VAIT Experts in Germany
in minutes from over 15,000 CVs with the power of AI.Hire experts who know VAIT, BaFin expectations, and insurance IT controls, and who can support governance, risk reviews, and audit-ready documentation. Get fast, precise matching with vetted, available freelancers.
Meet FRATCH Experts in Germany, who have recently used VAIT
Karl-Heinz Reis
Last position:
Support in the further development of a European IT store service organization (15 countries) at European retail company (discount store)
- Capturing the current processes Incident Management, IT Service Request Management, Problem Management, Change Management, Service Configuration Management (including CMDB)
- Carrying out maturity assessments for these processes based on the ITIL® 4 Maturity Model
- Analyzing the different service value streams based on the ITIL® 4 value stream model
- Agreeing maturity levels for the processes being reviewed
- Developing and approving a roadmap to achieve and measure the respective maturity levels
- Presenting the approach, including milestones, to management for approval
- Managing external service providers in 1st level support
Robert Karash
Last position:
Interim Manager | Group Leader in the IT Operations & Digitalization Division "Databases, Operations & Support" (DOS) at Landwirtschaftliche RentenBank
- Technical leadership and further development of a team of 28 IT staff (internal & external) in the areas HelpDesk/HelpLine, RHEL (Red Hat), MUREX (trading system & applications), SAP basis operations
- Managing external service providers (including FI-TS for SAP basis operations)
- Personnel, resource and budget planning for the IT department and projects
- Introducing and establishing regular communication formats (weekly status meetings, team and cross-department meetings)
- Ensuring application operations in a hybrid environment (Windows/Linux with database and web/application servers)
- Supporting transformation projects to modernize the application landscape (e.g. DevOps approaches)
- Setting up and implementing a digital IT procurement for hardware & software (e.g. with DELL)
- Developing and managing the "IT Operations DOS" department based on corporate strategy
- Preparing management reports & decision papers on IT projects, optimization potential and automation opportunities
- Representing the department in the advisory boards of the Rentenbank and ensuring regulatory compliance (BaFin §44, GDPR, BSI, MaRisk)
Halil Oeztoprak
Last position:
Senior Cloud Operations & DevSecOps Engineer (Azure / Terraform / CI-CD) at KfW Bankengruppe
Regulated environment within a German banking group (approx. 8,500 employees, hybrid cloud strategy).
Responsible for operating, provisioning, and continuously securing business-critical platforms – including a GenAI chat application, a big data/AI platform, and data science workspaces based on Azure Virtual Desktops and VMs. Ownership of Azure DevOps projects for ShaiHulud and React2Shell, as well as BSI alerts – Security Operations improvements across the SDLC.
Deployment responsibility for the GenAI chat application, big data/AI platform (BDAI), and data science workspaces (AVD/VM-based) in the respective landing zones.
Deployment & release management: end-to-end responsibility for deploying portal and service applications across multiple Azure landing zones, including technical approvals, compliance with development team deployment guidelines, and ensuring ITIL-based change and release processes via ServiceNow.
Azure landing zones & network architecture: design, provisioning, and operation of Azure landing zones for 3-tier web applications with enhanced network segmentation, VNet peering, hub-and-spoke architectures, private endpoints, and firewall integration across separate subscriptions and tenants.
Azure DevOps governance & operations: ownership of the Azure DevOps organization, including projects, repositories, and CI/CD pipelines; implementation of governance requirements such as branch policies, approval gates, permission models, and audit-ready operating structures.
Infrastructure as Code (Terraform): design, implementation, and operation of a modular Terraform architecture for standardized cloud infrastructure deployment, including state management, provider versioning, reusability, and policy-as-code approaches.
CI/CD pipeline engineering: design, operation, and optimization of complex YAML-based CI/CD pipelines with multi-stage deployments, template standardization, self-hosted agents, integrated secret management, and automated quality and security checks.
Git migration & platform consolidation: planning and execution of repository and pipeline migration from Azure DevOps to GitLab CI/CD, including automated scripts, full Git history transfer, pipeline porting, and platform consolidation.
