Konstantin Meyeringzoxai.de

Information Security Officer · Braunschweig, Germany

Two security problems. One management system.

The old one: an ISMS that passes the certification audit and then gathers dust. The new one: staff are already using AI, policy or no policy. I treat them as one problem.

Today I run the ISMS at Amadeus Fire AG. Before that, I advised companies, critical infrastructure operators and German federal authorities on ISO 27001 and BSI IT-Grundschutz.

View career Standards meet code
Portrait of Konstantin Meyering
Languages: German, English, Spanish (basic) Network: Advisory board, Global Cyber Circle
§ 1Focus areas

Four frameworks I treat as one system.

ISMS and audit
Operating and developing ISMS under ISO 27001, running internal audits and supporting external audits and recertifications.ISO 27001 · TISAX · ITSCM
Public sector and critical infrastructure
Security concepts under BSI IT-Grundschutz for German federal authorities, including classified work at VS-NfD level, and ISMS implementations for critical infrastructure operators.IT-Grundschutz · KRITIS · VS-NfD
EU regulation and defence
NIS2, DORA and the obligations of defence-industry suppliers, assessed by what contract, jurisdiction and classification level actually trigger. Read moreNIS2 · DORA · NATO AQAP · EUCI
AI governance
Rules and risk management for the use of AI under ISO 42001 and the NIST AI RMF, and where the EU AI Act meets an existing ISMS.ISO 42001 · EU AI Act · NIST AI RMF
§ 2Standards meet code

I do not just talk about AI in compliance. I build it.

Not a product, but a test bench: I check whether a standard holds up once you force it into a data model. Three principles that came out of it.

  1. Separation is architecture.

    Every table carries the organisation as a mandatory field. If you only check tenant separation in the application, you do not have it.

    organization_id uuid NOT NULL
-- on every table

  2. No write without a signature.

    Read tools run automatically, write tools never without human approval. The oversight the AI Act demands, as code rather than a statement of intent.

    tool.read  -> auto
tool.write -> approval + audit_log

  3. Maturity, not traffic lights.

    Red, amber and green have no direction. A maturity level shows where an organisation stands and what the next step costs.

    maturity: 0..5
-- not: red | amber | green

Plus ongoing training on the attacker side, publicly visible on TryHackMe.

§ 3Career

From federal authority to group headquarters.

  1. 2026 to present

    Information Security Officer · Amadeus Fire AG, Frankfurt

    Operating and developing the ISMS in line with ISO 27001, NIS2 and TISAX; Information Security Officer for group companies. Internal audits, support for the successful ISO 27001 recertification, cyber risk assessments, ITSCM, training and awareness.

  2. 2025 to present

    Advisory Board, Cyber and Regulation · Global Cyber Circle

    NIS2, DORA and compliance as a strategic advantage rather than a cost centre, in a network of cybersecurity professionals across the DACH region.

  3. 2023 to 2026

    Information Security Consultant, latterly Senior · DS DATA SYSTEMS

    Led a five-person team in a BSI IT-Grundschutz project for a federal authority while contributing hands-on. ISMS implementations for companies and critical infrastructure operators; security, continuity and data protection concepts.

  4. 2022 to 2023

    Junior IT Consultant · Grouplink IT Solutions

    ISMS implementation under ISO 27001, IT security concept under BSI IT-Grundschutz and KRITIS, emergency manuals, advice on NIS2 and TISAX.

  5. 2018 to 2021

    Early roles

    Internship at CRANIUM, contributing to its internal ISO 27001 implementation. Student assistant in system administration at etamax space, including the TISAX implementation.

§ 4Publications (in German)

Navigieren durch die NIS-2

Eine Roadmap zur Compliance

IT-Notfallmanagement

Die Lebensversicherung für den Geschäftsbetrieb

§ 5Contact

Questions on regulation or ISMS? Get in touch.

On ISO 27001, NIS2, DORA, ISO 42001 or the EU AI Act, in English or German.

meyering@zoxai.de LinkedIn