Cyber Security, Senior Projektmanager (IPMA Level B), Krisenmanager

7/2021 – 10/2022

PL Schwachstellen- u. Patchmanagement
Prozessmodellierung, Dienstleistersteuerung

Bankwesen (allg.), Cyber Security, Projektmanagement (IT), Prozessmanagement

5/2021 – 5/2021

Атака, контратака и кибервойна (Blockseminar)

Aus- / Weiterbildung, Cyber Security

1/2021 – 4/2021

Gutachen für Erweiterungen Toollandschaft Schwachstellenmanagement

Cyber Security, Prozessmanagement

11/2019 – 12/2020

Full Responsibility Vulnerability Management
Vulnerability management; freelancer, first alone, the last months with 2-3 colleagues


- Perform vulnerability Scans (Tenable.sc)
- Analysis and evaluation of vulnerabilities found incl. initial prioritization
- Where needed, special analytics, especially for a detailed risk assessment
- Coordination of measures together with the Information Security Officers and affiliates
- Initial commissioning of service providers via Patch Management and I&O
- Member of the regular Cyber Defense Call
- Other stakeholder management (e.g. internal auditors)
- Continuous improvement of all related processes
- Extensive reporting of found vulnerabilities including defined KPIs
- Collaboration wirh other relevant cybersecurity teams (SOC, CSIRT, PenTest, LogMan)

Cyber Security, It-Beratung, Projektmanagement (IT)

7/2017 – 5/2020

Central point of contact (SPOC) for patch & vulnerability management; freelancer, first alone, the last year with 2 up to 3 employees


- Perform vulnerability Scans (first OpenVAS, later Tenable.sc, both with Nessus scripts)
- Analysis and evaluation of vulnerabilities found incl. initial prioritization
- Where needed, special analytics including ethical hacking (with Kali Linux) and forensic, especially for a detailed risk assessment
- Coordination of measures together with the Information Security Officers of the individual subsidiaries, shareholdings and regions
- Coordination of measures together with the techn. product managers and business case managers
- Initial commissioning of service providers via incident and change management (in particular patching, network protocols and GPO hardening)
- Separate assignment for extended mitigations, where available (e.g. virtual patching (Trend Micro), discrete network remediation (Qualys))
- Member of the group-wide Central Review Board for Vulnerability Mitigations
- Other stakeholder management (internal auditors, operational management)
- Extensive reporting of found vulnerabilities including defined KPIs
- Continuous improvement of all related processes
- Collaboration on other relevant cybersecurity programs (different work streams)

Cyber Security, It-Beratung, Projektmanagement (IT)

8/2016 – 4/2017

Unentgeltliche Gründungsbegleitung eines gemeinnützig orientierten Start-Up Unternehmens (pro bono publico), hierzu bezahlt freigestellt von Transfergesellschaft PTG für Giesecke & Devrient

General vulnerability analysis of in-house augmented reality applications; therefore foundation of a dedicated company with up to 6 employees.

- Performing Semi-Manual Vulnerability Scans, Ethical Hacking
- Analysis and evaluation of vulnerabilities found and initial prioritization
- Extensive risk assessment including terrorism threat and insider thread potentials
- Policy discussion with global IT, faculties documentation and maintenance
- Documentation of the attack scenarios and possible defenses
- Collaboration requirements specification AR / MR secure layer library (MVP)
- Cooperation preparation Homeland Security audit

Informationssicherheit, Interim Management, Investitionsrechnungen, Kryptologie, Organisation (allg.), Personalentwicklungskonzept, Personalwesen (allg.), Planung / Kontrolle Auslandsaktivitäten, Planung von Finanzierung / Absicherung im Ausland, Projekt - Start-Up-Workshop, Projektfinanzierung, Projektleitung / Teamleitung (IT), Projektmanagement (IT), Vertragsmanagement, Vorbereitung Auslandsinvestitionen

1/2014 – 6/2016

Kundenprogramm- und Multiprojektmanager Öffentlicher Dienst, insbesondere Projekte für das Kraftfahrtbundesamt, Flensburg

asks and activities Kraftfahrt-Bundesamt (KBA) (05/2011 - 06/2016),
Permanently employed by Giesecke & Devrient, most recently as a customer product manager up to 60% on-site at the customer.

- Program and portfolio management of all customer projects and product development KBA, especially card personalization TACHOGRAPH (driver card, company card, workshop card, control card)
- Collaboration functional specification security concept and security implementation
- Implementation of card-based, segmented access control
- Implementation of card-based authentication and authorization
- Maintenance of hardware-based key generation, multiple times cryptographically hardened
- Upgrade secure route encryption, multiple timnes cryptographic hardened (several times)
- Analysis and evaluation of attack scenarios against personalization, also in the sense of insider threat management, in cooperation with BKA
- Analysis and evaluation of attack scenarios against the product, in cooperation with police departments
- Forensics to manipulated driver cards
- Extensive stakeholder management inside and outside the office
- Task coordination with the internal customer Security Officer
- Task coordination with the internal customer IT department
- Detailed reporting and documentation of all discussed and implemented measures
- SPOC continuous improvement of the personalization process
- Contribute to continuous improvement of internal processes for incident management and change management

Incident-Management, Investitionsrechnungen, IT Sicherheit (allg.), ITIL, Krisenmanagement, Mehrprojektmanagement, Offshoring, Projektmanagement - Angebotsmanagement, Konfliktlösung, Projektmanagement - Projektentwicklung, Projektmanagement - Vertragsmanagement, Projektmanagement (IT), Projektsteuerung (Projektcontrolling), Service Management, Technisches Projektmanagement

5/2011 – 12/2013

(Multi-) Projektmanagement Internationale Regierungsaufträge, insb. Region SADC plus KBA Flensburg

Permanently employed by Giesecke & Devrient, first as project manager, then most recently as a customer product manager up to 60% on-site at the customer.

