TISAX Expert in Germany

• Conducted security assessments for supplier qualification, business unit onboarding, and ongoing reviews of service providers and partners (Ongoing Assurance).
• Assessed technical and organizational measures (TOMs) against GDPR and information security requirements.
• Handled security reviews and approval processes in the Global Approval Navigator (OneTrust).
• Advised business units and IT on information security, security requirements, and risk-appropriate measures.
• Supported the development of SOC/SIEM processes and tools as part of the ISMS in line with ISO/IEC 27001.
• Analyzed cyber threats and coordinated security objectives and measures to address Security Findings with the SOC team.
• Monitored and assessed current security advisories and security-related metrics (KPIs).
• Reviewed, assessed risks, and approved exception requests (Security Exceptions).
• Independently analyzed and handled Security Events and supported the handling of security incidents.
• Planned and supported awareness initiatives to strengthen security awareness.
• Created, implemented, and reviewed information security policies and standards.
• Conducted protection needs analyses and gap assessments to identify security gaps and risk deviations.
• Defined and reviewed technical and organizational risk treatment measures.
• Advised on Third Party Governance with consideration of DORA, ISO/IEC 27001, ISO/IEC 27005, ISO/IEC 42001, and BCM in line with ISO 22301.

• Founder of CheironX: AI-supported GRC management (ISO 27001, BSI IT-Grundschutz, TISAX, DORA)
• Strategic focus on Agentic AI and GenAI for modern IT Governance, Risk & Compliance Management
• IT interim management and strategic consulting

Conceptualization, founding and development of a non-profit organization for international future and development partnerships. Development of the basic organizational and legal structures, governance and internal processes, as well as development of the organization’s external profile and institutional networks. Coordination of the founding and registration process, development of initial project and subject areas, and establishment of contacts with policymakers, public administration, funding institutions, academia and other cooperation partners. Development of funding and financing approaches and external representation of the organization. Result: Establishment of a legally capable organization recognized as a non-profit, with defined governance and working structures, an independent external profile and initial institutional networks. Establishment of FIZE as an organizational structure for international projects and initiatives, including MICT UA.

Assignment focus: Leading digital restructuring in a highly regulated Defence and Aerospace environment. Focus areas: improving data flows and data quality, introducing paperless data collection in production, integrating machine data for automatic SPC calculation and process control, as well as cybersecurity analyses.

Main objectives:

• Analyze, structure and improve data flows and data quality in production
• Introduce paperless data collection in manufacturing areas
• Integrate machine data for automatic SPC data calculation and process control
• Implement digital restructuring while meeting regulatory requirements in the Defence environment

Measures and results:

• Analyzed and structured existing production data flows as a basis for control and reporting
• Established mechanisms to ensure data quality and availability across manufacturing areas
• Introduced paperless data collection in production — replacing manual and paper-based processes
• Integrated machine data for automatic SPC data calculation (control charts, Cp/Cpk) and real-time process control
• Conducted cybersecurity analyses in the production and IT environments

Area of responsibility: Project management for digital restructuring, paperless production, data management and data quality in a highly regulated Defence and Aerospace environment.

• Private Equity owned precision grinding machines for Auto, Military & Aerospace – 1200 Employees
• Acting as Interim Group CIO / CISO consolidating Global IT back to Europe – M&A consolidation
• Managed major Security event and post event cleanup – Reporting to regulators
• Performed Vendor & Contract Management – full assessment of capabilities
• Guided Infrastructure refresh & Security Hygiene assessments

As Germany’s only large integrated energy company, EnBW covers the entire value chain—from energy generation and distribution to serving customers. The company is expanding its renewable energy sources, working toward a socially responsible coal phase-out, and advancing key technologies such as the use of green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW.  Developing and implementing an end-to-end process view that takes both technical and organizational aspects into account  Ensuring end-to-end control of all IAM-related technical services  Establishing clear responsibilities and accountabilities across the IAM landscape  Working with various departments to identify and optimize an end-to-end architecture and act as the Single Point of Contact (SPoC) for Information Security  Introducing and monitoring governance policies to ensure compliance and security  Continuously improving IAM processes and systems through regular audits and service reviews  Taking part in external process audits as part of official audits against ISO standards  Further developing the policy that sets administrative requirements and procedures, and aligning it with administrative departments  Conceptually developing the KPI system for measuring process quality

Carve-out and post-merger integration of two automotive engineering companies under Accursia Capital, 6 locations in Germany and Spain, 250+ employees after the carve-out. Reporting directly to the investor, with overall IT responsibility for both companies.

