05/06/2026 updated

**** ******** ****
Premium member
partially available

Cybersecurity- and Data-Privacy Audit, GRC, IT Architecture

Tallinn, Estonia
Germany +11
info: Germany, Austria, Switzerland, United Kingdom, Italy, France, Belgium, Denmark, Finland, Luxembourg, Netherlands, Sweden
Mathematics and Computer science
Tallinn, Estonia
Germany +11
info: Germany, Austria, Switzerland, United Kingdom, Italy, France, Belgium, Denmark, Finland, Luxembourg, Netherlands, Sweden
Mathematics and Computer science

Profile attachments

20251215-CV-AuditComplianceRisk-JM-EN.docx
20251215 CV_AuditComplianceRisk_JM_DE.docx
20260330 PM-CV_JM_DE.docx
20260330 PM-CV_JM_EN.docx

About me

Highly certified and multilingual IT security leader in Regulatory Compliance, Risk Mgmt, IT Governance - working across Europe: • IT Governance & Compliance. • Cybersecurity & Data Protection. • (Third-Party) Risk Assessments. • Project & Programme Mgmt. • Multicultural stakeholder management.

AuditingComplianceInformation Technology Infrastructure Libraries (ITIL)IT ManagementIT Service ManagementScrum Methodology
Profile
Experienced Information Security and IT Governance professional with several years of international consulting and leadership in cybersecurity, risk management, regulatory compliance, and IT service management. Proven expertise in critical infrastructure (finance, insurance, telecom, energy) and extensive certifications in ISO, ITIL, COBIT, PRINCE2, CISA, SCRUM. Skilled at aligning IT strategies with business goals, managing complex projects, and ensuring compliance with EU and local regulations (DORA, NIS2, GDPR, AI Act, KRITIS).

Key Experience
• Certified Information Security Officer, Allianz Suisse AG (2024–present)
Supports CISO in compliance, risk assessments, IT security framework management, and regulatory alignment (EU & FinMa).

• Owner/Consultant, ICT Project & Governance Consulting (Estonia & Finland, 2011–present)
Delivered IT governance, compliance, and risk projects for major banks, insurers, and automotive clients across Europe. Conducted audits (ISO 27001, ISO 20000, GDPR, IEC 62443, TISAX).

• Managing Director, Marabu Information Technology (1996–2009)
Led IT consulting and outsourcing services for banks, insurers, and SMEs. Oversaw teams, budgets, ITIL-based process improvements, and IT security projects.


Education & Certifications
• Mathematics, Computer Science minor – Free University of Berlin.
• Certified ISO 27001 Auditor, ISO 20000 Auditor, ITIL Expert, PRINCE2 Practitioner, SCRUM Master/Product Owner, CISA, COBIT (Foundation & Practitioner).
• Ongoing advanced training in IT security, data privacy, and regulatory compliance (latest in 2024).

Languages
• German (native), English (C2), Italian (B2), Dutch (B2), French (B1–B2).

Core Skills
• IT Governance & Compliance (EU & international frameworks).
• Cybersecurity & Data Protection (ISO 27000, GDPR, DORA, NIS2, AI Act).
• Risk Management & Third-Party Risk Assessments.
• Project & Program Management (PRINCE2, SCRUM, SAFe, Kanban).
• Multicultural stakeholder management, leadership, and training.