Container & platform operations (AKS): operation and security assessment of containerized workloads on Azure Kubernetes Service, centralization of on-premises container registries for ACR.
OpenShift (OCP) security reviews: security assessment of code baselines, build pipelines, and deployment processes for on-premises OpenShift clusters with critical applications, and derivation of specific hardening recommendations.
Shift-left security & DevSecOps transformation: introduction of a company-wide shift-left approach for early security integration in development and deployment processes, enabling developers to perform self-led security checks and sustainably reduce vulnerabilities before production (IDE integrations, pre-commit hooks, local scanners).
Software supply chain security: analysis and mitigation of supply chain risks in NPM- and Yarn-based applications through dependency audits, CI/CD pipeline hardening, token rotation, and restriction of risky build and lifecycle mechanisms.
Frontend & framework security (React / Next.js): security assessment and coordination of critical vulnerability remediation across platform applications and web frameworks, including coordination and complementary technical mitigations with all teams following BSI alerts.
Software composition analysis (SCA): introduction and operation of automated vulnerability scans for container images, pipelines/artifacts, and third-party dependencies, including SBOM exports within CI/CD pipelines.
SAST/DAST integration: design and piloting of static and dynamic application security tests in close collaboration with security architecture and development teams, for continuous improvement of code and runtime security, and establishing operational acceptance tests.
Artifact & registry consolidation: analysis and consolidation of all package and container repositories for service applications and AKS workloads, aiming for a centralized, secured registry strategy with centralized vulnerability scanning and governance.
Dependency-Track & SBOM strategy: advising the compliance board on introducing a central SBOM and vulnerability management platform to increase enterprise-wide dependency transparency and accelerate CVE response capability.
CI/CD pipeline hardening: security analysis and cleanup of the existing pipeline landscape by removing unused pipelines, improving secrets hygiene, implementing least-privilege principles, and isolating build agent environments.
Azure Web Application Firewall (WAF) optimization: analysis and tuning of existing Azure WAF rules (OWASP Top 10 Core Rule Set, DSR/SDC, custom rules) to defend against known vulnerabilities and exploit patterns, including reducing false positives and improving threat detection.
Documentation & stakeholder communication: creating and maintaining technical documentation, runbooks, and architecture overviews in Jira and Confluence, as well as active knowledge transfer between operations, development, security, and compliance stakeholders.
Peter Konrad
Last position:
IT Audit Expert at Sparkasse
Support for Internal Audit:
Conducting an audit of the data protection officer and data protection management:
- Preparing an audit program based on the audit field concept
- Requesting the necessary audit documentation
- Carrying out control testing based on the audit program with the following focus:
- Reviewing the relevant PPS processes
- Reviewing the data protection mission statement, data protection policy, and data protection management concept
- Conducting audit interviews with the data protection officer
- Preparing the audit documentation
- Training a junior auditor in the methodology of Internal Audit
- Coordinating the audit documentation with the head of audit
Michael Schwendemann
Last position:
Compliance/TPRM setup at Haftpflichtkasse
Compliance department setup & DORA operationalization
- Setup of a complete compliance organization according to DORA
- Development and operationalization of SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, news feeds)
- Setup of a decentralized risk and action register
- Creation of gap analyses and derivation of actions
- Setup and maintenance of the outsourcing information register
- Use of own TPRM frameworks, checklists and process models
Compliance department setup & DORA operationalization
- Setup of a complete compliance organization according to DORA
- Development and operationalization of SfO
- Use of AI agents for automation:
- Evaluation of due diligence questionnaires including risk classification
- AI-supported contract analysis (DORA/MaRisk compliance)
- Monitoring of external data sources (cyber incidents, news feeds)
- Setup of a decentralized risk and action register
- Creation of gap analyses and derivation of actions
- Setup and maintenance of the outsourcing information register
- Use of own TPRM frameworks, checklists and process models
- Project controlling - presentation and structured measurement of achieved project goals within management reporting.
