10/26/2026 updated
100 % available
Senior Cybersecurity Governance & ISMS-Berater
Frankfurt am Main, Germany
Only remote
Computer Science / Cyber Security ExpertAbout me
Senior Cybersecurity- und ISMS-Berater mit 15 Jahren Erfahrung in regulierten, sicherheitskritischen Bereichen (Finanzen, öffentlicher Sektor, KRITIS). Fokus auf Auditvorbereitung (BSIG §§ 8a(3) / 39), ISMS-/Governance-Weiterentwicklung, regulatorische Umsetzung, DLP und revisionssicheres Reporting.
Six Sigma MethodologyCertified Information Systems Security ProfessionalIT ManagementISO/IEC 20000ISO/IEC 27001IT Service ManagementLife-Critical Systems
Senior Cybersecurity & ISMS Berater mit 15-jähriger Erfahrung in regulierten und sicherheitskritischen Umfeldern, insbesondere in Finanzdienstleistungen, öffentlichem Sektor und KRITIS-Kontexten. Schwerpunkt auf Audit-Vorbereitung nach ISO/IEC 27001, BSI IT-Grundschutz und BSIG §8a (3), Weiterentwicklung von ISMS- und Governance-Strukturen, regulatorischen Umsetzungsmandaten sowie Data Loss Prevention und revisionssicherem Information Security Senior Management Reporting gegenüber Audit und Regulatoren.
Qualifikationen, Kompetenzen und Zertifizierungen:
- 2026: Zusätzliche Prüfverfahrenskompetenz für § 8a (3) BSIG / § 39 BSIG (neu)
- 2025: BSI IT-Grundschutz-Praktiker (BSI IT-GS)
- 2023: BISG-zertifizierter IT-Sachverständiger für Cybersicherheit
- 2018: CISSP (Certified Information Systems Security Professional)
- 2018: MoR Risk Management Practitioner (Intermediate Level)
- 2017: TÜV Datenschutzbeauftragter nach DSGVO und BDSG (neu)
- 2016: ISO/IEC 27001 Auditor in ISMS (Information Security Management Systems)
- 2016: ISO/IEC 27001 Information Security Officer / Informationssicherheitsbeauftragter
- 2016: PRINCE2 Foundation (Projektmanagement)
- 2014: ISO/IEC 20000 Auditor in ITSM (IT Service Management)
- 2014: ISO/IEC 20000 Consultant/Management
- 2014: COBIT 5 Implementer (Enterprise IT Governance)
- 2013: ITIL v3 Expert (IT Service Management)
- 2010: Six Sigma Process Manager (Green Belt)
- 2009: Fachinformatiker Systemintegration (IHK)
Relevante Branchen- und Industrieerfahrung:
- Finanzdienstleistungen (13 Jahre)
- Telekommunikation (3 Jahre)
- Transport & Verkehr (1 Jahr)
- Informationstechnologie (2 Jahre)
- Bildungssektor, lehrend (5 Jahre)
Experience
Professional experience10+ years
Freelancer since2012
Languages
DeutschNative speakerEnglischFluent
Project history
Synopsis:
Auditing and conformity assessment of critical infrastructure and KRITIS IT systems used to provide a critical service in local public transport (ÖPNV).
Interfaces:
Close collaboration with the Executive Board department responsible for Digital Affairs, Information Security and Governance, and the KRITIS IT Coordination team, as well as the relevant product and IT service owners.
Synopsis
External cybersecurity expert assessor for competence and conformity assessments of notified bodies within the framework of the RED Radio Equipment Directive (Radio Equipment Directive) FuAG/RL2014/53/EU.
External cybersecurity expert assessor for competence and conformity assessments of notified bodies within the framework of the RED Radio Equipment Directive (Radio Equipment Directive) FuAG/RL2014/53/EU.
Synopsis
Training of IT specialists in the fields of system integration, digital networking and application development in IT security and data protection, as well as penetration tests. The training is aimed at IT specialists who are
Technology
Kali Linux, Armitage, Metasploit Framework, NMAP, Hashcat etc.
Teaching activities
▪ Fundamentals, drivers, benefits and roles in information security
▪ Fundamentals of information security management systems (ISMS)
▪ Fundamentals of data protection (new BDSG, GDPR) Rights of data subjects,
sensitive personal data, data protection exercises)
▪ National and international cybersecurity frameworks and standards
(ISO/IEC: 27001:2022, BSI IT-Grundschutz Compendium and Building Blocks)
▪ Cybersecurity legislation (IT Security Act, IT-SiG 2.0, BSI-KritisV)
▪ Cybersecurity regulations (BaFin banking supervisory requirements for IT)
▪ Cybersecurity governance and information security risk management
▪ Cybersecurity personal certifications ISACA, ISC², TÜV, DEKRA, EC-Council
▪ Practical exercises in the virtual lab with Kali Linux, Metasploit Framework
and Armitage, network port scans (Nmap), hash cracking (Hashcat)
▪ Expansion of the Metasploit Framework through implementation
of additional payloads using Python modules (exploit libraries)
▪ Leading group work to develop and present
relevant cyber attacks to strengthen ‘cyber awareness’
Training of IT specialists in the fields of system integration, digital networking and application development in IT security and data protection, as well as penetration tests. The training is aimed at IT specialists who are
Technology
Kali Linux, Armitage, Metasploit Framework, NMAP, Hashcat etc.
Teaching activities
▪ Fundamentals, drivers, benefits and roles in information security
▪ Fundamentals of information security management systems (ISMS)
▪ Fundamentals of data protection (new BDSG, GDPR) Rights of data subjects,
sensitive personal data, data protection exercises)
▪ National and international cybersecurity frameworks and standards
(ISO/IEC: 27001:2022, BSI IT-Grundschutz Compendium and Building Blocks)
▪ Cybersecurity legislation (IT Security Act, IT-SiG 2.0, BSI-KritisV)
▪ Cybersecurity regulations (BaFin banking supervisory requirements for IT)
▪ Cybersecurity governance and information security risk management
▪ Cybersecurity personal certifications ISACA, ISC², TÜV, DEKRA, EC-Council
▪ Practical exercises in the virtual lab with Kali Linux, Metasploit Framework
and Armitage, network port scans (Nmap), hash cracking (Hashcat)
▪ Expansion of the Metasploit Framework through implementation
of additional payloads using Python modules (exploit libraries)
▪ Leading group work to develop and present
relevant cyber attacks to strengthen ‘cyber awareness’