Experience

Professional experience10+ years
Freelancer since2010

Languages

GermanNative speakerEnglishFluentFrenchBasic knowledgeDutchBasic knowledge

Project history

Certified Information Security Officer

Allianz Suisse AG - Zurich

Insurance

5000-10.000 team member

- IT Security Risk Management (ISRM):
  1. Controlling implementation of IT security controls in the Software Development Life Cycle (SDLC) in cooperation with DPO, IT Architecture and the Project Organisation;
  2. Controlling the implementation of IT security controls in IT Operations (Applications- and IT Service Operations, DevOps, Backup and Recovery, DisasterRecovery, Identity and Access Management (IAM), data encryption (data in transfer/rest), key and certificates management, CA operation));
  3. 3rd Party Risk Management (assessing services against the IT Security Framework).
- Frameworks and Policies:
  1. Supporting CISO, Portfolio and Risk Management in alignment Portfolio-, Project- and Operational Risk Management processes within the SDLC acc. to ITIL/ISO 20000;
  2. Implementation of new/additional IT Security Controls and Quality Gates required by regulatory bodies (FINMA (CH), BaFin (DE), DORA (EU), NIS2 (EU)) into SDLC and CI/CD pipelines like STRIDE Analysis, Security/Cloud Design Pattern, SAST/DAST testing, Data Leakage Prevention (DLP);
  3. Supporting CISO in the adaptation ot the IT Security and IT Risk Management Framework to new technical and organisational requirements (e.g. Cloud-Strategie, Artificial Intelligence (AI));
  4. Evaluation of possibilities to use AI in IT security (e.g. STRIDE Threat Modelling);
  5. Review of documents related to the IT Security and Risk Management Framework.

- Audit related tasks:
  1. Managing Audit Findings (management of mitigation projects).

IT Security Analyst / Project Manager

BNP Paribas Fortis - Brussels

Banking & Financial Services

5000-10.000 team member

- Responsible for remediation of Audit Findings in the field of Application Vulnerability detection and management (Source Code Scan, DAST, SAST, SCA, Vulnerability Scanning):
  1. Analysis of Audit Findings and requested/agreed remediations,
  2. Analysis and documentation of process-chains, involved applications and interfaces as well as exchanged information artefact as well as organisational topics across the IT organisation,
  3. Development of improvement measures regarding the orchestration of applications and teams (squads),
  4. Alignment of technical details with the involved IT teams and Internal Audit,
  5. Technical and organisational definition of project plans and monitoring the implementation progress.

- Contributing to the migration activities of the Fortis SAST/DAST tool-landscape towards the desired BNP Group tool landscape.

- Involved in the development and roll-out of a software feature validation process (Quality Gates) regarding business related web-applications (Web Application Vulnerability Assessment) within the Release Management Processes.

IT/OT Risk Assessor / GRC Manager

ZF Group - Friedrichshafen, Lommel

Automotive & Vehicle Manufacturing

>10.000 team member

  1. Contribution to review and adjustment of internal IT Security Guidelines (IT Security Policy, IT Security Instructions, IT Security Work Instructions);
  2. Assessed the implementation maturity of generic Security IT Guidelines based on CIS Controls, IT hardening measures based on CIS Benchmarks and IT Security processes and procedures based on BSI Grundschutz recommendations;
  3. Conducting IT/OT Assessments regarding technical and organisational security of IT programmes in the fields of e.g:
  4. Backup and Recovery, Global Backup and Desaster Recovery Concept,
  5. Adjustment of mobile device strategy,
  6. Identity and Access Management for cloud and on-premise applications,
  7. Changes in the fields of production management systems,
  8. Telematics and Predictive Maintenance,
  9. DC consolidation;
  10. IT/OT availability for critical business processes (BCM),
  11. Security Architecture regarding the processing of "strictly confidential" data, documents and artefacts.
  12. Managed File Transfer (MFT), Electronic data interchange (EDI), Product Lifecycle Management Systems (PLM)
  13. Contribution to review and adjustment of internal IT Service Management (ITSM) Guidelines acc. to ITIL and ISO20000;
  14. Project management in the field of mitigation measures:
  15. IT Security Policies und Security Instructions, Hardening Guidelines etc.,
  16. Cloud Computing Security (z.B. AWS, Azure, CASB),
  17. DevOps und DevSecOps,
  18. IT/OT Security and Data Privacy,
  19. MES-, ERP-, CRM-Systeme,
  20. PLM-, MFT- and EDI systems.

Internal SAP Auditor

C&A - Duesseldorf, Germany; Brussels, Belgium

Goods & Retail

>10.000 team member

- Conducting internal audits regarding the SAP Application and Infrastructure operation concerning:
  1. Conformity of SLAs with internal business requirements (Confidentiality, Availability and Integrity),
  2. Application of industry best practices in the day-to-day SAP service delivery,
  3. Implementation of BSI recommendations regarding access rights and application roles,
  4. Achievement of business expectations regarding SAP application adjustments/developments;
- Development of follow-up adjustment measures according to the audit outcome;
- Review of internal IT control standards (MISC (IT Security Policies, IT Security Instructions, Hardening Guidelines)).