Frank Dostert
Last position:
Project Manager at TEAG Thüringer Energie AG
- Transition of Microsoft Azure operations to BTC AG
- Responsibility: budget of €60k
- Staff: leadership of 5 people
- Tools: Office 365, JIRA, Confluence
Matthias Kühnlein
Last position:
Business Owner at AKM
Management of several MFA methods for central authentication within a group company. Interface between different stakeholders such as support, finance and accounting, developers, and security departments. Budget controlling and monitoring of KPIs as well as SLAs. Review of operating documentation
Matthias Ottowski
Last position:
IT Project Manager at IT service provider
Implementation of anti-money laundering requirements in accordance with AMLA/KYC for an international large bank in Munich
Services provided:
- Clarification of the assignment, definition of the work package structure for the AMLA/KYC implementation project
- AI-supported project planning using my own AI workflow for project management
- Creation of the project management plan
- Resource and capacity planning
- Development of collaboration structures between IT service provider and bank client
- Alignment of responsibilities (RACI matrix)
- Management of 5 project members (core team)
- Project control, project monitoring, project reporting
- Communication management
- Escalation management
- Stakeholder management (11 stakeholders)
- Permanent member of the steering committee
- Project representation internally and externally
- Project reporting, management of decision-making bodies
- Project volume: 506 person-days (development effort)
- Risk management
- Quality management
- Organization and running of workshops
Methods: PMI PMBOK, EVM, GWG, DORA, BAIT, KANBAN, AML, AMLR, AMLA, GWG, KYC
IT environment: JIRA, Confluence, Sharepoint, Kantata Kimble, AI LLM Copilot, ChatGPT, anti-money laundering systems (in-house developments and SMARAGD)
Jochen Gögel
Last position:
Senior Specialist Software Compliance at Inter Versicherung
- Designing processes for implementing regulatory IT requirements (VAIT, BAIT, DORA, MaGo) and establishing them within the IT organization
- Monitoring the execution of these processes, quality assurance and adaptation to new requirements
- Support and coordination of the annual audit regarding regulatory IT requirements (PwC)
- ITK governance
- Software lifecycle management
- Documentation and control of the IDV development process
- Process support and policy creation when setting up test management with regard to DORA and VAIT
- Policy creation for IAM processes
- Tools/Applications: ServiceNow, Confluence, Jira, M365, Loop, Connect, Omada
Federico Leefhelm
Last position:
Senior IAM Manager & Single Point of Contact for Information Security at EnBW Energie Baden-Württemberg AG
As the only large integrated energy company in Germany, EnBW covers the entire value chain - from energy production through distribution to customers. It expands its renewable energy sources, advocates for a socially responsible coal exit, and drives key technologies like green hydrogen. A rapid energy transition and achieving climate neutrality by 2035 are priorities for EnBW. Developed and implemented a holistic process view covering both technical and organizational aspects Ensured end-to-end control of all IAM-related technical services Established clear responsibilities and accountabilities within the IAM landscape Collaborated with different departments to identify and optimize a holistic architecture and act as Single Point of Contact (SPoC) for Information Security Introduced and monitored governance policies to ensure compliance and security Continuously improved IAM processes and systems through regular audits and evaluations Participated in external audits of the process as part of official ISO audits Further developed the policy for setting administrative requirements and procedures and aligned it with administrative units Conceptually advanced the KPI system to measure process quality
Kai Saathoff
Last position:
Senior Manager Regulatory Changes and Digitalization at Consulting Firm
- Responsible for business development, sales, partnerships, and marketing
- Project management and business analysis for regulatory and strategic projects
- Test management
- Expert in digitalization strategies
- Expert in new EU regulations and legislative changes
- Expert in client-related projects
- Implementations in asset management and in the banking sector
Arnd Furken
Last position:
Senior Manager at Gehrke Maas Consulting
Markus Marschollek
Last position:
Project Manager / Senior Consultant (multiple projects) at gkv informatik
- Project manager controlling the update to ISO 27001:2022 (certification from ISO 27002:2013 to ISO 27002:2022) including gap analysis, project planning, preparation of internal and external audits, and creation and maintenance of required documentation.
- Coordination of adjusting existing measures and implementing new measures according to the new standard’s requirements, as well as continuous monitoring and adjustment of these measures.