- Program and portfolio management of all customer projects and product development KBA, especially card personalization TACHOGRAPH (driver card, company card, workshop card, control card)
- Collaboration functional specification security concept and security implementation
- Implementation of card-based, segmented access control
- Implementation of card-based authentication and authorization
- Maintenance of hardware-based key generation, multiple times cryptographically hardened
- Upgrade secure route encryption, multiple timnes cryptographic hardened (several times)
- Analysis and evaluation of attack scenarios against personalization, also in the sense of insider threat management, in cooperation with BKA
- Analysis and evaluation of attack scenarios against the product, in cooperation with police departments
- Forensics to manipulated driver cards
- Extensive stakeholder management inside and outside the office
- Task coordination with the internal customer Security Officer
- Task coordination with the internal customer IT department
- Detailed reporting and documentation of all discussed and implemented measures
- SPOC continuous improvement of the personalization process
- Contribute to continuous improvement of internal processes for incident management and change management

Bereich mit Anhängen

Angebotskalkulation, Bilanzen, Investitionsrechnungen, IT Sicherheit (allg.), Mehrprojektmanagement, Offshoring, Planung / Kontrolle Auslandsaktivitäten, Planung von Finanzierung / Absicherung im Ausland, Projektmanagement, Projektmanagement - Angebotsmanagement, Projektmanagement - Risikomanagement, Projektmanagement - Umfeldanalyse, Projektmanagement - Vertragsmanagement, Projektmanagement (IT), Risikomanagement, Vertragsmanagement, Vorbereitung Auslandsinvestitionen

3/2010 – 4/2011

F&E Verantwortung PLCM Prozessdesign Service und Support
Projektmanager globale Prozessvereinheitlichung Service und Support

(in Festanstellung)

Incident-Management, ITIL, Service Management, IT Sicherheit (allg.), Projektmanagement (IT), 1st Level Support / UHD, 2nd & 3rd Level Support, 24/7 Leistungen, IT-Support (allg.), Prozessoptimierung, Product-lifecycle-cost-management (PLCM), Service-lifecycle-management (SLM), Projektmanagement - Vertragsmanagement, Mehrprojektmanagement, Projektmanagement - Konzeption / Vorgehensmodell, Projektmanagement - Projektentwicklung, Shared Services, Offshoring, Vertragsmanagement, Service-Level-Management (SLA)

3/2010 – 9/2010

Interimsleitung F&E Bereich Client/Server Systeme

(in Festanstellung)

IT Sicherheit (allg.), Projektmanagement (IT), Projektmanagement - Personalentwicklung, Projektmanagement - Personalmanagement, Offshoring, Personalwesen (allg.), Personalorganisation, Personalverwaltung, Personalplanung, Personalführung

1/2008 – 3/2010

Projektleitung internationale Großprojekte Client/Server Entwicklung

Größtes Projekt: knapp 100 Mitarbeiter an 5 Standorten, 1,5 Jahre, 14,7 Mio EUR Gesamtbudget

(als Festanstellung)

Embedded Entwicklung / hardwarenahe Entwicklung, IT Sicherheit (allg.), Projektmanagement (IT), Projektleitung / Teamleitung (IT), Software Design, Software Architecture, J2EE, Kryptologie, Interim Management, Mehrprojektmanagement, Projektmanagement - Projektentwicklung, Projektmanagement - Krisenmanagement, Kooperationen, Offshoring

4/2007 – 12/2007

Abteilungsaufbau einer offshore Ausgründung als Projekt und Interimsleitung Entwicklung

Projektmanagement (IT), Interim Management, Projektmanagement - Vertragsmanagement, Projektmanagement - Vorstudien / Machbarkeitsstudien, Projektmanagement - Projektentwicklung, Projektmanagement - Personalmanagement, Offshoring, Vorbereitung Auslandsinvestitionen, Planung / Kontrolle Auslandsaktivitäten

4/2001 – 4/2007

Mitarbeit, dann zunehmend Teilprojektleitung und Projektleitung in Entwicklung und insbesondere Testentwicklung Chipkarten und Chipkartensysteme.

Embedded Entwicklung / hardwarenahe Entwicklung, Transport Layer Security, IT Sicherheit (allg.), Projektmanagement (IT), Projektleitung / Teamleitung (IT), Test Management, Testen, Testdesign (IT), C++, Visual C++, Kryptologie, Krisenmanagement, Projektleitung / Teamleitung, Projektmanagement - Krisenmanagement

2/2000 – 4/2001

Projektmitarbeit, teilweise Leitung Softwareentwicklung Java

Projektleitung / Teamleitung (IT), Java (allg.), Softwareentwicklung (allg.), Projektleitung / Teamleitung

9/1999 – 2/2000

(Teil-) PL Systemarchitektur Gewährleistungssysteme Oracle bei VW, Wolfsburg

Oracle-Anwendungen, Projektleitung / Teamleitung (IT), System Architektur, Projektleitung / Teamleitung

1/1999 – 7/1999

Erstellung Prozesskonzept Produktservices und Webauftritt.

Internet / Intranet- Integration (eBusiness), Prozessoptimierung

7/1998 – 12/1998

Leitung eines DFG Projektes Lehrstuhl für Psychologie

Projektleitung / Teamleitung

1/1998 – 7/1998

Leitung Projektdokumentation Core of Excellence beim Endkunden DaimlerBenz.

Projektmanagement (IT), Projekt-Dokumentation, Projektleitung / Teamleitung

8/1997 – 2/1998

Erstellung Schulungskonzept und Unterlagen in verschiedenen Firmen, über CSG

Schreiben von Dokumentation, Schulungskonzepte