21.10.2026 aktualisiert
100 % verfügbar
Information Security Expert | ISO 27001 | GRC |Application Security | SOC | BSI C5 | NIS 2
Munich, Deutschland
Weltweit
Computer EngineerÜber mich
Information Security expert helping organizations build secure, compliant, and resilient systems. Skilled in ISO27001, AppSec, and Cloud Security , SIEM. Trusted advisor with 20+ years of hands-on experience.
Skills
Code-ReviewInformationssicherheitSicherheitskontrollenVulnerability ManagementInformationssicherheits-ManagementsystemSoftware SecuritySicherheitsbestimmungen
Information Security Governance
Enterprise-wide security governance frameworks, policies, standards and control frameworks aligned with business objectives. Risk frameworks and KPI dashboarding for executive and Board-level reporting. Experience building security functions from scratch and maturing established programmes.
Product Security Engineering
Secure-by-design principles, threat modeling, security architecture reviews and secure code review practices. SAST/DAST/SCA automation integrated into CI/CD pipelines. Secure software development lifecycle implementation and governance.
Compliance Frameworks
ISO 27001:2022 implementation and certification. CRA (Cyber Resilience Act EU 2024/2847) compliance strategy and governance. BSI C5 certification delivery. Banking regulatory compliance. GDPR and data privacy implementation. PCI DSS certification and compliance.
AI Security Governance
LLM security risks, data integrity, adversarial threat mitigation and model assurance. EU AI Act-aligned governance and controls. Security assessment frameworks for AI model development, testing and validation.
Cloud Security
Azure, AWS and Kubernetes security controls. Network segmentation, encryption and threat detection. Secure CI/CD pipeline architecture and container security.
SIEM & SOC Operations
Built enterprise 24/7 SOC operations. Experience with RSA NetWitness, McAfee ESM, ArcSight. Continuous monitoring, threat detection and incident alerting frameworks.
Vulnerability Management
Tenable Nessus and PrismaCloud expertise. Scanning policies, remediation tracking and reporting. Penetration testing coordination and vulnerability disclosure frameworks.
Threat Modeling & Risk Assessment
Threat modeling across product portfolios. Risk assessment methodologies and enterprise risk registers. Technical risk translation to business-aligned metrics.
Incident Response
Incident response frameworks and playbooks. Post-incident analysis and preventive measures implementation.
Third-Party & Vendor Risk Management
Third-party security assessments and vendor management programmes. Security questionnaires and compliance verification.
Data Loss Prevention & Data Security
DLP infrastructure deployment across endpoints, email and cloud systems. Data classification policies, monitoring and enforcement. Encryption frameworks for data at rest and in transit.
Team Leadership & Security Advisory
Executive-level communication and risk translation. Security posture reporting to Board and leadership. Cyber risk and resilience strategy guidance.
Built and led security teams from zero in startups and mature organisations. Performance management, talent development and cross-functional security coordination.
Organisational Experience
Proven experience building security programmes from scratch in startup environments. Matured and scaled security functions in established enterprises. Hands-on security delivery with strategic governance oversight.
Erfahrung
Berufserfahrungmehr als 10 Jahre
Freelancer seit2026
Sprachen
DeutschgutEnglischMuttersprache
Projekthistorie
- Developed and implemented a Security Framework to ensure high security standards
- Created and enforced security policies and controls (MDR, ISO 27001, BSI C5)
- Managed and conducted internal and external audits to ensure compliance
- Integrated security into software development processes to mitigate risks
- Established and led a Security Awareness Program for employees
- Advised and collaborated with key stakeholders (Board Members, General Managers, Vice Presidents)
- Conducted market research to identify potential MSSP target industries
- Defined and implemented Managed Security Service offerings
- Developed a Target Operating Model, covering SLAs, BCP strategies, and service level targets
- Analyzed and optimized Governance, Risk & Compliance (GRC) processes
- Established and implemented an Application Security Program in DevOps
- Developed and introduced Application Security policies, standards, and guidelines
- Integrated security measures into the CI/CD process
- Conducted vulnerability assessments and security evaluations for software projects