VAIT Experts in Germany
, matched with vetted and available freelancers in minutesHire experts who assess IT governance, document information security controls and prepare evidence for BaFin-focused audits under VAIT. FRATCH connects you with precisely matched, vetted and available freelancers quickly.
Meet FRATCH Experts in Germany, who have recently used VAIT
Matthias K.
Last position:
Business Owner at AKM
Management of several MFA methods for centralized authentication within a group. Interface between various stakeholders such as support, financial accounting, developers, and security departments. Assessment of compliance requirements such as KRITIS. Budget controlling and monitoring of KPIs and SLAs. Support with internal and external audits on MFA and with connecting new systems. Review of operational documentation. Participation in steering committees and leadership of service review meetings and decision-making committees.
Tools/Frameworks: FIDO, YubiKey, Veridium, BSI IT-Grundschutz, NIST
Jens B.
Last position:
Senior Cyber Security Consultant at Brennscheidt IT Consulting
KEY PROJECTS
Since 05/2023 | Bank | Senior Cyber Security Consultant (external)
- Advising and guiding the system owners in creating and further developing IT security concepts
- Coordinating and tracking the remediation of findings from reviews and audits
- Advising on the implementation of regulatory requirements for information security
10/2023 – 02/2024 | Fintech | Project Manager (external)
- Project management to close various audit gaps in the field of information security
- Conceptual design and implementation of an information security management system based on ISO/IEC 27001
- Creation and further development of ISMS documents and processes
Karl-Heinz R.
Last position:
Supporting the further development of a European IT branch service organization (15 countries) at European retail company (discount retailer)
- Documenting the current Incident Management, IT Service Request Management, Problem Management, Change Management and Service Configuration Management processes (including CMDB)
- Conducting maturity assessments for these processes based on the ITIL® 4 Maturity Model
- Analyzing the various service value streams based on the ITIL® 4 value stream model
- Agreeing on maturity levels for the assessed processes
- Developing and approving a roadmap to achieve and measure the respective maturity levels
- Presenting the approach, including milestones, to management for approval
- Managing external service providers in 1st Level Support
Robert K.
Last position:
Interim Manager | Group Leader in the IT Operations & Digitalization Division "Databases, Operations & Support" (DOS) at Landwirtschaftliche RentenBank
- Technical leadership and further development of a team of 28 IT staff (internal & external) in the areas HelpDesk/HelpLine, RHEL (Red Hat), MUREX (trading system & applications), SAP basis operations
- Managing external service providers (including FI-TS for SAP basis operations)
- Personnel, resource and budget planning for the IT department and projects
- Introducing and establishing regular communication formats (weekly status meetings, team and cross-department meetings)
- Ensuring application operations in a hybrid environment (Windows/Linux with database and web/application servers)
- Supporting transformation projects to modernize the application landscape (e.g. DevOps approaches)
- Setting up and implementing a digital IT procurement for hardware & software (e.g. with DELL)
- Developing and managing the "IT Operations DOS" department based on corporate strategy
- Preparing management reports & decision papers on IT projects, optimization potential and automation opportunities
- Representing the department in the advisory boards of the Rentenbank and ensuring regulatory compliance (BaFin §44, GDPR, BSI, MaRisk)
Peter K.
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Frank D.
Last position:
Project Manager at TEAG Thüringer Energie AG
- Transition of Microsoft Azure operations to BTC AG
- Responsibility: budget of €60k
- Staff: leadership of 5 people
- Tools: Office 365, JIRA, Confluence
Pierre G.
Last position:
Ansible Automation, Windows Third Level Support at DB InfraGO AG
- PRISMA project
- Ansible automation
- Windows third-level support for Windows NT, Windows 2000, Windows 2013, Windows 2016, Windows 2019
Matthias O.
Last position:
IT Project Manager at IT service provider
Implementation of anti-money laundering requirements in accordance with AMLA/KYC for an international large bank in Munich
Services provided:
- Clarification of the assignment, definition of the work package structure for the AMLA/KYC implementation project
- AI-supported project planning using my own AI workflow for project management
- Creation of the project management plan
- Resource and capacity planning
- Development of collaboration structures between IT service provider and bank client
- Alignment of responsibilities (RACI matrix)
- Management of 5 project members (core team)
- Project control, project monitoring, project reporting
- Communication management
- Escalation management
- Stakeholder management (11 stakeholders)
- Permanent member of the steering committee
- Project representation internally and externally
- Project reporting, management of decision-making bodies
- Project volume: 506 person-days (development effort)
- Risk management
- Quality management
- Organization and running of workshops
Methods: PMI PMBOK, EVM, GWG, DORA, BAIT, KANBAN, AML, AMLR, AMLA, GWG, KYC
IT environment: JIRA, Confluence, Sharepoint, Kantata Kimble, AI LLM Copilot, ChatGPT, anti-money laundering systems (in-house developments and SMARAGD)
Jochen G.