- Regular reporting to management on progress and risks.
- Senior consultant supporting audit reviews with a focus on critical infrastructures (KRITIS), including resolving findings, creating and updating evidence documents, and amending provider contracts.
- Senior consultant reviewing all deliverables and responsibilities of the IT provider according to the existing contract: identification of over 1500 deliverables & obligations (D&O), setup of a D&O tracker (claim register), and joint expert review with service owners for various service descriptions (e.g. IT service management, workplace and print services, application and desktop services, endpoint management, email including archiving, file services, software packaging, certification, distribution).
- Senior consultant adjusting service scopes in existing service descriptions to enable end-to-end service responsibility of the provider, including identification and analysis of use cases, process analysis and optimization (incident, problem, change), as well as recording and documenting all software products in LeanIX and documenting the contract change.
- Focused services: managed software service, application and desktop service, workplace and print services, web server service, container service, M365, SAP/Oscare, output management systems (OMS), telephony and omnichannel management service.
- Project manager steering a benchmark based on the existing IT contract, including coordination of the entire benchmark process between the benchmarker, IT provider and client, review of benchmark results, and preparation and conduct of price negotiations with the IT provider.
Jens Brennscheidt
Last position:
Senior Cyber Security Consultant at Brennscheidt IT Consulting
ISMS consulting
Interim management
Conducting security analyses & audits
BCM consulting
Executive management
Dennis Schelberg
Last position:
Third Party Risk Management at Ergo Group
- Processing entries in the Third Party Risk Management (TPRM) process
- Conducting clean-ups of existing business relationships
- Creating, processing, and documenting requests
- Reviewing entries from process participants based on existing files
- Collaborating with risk SMEs (Subject Matter Experts) and vendor contacts
- Working closely with procurement, information security, and data protection to align business requirements
- Implementing regulatory requirements (VAIT, DORA) and ensuring compliance and risk management
Discover over 15,000 top freelancers
Statistics of experts using VAIT
Aggregated from the professional profiles of matched freelancers.
Experience
25 years
Position duration
2.7 years
Positions per freelancer
17
Top business areas
Information Technology, Project Management, Operations
Top industries
Information Technology, Banking and Finance, Insurance
Certification focus areas
Information Technology, Project Management, Audit
Bachelor's degree or higher
82%
Master's degree or higher
46%
Doctorate
14%
Certifications per freelancer
7
Most common languages
German, English, French
Speak two or more languages
96%
Based on our profile pool as of 30 Aug 2026.
Daily rate distribution
The chart shows how the daily rates of freelancers in this technology in Germany are distributed, based on recent contracts on our platform. Each bar covers a rate range — its height shows how many freelancers charge within that range.
Average rates of experts in Germany using VAIT
Rates are based on recent contracts and do not include FRATCH margin.
The average daily rate is the mean of all daily rates from recent contracts of comparable freelancers on our platform.
The median daily rate is the middle value of all daily rates — half of comparable freelancers charge less, half charge more. Unlike the average, it is barely affected by outliers.
Calculated based on our freelancers’ daily rates as of 30 Aug 2026. Actual rates may vary depending on seniority level, experience, skill specialization, project complexity, and engagement length.
About the technology
What VAIT covers
VAIT stands for Versicherungsaufsichtliche Anforderungen an die IT. It sets expectations for how insurers in Germany manage IT governance, access control, outsourcing, incident handling, and documentation. Companies bring in VAIT specialists when they need clear controls that can stand up to internal review and BaFin scrutiny.
Typical VAIT work
- Review IT policies, roles, and responsibilities
- Map controls to VAIT requirements
- Support outsourcing and third-party governance
- Prepare evidence for audits and supervisory questions
- Close gaps in security and change processes
Ecosystem and standards
VAIT work often sits next to MaGo, BAIT, DORA, ISO 27001, and internal risk frameworks. Strong professionals understand how IT, compliance, security, and vendor management connect in an insurer’s operating model. They know how to turn regulatory wording into practical controls and repeatable evidence.
