Information security and compliance grounded in audit practice, with a focus on European defence regulation. I translate NATO, EU and national requirements into decisions a board can act on.
01 - Practice
02 - Hands-on
Management systems are not built at a desk alone. These are the areas I work on myself — technical as well as organisational.
Under ISO 27001, NIS2 and TISAX. As the auditor, not as the supplier of evidence.
Assessing exposure and control effectiveness rather than handing out traffic lights.
Under BSI IT-Grundschutz, including critical-infrastructure environments and public authorities.
Continuity and recovery plans that hold when it matters — plus awareness training.
Responsible for the secure adoption of AI inside a running ISMS.
Ongoing technical training on TryHackMe. Profile publicly visible.
View profile ↗03 - Workshop
No offer, no product. A test rig I use to check whether a standard holds up once you force it into a data model. Four things it taught me.
A group-wide ISMS has to keep subsidiaries and sites properly apart. In my build every table carries the organisation as a mandatory field, and every access path runs through exactly one control point. If you only check separation in application logic, you do not have it.
organization_id uuid NOT NULL // on every table. no exceptions.
Read tools run automatically, writing tools never without human approval, and every AI-drafted record stays visibly flagged. That is the human oversight the AI Act demands, as code rather than as a statement of intent.
tool.read -> auto tool.write -> approval + audit_log
Adding SOC 2 or NIS2 must not trigger a database migration. Build your model on a single standard and you build yourself into it, which you only notice when the second one arrives.
frameworks/soc2.seed.ts // new standard = new file
Red-amber-green tells a board nothing, because it has no direction. A maturity level tells them where the organisation stands and what the next step costs.
maturity: 0..5 // not: red | amber | green
04 - Profile
Information Security Officer with a background in data science. I combine classic security management under ISO 27001 and the German BSI IT-Grundschutz with AI governance under ISO 42001, from federal agencies to international groups. Advisory board member at Global Cyber Circle, author of "Navigating NIS-2".
Information Security Officer · Amadeus Fire
Running ISMS under ISO 27001, NIS2 and TISAX. Internal audits, cyber risk assessments, ITSCM, the CISO mandate for group companies, and responsibility for AI in information security.
Advisory board · Global Cyber Circle
Focus on cyber & regulation: NIS2, DORA and compliance as a strategic strength across the DACH network.
Information Security Consultant · DS DATA SYSTEMS
Security analyses under ISO 27001 and BSI IT-Grundschutz, ISMS implementations, BCM and data protection for companies and public authorities.
Junior IT Consultant · Grouplink IT Solutions
ISMS implementation under ISO 27001, security concepts under BSI IT-Grundschutz / critical infrastructure rules, security awareness training.
05 - Contact
Questions on ISO 27001, NIS2, DORA, ISO 42001 or the EU AI Act? I welcome messages, in English or German.