• Consolidation of the ERP landscape into one instance (replacement of SAP legacy)
• TISAX certification
• M365, identity and data center migration
• Replacement of end-of-life infrastructure
• Weekly investor reporting

Results:

• Critical infrastructure risk eliminated, backup and platform stabilized
• One IT organization established for both companies
• Weekly investor reporting successfully established

• Ran a group-wide steering committee to set strategic direction for a turnaround program. Planned delivery to secure go-to-market and investor milestones
• Prepared the project structure and supplier management process for an ACQ.4 Automotive SPICE audit. Built dry runs and compiled evidence with the team, resulting in a successful CL2 assessment
• Synchronized Automotive SPICE activities with the organization's SAFe rollout by screening base practices and agile artifacts for overlap. Avoided approximately 30% duplicate effort

• Industry: mechanical engineering, vehicle manufacturing
• Regulations: Data Act
• Project focus: data governance, legally compliant use of machine data, data platforms
• Assigned by: CFO, platform product owner

Successes/Results (early phase):

• Compliance support for the setup of an internal standardized data usage platform based on Databricks.
• Created the basis for the legally compliant and effective use of machine data, including:
• Technical: gap analysis and closing of gaps in the segmentation and maintenance of collected machine data.
• Technical: consideration of data flows from the platform to users and third parties.
• Organizational: drafting and finalizing the required data usage agreements.

• Development of a comprehensive transformation model for IT departments and ITSM organizations, from operational stabilization through structuring and optimization to strategic advancement
• Design of a transformation matrix that connects development phases with the implementation activities Position, Focus, Model, Enable, Anchor and Develop
• Development of assessment, maturity and decision-making logic to determine the operational starting point, the appropriate entry point and the prioritized areas of action
• Structuring of an end-to-end approach from current-state assessment and target vision through operating model, roadmap and service modules to implementation and integration into steady-state operations
• Derivation of combinable consulting and implementation modules, including methods, deliverables, role models, governance structures and transformation paths
• Collection, structuring and prioritization of business requirements from the perspectives of IT management, service management and operational roles
• Translation of requirements into target visions, process and role models, decision criteria and traceable deliverables

Environment / Tools: ITIL 4, IT4IT, Operating Model Canvas, SIAM, maturity models Kanban

Responsible for the IT operations of a medium-sized mechanical engineering company (approximately 2 000 employees, annual revenue of approximately 400 million euros worldwide). Direct responsibility for 13 employees. At the same time, project manager for an internal carve-out (commercial and technical separation of the two business units worldwide).

Industry: Mechanical and plant engineering

Function: Director IT

• Responsibility for outsourced IT operations; provider management and service management.
• Responsibility for the complete separation of the two business units (applications, SAP R//3, Active Directory, IT infrastructure, ...); project planning and management; selection and management of service providers.
• TiSAX certification for one business unit; budget planning 2025 ff.
• Establishment and structuring of application operations, including the definition of operating models, SLAs/KPIs, and provider management in the SAP environment.
• Preparation of the operating organization for application operations of S/4 Hana (private cloud).