Last position:
Senior Specialist Software Compliance at Inter Versicherung
- Designing processes for implementing regulatory IT requirements (VAIT, BAIT, DORA, MaGo) and establishing them within the IT organization
- Monitoring the execution of these processes, quality assurance and adaptation to new requirements
- Support and coordination of the annual audit regarding regulatory IT requirements (PwC)
- ITK governance
- Software lifecycle management
- Documentation and control of the IDV development process
- Process support and policy creation when setting up test management with regard to DORA and VAIT
- Policy creation for IAM processes
- Tools/Applications: ServiceNow, Confluence, Jira, M365, Loop, Connect, Omada
Natascha K.
Last position:
Business Analyst DORA and System Architecture at PSVaG
- DORA consulting and system optimization
- Process analysis of existing business processes that are complex from both a business and technical point of view
- Analysis of the individual business processes in the relevant business areas Trading, Back Office, Settlement, Custodian Bank
- Interface between the business units and IT to understand and define requirements
- Creation of a business concept incl. adjustments and implementation of software applications and their interfaces to the systems
- Preparation of a decision template for the management board for project approval
- Setting up and running project meetings with the relevant stakeholders and documenting them
- Close collaboration with the stakeholders
- Coordination and control of the analysis
- Creation and planning of resources and budget
- Onboarding of large banks (Asia and Eastern Europe) for Depot B
- Migration of portfolio holdings (volume around EUR 70-100 million)
Halil O.
Last position:
Senior Cloud Operations & DevSecOps Engineer (Azure / Terraform / CI-CD) at KfW Bankengruppe
Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).
Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.
Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.
Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.
Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.
Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.
Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.
CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.
Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.
Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.
OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.
Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).
Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.
Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.
Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.
SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.
Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.
Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.
CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.
Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.
Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.
Michael S.
Last position:
Compliance/TPRM setup at Haftpflichtkasse
Compliance department setup & DORA operationalization
- Setup of a complete compliance organization according to DORA
- Development and operationalization of SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, news feeds)
- Setup of a decentralized risk and action register
- Creation of gap analyses and derivation of actions
- Setup and maintenance of the outsourcing information register
- Use of own TPRM frameworks, checklists and process models
Compliance department setup & DORA operationalization
- Setup of a complete compliance organization according to DORA
- Development and operationalization of SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, news feeds)
- Setup of a decentralized risk and action register
- Creation of gap analyses and derivation of actions
- Setup and maintenance of the outsourcing information register
- Use of own TPRM frameworks, checklists and process models
- Project controlling - presentation and structured measurement of achieved project goals within management reporting.
Stephan B.
Last position:
Freelance Data Scientist at Baier Data & AI Consulting
Federico L.
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developed and implemented a holistic process view covering both technical and organizational aspects Ensured end-to-end control of all IAM-related technical services Established clear responsibilities and accountabilities within the IAM landscape Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security Introduced and monitored governance policies to ensure compliance and security Continuously improved IAM processes and systems through regular audits and evaluations Participated in external audits of the process as part of official ISO audits Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units Conceptually advanced the KPI system to measure process quality
Kai S.
Last position:
Senior Manager Regulatory Changes and Digitalization at Consulting Firm
- Responsible for business development, sales, partnerships, and marketing
- Project management and business analysis for regulatory and strategic projects
- Test management
- Expert in digitalization strategies
- Expert in new EU regulations and legislative changes
- Expert in client-related projects
- Implementations in asset management and in the banking sector
Discover over 15,000 top freelancers
Statistics of experts using VAIT
Aggregated from the professional profiles of matched freelancers.
Experience
25 years
Position duration
2.7 years
Positions per freelancer
18
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Banking and Finance, Insurance
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
83%
Master's degree or higher
45%
Doctorate
10%
Certifications per freelancer
7
Most common languages
German, English, French
Speak two or more languages
98%
Based on our profile pool as of 19 Sep 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Germany using VAIT
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 19 Sep 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
VAIT experts industry focus
See which industries our matched freelancers work in most often — every figure is calculated live from the freelancers on FRATCH.
- Information Technology (85%)
- Banking and Finance (74%)
- Insurance (67%)
- Professional Services (63%)
- Manufacturing (46%)
- Automotive (37%)
- Government and Administration (37%)
- Transportation (33%)
Please note that freelancers can work across multiple industries, so percentages overlap.
About the technology
What VAIT covers
VAIT means Versicherungsaufsichtliche Anforderungen an die IT. The framework sets expectations for IT governance, information security, risk management and operational resilience at insurance companies and groups supervised in Germany. It translates supervisory principles into practical requirements for accountable processes, controls and evidence.
