
• Planning and execution of the IT consolidation of two locations for 170 users
• Introduction of automated penetration testing with Pentera
• Coaching and mentoring the team in agile methods & project management
• Operational support in day-to-day business: administration, incident & change management
• Management of external service providers and assurance of the quality of outsourced IT services
• Responsibility for the IT budget incl. planning and controlling
• Direct reporting line to management with regular management reports on IT KPIs, budget and project status

Founded in 1968, MLD today employs over 350 people at various locations in and around Düsseldorf. The academic team, made up of 17 specialists, colleagues from biology, chemistry, pharmacy, drinking water hygiene, and medical training assistants, supports more than 1,500 office-based doctors and more than 30 hospitals with more than 5,000 beds in the Düsseldorf, Cologne and Lower Rhine regions as a reliable partner in laboratory medicine. It is a subsidiary of the Sonic Healthcare Group based in Sydney, Australia. Group: 37,000 employees, direct reporting line: Managing Director

Responsibilities:

• Disciplinary and technical management responsibility for 16 employees, sub-ledgers, general ledger, controlling, IT, purchasing, HR
• monthly reporting according to IFRS, consolidation of several domestic subsidiaries
• preparation of monthly, quarterly and annual financial statements of the companies according to IFRS and annual financial statements according to HGB of several companies, as well as preparation and support of the annual audits
• budgeting, forecasting
• accounting-related execution of incorporations, liquidations and transformations of the companies
• main contact person for auditors, tax advisors and tax authorities.

• Process management, project management
• Business process modeling market-to-order, order-to-cash
• Replacement of an existing CRM system
• Salesforce energy & utilities cloud, Aurea CRM, SAP-Signavio, iGrafx

• Creating workflows for server orders with different conditions, requirements and specifications based on an external ordering portal (connecting Aria Automation via RestAPI to BMC ITSM Helix) for separate internal customers / teams / tenants
• Mapping workflows for Day-2 Operations through the upstream portal (Snapshots, Resize, Disk Operations, Backup)
• Creating test cases and automated tests to verify the code and stability of the complete ordering process
• Documenting workflows in Confluence / Wiki / Jira
• Creating and maintaining blueprints
• Integrating Ansible Tower for further VM customization