• Transition strategic business development: product before customer in <4 months instead of 10
• Transition strategic business development: development cost reduction to plan: 40% (-250 k EUR)
• Executive mentor & coach for CEO & CPO: CEO too busy to improve - portfolio, company structure and strategy
• Executive mentor & coach for CEO & CPO: PO→CPO transition to take over full product responsibility for Lohnpulse
• Interim CIO: scouting / onboarding / handover of general contractor service providers to CPO
• Interim CIO: transition from MVP to a fully operable product by the CPO

Full overall responsibility: product, technology, compliance and go-to-market

• Delivered an enterprise MVP in 54 days, exceeding scope and schedule.
• Won a 250k € ARR anchor customer and built a sustainable enterprise sales pipeline in the first quarter.
• Paid PoCs with Zalando (35k €) and tesa (26k €), validating product-market fit with Tier-1 enterprise customers.
• Initiated ISO-27001 and TISAX certification processes. Left when the venture entered its next organizational phase.

Unified ITSM framework

• Definition of a company-wide ITSM target picture
• Introduction of a uniform service structure across all business units

SLA and OLA management

• Building a standardized SLA framework
• Definition of service classes (Business Critical, Standard, Low Priority)
• Introduction of OLAs between internal teams
• Building meaningful SLA reporting
• Definition of KPI and service dashboards for business units

Service portfolio management

• Definition of service descriptions
• If needed, preparing possible cost and service billing

Ticketing & processes

• Incident management
• Uniform ticket categories
• Standardized prioritization
• Escalation matrix
• Automations
• Self-service optimization

Request fulfillment

• Service catalog across all business units
• Approval workflows

Problem management

• Introduction of root cause analysis
• Known error database
• Problem review process

Complete asset management concept

• Hardware lifecycle management
• Software lifecycle management
• Leasing lifecycle
• Mobile device lifecycle
• Monitor lifecycle
• Phone lifecycle

Processes

• Procurement
• Goods receipt
• Inventory
• Assignment
• Return
• Disposal
• Leasing return Goal: single source of truth for all assets

CMDB design

• Definition of all configuration items:
• Workplace
• Notebooks
• Monitors
• Mobile phones
• Printers

Infrastructure

• Servers
• Firewalls
• Switches
• WLAN
• Storage
• Backup systems

Cloud

• Azure resources
• Microsoft 365
• SaaS services

Relationships

• User ↔ Asset
• Asset ↔ Service
• Service ↔ Infrastructure
• Location ↔ Asset
• Goal: make all service dependencies visible

Software asset & license management

• License management concept
• License balancing
• Compliance reporting
• Microsoft license management
• Adobe license management
• SaaS management
• Contract management
• Renewal management

Interfaces & automation Existing systems

• Workday
• Joiner
• Mover
• Leaver

TESMA

• Leasing data
• Contract data

Matrix42

• Asset synchronization
• User synchronization

Active Directory / Entra ID

• User management

Microsoft 365

• License assignment
• Group management

Dormakaba

• Access processes

• Lifecycle services

Monitoring platforms

• PRTG
• Palo Alto
• Cisco

Reporting & KPI framework

• Definition of a management dashboard
• KPIs
• Ticket volume
• SLA fulfillment
• MTTR
• First resolution rate
• Asset accuracy
• License compliance
• Change success rate
• Service availability
• Degree of automation

Network redesign support

• Governance
• Support of the network redesign from an ITSM point of view
• Definition of affected services
• Change management structure
• Communication concept

CMDB integration

• Recording of all network components
• Service mapping
• Dependency analysis

Validation of documentation and knowledge base articles

• Network documentation
• Operations documentation
• Standard changes

Monitoring & event management

• Target picture
• Central monitoring concept
• Event management process
• Alerting strategy
• Escalation model

Systems

• Cisco

• Palo Alto

• Fortinet

• Rubrik

• Veeam

• Matrix42

• Azure

• Microsoft 365 Automation

• Ticket creation from monitoring

• Escalations

• Standard actions

Audit, compliance & information security

• ISO 27001 consulting
• TISAX consulting
• NIS2 preparation - consulting
• Audit-ready processes
• Documentation structure
• Evidence tracking in Matrix42

Roadmap

• 12-month roadmap
• Prioritization of all measures
• Quick wins
• Medium-term projects
• Long-term target picture
• Documentation