Core governance areas
VAIT work connects business responsibility with technology oversight. Specialists examine how an organisation manages IT strategy, information security, access rights, outsourcing, continuity and incident response. They also clarify roles between management, internal control functions, IT operations and external service providers.
- IT strategy and governance
- Information security management
- IT risk and control frameworks
- Outsourcing and third-party oversight
Typical deliverables
Companies use VAIT expertise to create or improve policies, control catalogues, risk assessments and audit trails. Projects may also produce target operating models, gap analyses, remediation plans, continuity documentation and evidence packs for internal or supervisory reviews. Clear ownership and traceable decisions are central to every deliverable.
When external expertise helps
Freelance specialists are useful when an insurer is preparing for an audit, integrating an acquired business or replacing fragmented IT controls. They can support a new information security programme, review cloud or outsourcing arrangements and turn findings into an ordered remediation backlog. Germany-based teams may also value German-language documentation and on-site workshops.
- Preparing for a supervisory or internal audit
- Assessing VAIT gaps across applications and infrastructure
- Improving controls after an incident or audit finding
- Establishing evidence and reporting routines
Relevant ecosystem and skills
Strong VAIT professionals understand more than policy writing. They combine insurance operations with information security, IT service management, enterprise risk, data protection and audit practice. Useful working knowledge can include ISO 27001, BSI guidance, COBIT, ITIL, cloud governance, identity management, vulnerability management and business continuity.
What strong professionals bring
The best specialists connect regulatory wording to verifiable technical and organisational practice. They distinguish a documented control from a control that actually operates, test evidence without disrupting critical services and explain weaknesses to both executive stakeholders and technical teams. For remote work, disciplined documentation and structured workshops matter; on-site access can help with interviews and process validation.
Frequently asked questions
Before you brief your next project: the most common questions about VAIT.
VAIT is the German supervisory framework for IT at insurance companies and groups. It guides governance, information security, IT risk management, outsourcing controls and operational resilience. Companies use it to assess their control environment and prepare reliable evidence for reviews.
VAIT is tailored to insurance supervision and focuses on the responsibilities and controls expected in that regulated environment. ISO 27001 provides a broader information security management system standard that can support VAIT compliance but does not replace insurance-specific supervisory interpretation. A specialist should map the two rather than treat them as interchangeable.
A strong VAIT specialist often brings experience in information security, IT risk, internal audit and business continuity. Knowledge of ISO 27001, BSI guidance, COBIT, ITIL, cloud controls, identity management and outsourcing oversight is valuable. Insurance processes and data protection knowledge add important context.
The right level depends on the assignment. A focused policy review may need a specialist who can assess a defined control area, while a broad remediation programme requires someone who can coordinate governance, technology teams and executive stakeholders. Ask for comparable deliverables and evidence of work in regulated insurance environments rather than relying on a generic experience claim.
VAIT projects can often be delivered remotely through structured interviews, evidence reviews and secure collaboration tools. On-site sessions may still help with process walkthroughs, stakeholder workshops or restricted documentation. Agree early on access rules, data handling, working language and availability for audit meetings.
Ask the VAIT professional to explain how they turn a requirement into an accountable control, test procedure and evidence trail. Strong answers connect policies with real processes, systems and owners. Review the clarity of sample deliverables, their approach to open findings and how they communicate risk to non-technical decision-makers.
VAIT also matters when important IT services are provided by external suppliers or cloud services. The insurer remains responsible for oversight, risk assessment, contractual safeguards, monitoring and exit planning. A suitable specialist should therefore review supplier governance as well as internal systems.
Before a VAIT engagement, clarify the organisation's regulatory scope, audit objective, control framework, available evidence and decision owners. Freelancers should expect sensitive information, formal documentation standards and cooperation across security, risk, compliance and IT operations. Clear access procedures and a defined remediation process make the work more effective.
The average hourly rate of freelancers in Germany who have used VAIT in their recent projects is 117 €, which corresponds to a daily rate of about 940 € based on an 8-hour working day.
Of the freelancers in Germany who have used VAIT in their recent projects, 83% hold at least a Bachelor's degree, 45% hold at least a Master's degree, and 10% hold a doctorate.
On average, freelancers in Germany who have used VAIT in their recent projects have 25 years of professional experience, with a single engagement typically lasting around 2.7 years.
The most common languages among freelancers in Germany who have used VAIT in their recent projects are German (100%), English (98%), and French (20%).
The most common industries among freelancers in Germany who have used VAIT in their recent projects are Information Technology (85%), Banking and Finance (74%), and Insurance (67%).
The most common business areas among freelancers in Germany who have used VAIT in their recent projects are Information Technology (96%), Project Management (85%), and Operations (72%).
Main locations of FRATCH Experts, who have recently used VAIT
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Cologne 
Dusseldorf Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