When freelancers help
Freelance VAIT experts are useful for assessments, remediation programs, policy updates, and audit preparation. In Germany, they also help with local language documentation and workshops when teams need to align IT, compliance, and business owners. Companies often need targeted support without building a permanent regulatory team.
What strong experts do
Strong VAIT professionals do not just quote requirements. They trace each control to a real process, find missing ownership, and explain what evidence is needed. They can work across architecture, security, sourcing, and operations without losing the regulatory thread.
How companies use it
VAIT usually matters in insurer IT landscapes with core policy systems, customer portals, and outsourced services. Specialists help when new suppliers are onboarded, major changes are introduced, or control gaps appear in a review. The best experts keep remediation practical and aligned with day-to-day operations.
Frequently asked questions
Before you brief your next project: the most common questions about VAIT.
VAIT is the German supervisory framework for IT in insurance companies. It helps insurers define governance, security, outsourcing, and documentation controls that support compliant operations and supervisory readiness. In practice, it is used to shape policies, control testing, and evidence collection.
VAIT is focused on insurers, while BAIT is aimed at banks and DORA is the wider EU framework for digital operational resilience. A good specialist knows where the frameworks overlap and where insurer-specific expectations still apply. That matters when a company runs mixed financial services environments.
A VAIT specialist can review control frameworks, support remediation plans, assess outsourcing, and prepare audit evidence. Many also help with policy updates, risk assessments, and workshops for IT and compliance teams. The best work is concrete and tied to real processes, not just document review.
The strongest VAIT experts usually bring security governance, risk management, outsourcing oversight, and audit preparation skills. Familiarity with internal control systems, insurer operations, and German regulatory language is also valuable. That mix helps them translate requirements into action.
A VAIT freelancer can be productive quickly if the scope is clear: assessment, remediation, policy work, or audit support. For larger change programs, they need access to architecture, risk, and process owners early. The more complex the outsourcing landscape, the more context they need.
Yes, much of the VAIT work can be done remotely if the expert can work in the required language and handle sensitive documentation securely. For workshops, stakeholder interviews, or final alignment, on-site time in Germany can still help. Hybrid collaboration is common in practice.
A strong VAIT expert can point to exact gaps, explain why they matter, and show how to close them with realistic controls. Look for clear mapping between requirements, evidence, and ownership, not vague compliance language. Experience with insurers and supervisory review is a good sign.
Freelancers usually ask whether the scope is assessment, remediation, or ongoing support, and who owns the final decisions. For VAIT work, they also want to know what systems, vendors, and documents are in scope. Clear access to stakeholders and evidence makes the assignment much smoother.
The average hourly rate of freelancers in Germany who have used VAIT in their recent projects is 117 €, which corresponds to a daily rate of about 940 € based on an 8-hour working day.
Of the freelancers in Germany who have used VAIT in their recent projects, 82% hold at least a Bachelor's degree, 46% hold at least a Master's degree, and 14% hold a doctorate.
On average, freelancers in Germany who have used VAIT in their recent projects have 25 years of professional experience, with a single engagement typically lasting around 2.7 years.
The most common languages among freelancers in Germany who have used VAIT in their recent projects are German (100%), English (96%), and French (20%).
The most common industries among freelancers in Germany who have used VAIT in their recent projects are Information Technology (85%), Banking and Finance (74%), and Insurance (65%).
The most common business areas among freelancers in Germany who have used VAIT in their recent projects are Information Technology (96%), Project Management (85%), and Operations (72%).
Main locations of FRATCH Experts, who have recently used VAIT
Our freelancers and interim experts are at home across the DACH region — available on-site in the major business hubs or fully remote. Choose a location to discover matched specialists, local market insights and up-to-date availability.
Berlin Hamburg Munich Cologne Frankfurt Stuttgart Dusseldorf Leipzig Dortmund Essen Bremen Dresden Hanover Nuremberg 
Cologne 
Dusseldorf Request a free demo
Get in touch with the FRATCH team and we will get back to you within 4 hours.
Would you rather directly get in touch?
We always have the time for a call or email!
Philipp Thomaschewski
FRATCH CEO