KritisV and GDPR Compliance Audits – Energy Sector

E.ON, Vattenfall Heat

Energy, Water & Environment

>10.000 team member

-Drafting a three-stage architecture of an audit programme to inspect group-internal and external GDPR relevant data-processing activities:
  1. Inventory and consolidation of sources dealing with contracts and processing activities;
  2. Drafting a classification schema for processing activities;
  3. Matching internal catalogues of technical and organisational measures (TOMs (Security/Data Privacy Instructions and Controls)) with the processing-activities classification schema.
  4. Development of a procedure to determinate appropriate sample sizes;
  5. Working out a method, combining self-assessments and audits, to work down the identified audit-sample;
  6. Elaboration of a procedure for the selection of audit candidates;
  7. Estimation of the required resources to implement and run the audit program.
- Conducting IT-/OT-, audits data-protection audits to verify the feasibility of the proposed audit program and to determine the adequacy of the technical-organizational measures (TOMs):
  1. Screening of framework contracts and individual orders, TOMs, process descriptions, work instructions regarding the particular concerned data-processing;
  2. Checking internal and external processing registers;
  3. Examination of documentation regarding the lawfulness of the processing activities;
  4. Interviews and on-site visits;
  5. Documentation of findings;
  6. Development of follow-up measures;
  7. Preparation of audit reports;
  8. Implementation of the follow-up measures.
- Participation in the technical specifications for the program’s IT support.

Data Privacy Assessor

VHV - Hannover

Insurance

5000-10.000 team member

Contributing to clarifications of IT-Security and Data Protection topics regarding the replacement of Core Systems:
  1. Assessing whether the programme was covered by the internal IT-Security and Data Protection framework;
  2. Assessing whether particular implementations were covered by external/internal agreements (company work agreements, data protection agreements);
  3. Assessing whether planned (new or changed) processing activities were documented in the Register of Processing Activities sufficiently;
  4. Assessing whether particular implementations are GDPR compliant with regard to the Rights of Concerned Persons;
  5. Assessing whether technical and organisational planning documents are compliant with internal and external/regulatory requirements concerning Confidentiality, Availability, Authenticity;
  6. Derivation, discussion and documentation of necessary adjustments in the planning and documentation of particular functionalities/features regarding regulatory requirements (KritisV, GDPR);
  7. Assessing the implementation status of adjustment measures.

IT Security Auditor

Finanz Informatik Technologie Service - Haar

Banking & Financial Services

500-1000 team member

  1. Determination of Audit-Scope and Controls in cooperation with the internal Revision and Risk Management unit;
  2. Inspection of REXX/SQL based z/OS security controls;
  3. Inspection of Job Control Flies (JCLs);
  4. Assessing the change history of z/OS Audit-Scripts and Job Control Files;
  5. Assessing the control execution evidences fo z/OS Audit-Scripts;
  6. Verification of archiving and retention of z/OS security audit results;
  7. Assessing the confirmability of z/OS security audit results;
  8. Verification of the change management process for z/OS security controls.

IT Security Auditor

IKB Deutsche Industriebank - Düsseldorf

Banking & Financial Services

500-1000 team member

  1. Agreeing the audit scope with the bank's CIO regarding the fields of confidentiality, availability and integrity;
  2. Compiling and agreeing specific technical and organisational security controls out of the IT service description focused on organisational procedures and technical implementations;
  3. Examination of dokumentaions and evidences;
  4. Organising organisational and technical security test;
  5. Working out of audit reports and follow-up measures.

Compliance Consultant

European Commission/DG-Sante - Brussels

Government and Public Services

>10.000 team member

- Data protection assessment of technical and organisational concepts (according to CEF-2015, 2017 eHealth-DSI) regarding the cross Member-Sate exchange of patient data suffering on rear and/or complex diseases.
- Development of technical and organisational adjustments - ensuring conformity of involved IT solutions with EU and Member-State legislation.

Assessor f. Regulatory Compliance in Architecture

E.ON - Essen

Energy, Water & Environment

>10.000 team member

  1. Assessment of applicability and business impact of new German regulation "BSI-KritisV" (dealing with IT security in critical infrastructures) regarding the operation of a Virtual Power Plant (VPP) in the fields Flex-Energy and Renewable Energy (Wind, PV, Bio-Gas);
  2. Verification of IT/OT security measures for the VPP according the grid operators (TSOs) requirements as e.g. network segmentation and separation, encryption, backup and recovery / disaster recovery;
  3. Assessment of horizontal Continuous Development / Continuous Deployment Processes (Scrum, Kanban);
  4. Assessment of vertical Product Implementation Processes regarding the steering of Flex-Energy Assets as Wind Parks, PV and Bio-Gas sites as well as Batteries (PRINCE2 Agil);
  5. Assessment of Software-Development- and Test-Processes;
  6. Develoment and validation of follow-up measures.
  7. Providing support to the line management:
  8. Team management;
  9. Provided support regarding project staffing and work planning;
  10. Filled the product owner rolle for audit follow-up measures;
  11. Provided consulting regarding classic and agile project management methods (incl. mixed approaches).

Assessor

Several Financial Institutions (e.g. BNPPF, db)

Banking & Financial Services

>10.000 team member

Assessments in the Fields of Programme and ProjectManagement, IT- and Business Strategies Alignment, IT Service- and IT SecurityManagement.
- Programme and Project Management:
  1. Assessment of IT Programmes and IT Projects withregard to conformity with the internal guidelines "Project ProcessStandard" (PPS) and "Financial Reporting Governance Board" (FGB):
· Business Strategy Alignment, IT StrategyAlignment,
· Architecture Alignment, Benefit Case,
· Completeness and plausibility of planningdocuments, availability of
necessary resources (capacities),
· Regulatory Compliance;
  1. Definition and validation of audit follow-upactions and Risk Management measures - triggered by internal and external audits;
- IT- and Business Strategies Alignment:
  1. Assessment of IT Architecture Strategy withregard to the "Direct Channel" Business Strategy;
  2. Development and validation of follow-up measures.
- IT-ServiceManagement:
  1. Internal preparation assessments regarding ISO20000 certification renewal;
  2. Compliance assessments regarding IT Security Management Processes in the field of IBM Mainframe software development;
  3. End-to-End IT-Architecture assessment regardingthe Mainframe based transaction systems (SWIFT);
-IT-SecurityManagement:
  1. Review of Quality- and Security-Gates (ITSecurity Policy, IT Security Instructions, IT Security Controls, Data PrivacyControls) regarding the internal Solution Development Life Cycles (SDLC) -focused on IBM Mainframe und VMS Systems;
  2. Development and validation of follow-upmeasures.

Certificates

VDA ISA 6.0 and TISAX

mITSM

2024

IT Compliance with ISAE 3402

mITSM

2023

ITsec audits competencies f. critical infrastr.

Bitkom Akademie

2020

GDPR for Auditors

Quality Austria

2019

IT-Sec. Catalogue acc. KritisV & EnWG f. Auditors

GUTcert

2019

SCRUM Delivery in PRINCE2 Project Organisations

QRP

2017

SCRUM Master and SCRUM Product Owner

TÜV Akademie Germany

2015

EFQM Excellence Assessor

ILEP

2014

TQM Coach

TÜV Akademie Germany

2014

PRINCE2:2009 Practitioner (Recertification)

APMG

2014

Governance, Risk and Compliance acc. to ISO 27000

TÜV Akademie Germany

2013

ISO 27000 Auditor in IT Security Mgmt Systems

TÜV Akademie Germany

2013

COBIT 5 Foundation

ISACA Germany

2012

ITIL v.3 Expert

Loyalists Certification Services USA/Canada

2011

ISO 20000 Auditor in IT Service Mgmt. Systems

TÜV Academy Germany

2011

Portfolio

Contact form

Log in to get in touch

You need to be logged in to use the contact form.

Sign upLog in