Christian Fox
Wirtschaftsinformatiker
Erfahrungen
Project Leader
Landwirtschaftliche Rentenbank
Analysis of findings:
Detailed review of vulnerabilities identified by BaFin in vulnerability management during §44 KWG audit
Assessment of potential impacts on institute's security and stability
Prioritization of findings by risk level and urgency
Development of action plan:
Creation of comprehensive plan to address identified vulnerabilities
Definition of concrete measures, responsibilities and timelines
Consideration of regulatory requirements
Implementation of measures:
Execution of planned measures to address vulnerabilities
Documentation of implementation steps and effectiveness
Involvement of relevant internal and external stakeholders
Proof of effectiveness:
Conducting effectiveness checks
Creating report on measure effectiveness and regulatory compliance
Submission of report to BaFin
Project Leader - Cyber Security
Hessische Landesbank
- Conducting comprehensive scans of software libraries to identify potential security risks, license violations and outdated components
- Inventory: Recording all relevant software systems and applications to be included in scan
- Scan execution: Using specialized software tools to analyze libraries and dependencies, identifying known vulnerabilities (CVEs), license issues and outdated versions
- Analysis and assessment: Evaluating scan results, prioritizing identified risks based on severity and potential impacts
- Reporting: Creating comprehensive report summarizing scan results, including detailed information on identified issues, remediation recommendations and risk level assessment
Project Leader
Hessische Landesbank
Project goal: Improving cybersecurity through vulnerability agent deployment for early detection and remediation of vulnerabilities to minimize cyber attack risks
Project scope:
- Selection and implementation: Choosing suitable vulnerability agent and integration into existing IT infrastructure
- Rollout planning: Creating detailed rollout plan covering all locations
- Training: Conducting training for IT staff
- Test phase: Conducting test phase to verify agent functionality
- Global rollout: Successive agent rollout across all locations
- Continuous monitoring and maintenance: Ongoing IT security monitoring and agent maintenance
Project Leader
Hessische Landesbank
- Increasing efficiency and effectiveness of vulnerability management through scan process automation
- Improving response times to detected vulnerabilities to minimize security incident risk
- Central management of all scan results and vulnerability information in ServiceNow
- Integration of vulnerability scans into existing IT Service Management processes
- Ensuring compliance with regulatory requirements and industry standards (e.g. PCI DSS, BaFin)
Compliance Advisor
Hessische Landesbank
Implementation of DORA and NIS-2 requirements:
Implementation of comprehensive ICT risk management system
Conducting regular resilience tests
Management of ICT third parties
NIS-2 specific requirements:
Application of risk-based approach in implementing IT security measures
Compliance with incident reporting obligations
Cooperation with other companies and authorities in cybersecurity
Compliance Advisor
Banco Santander
Project goals:
- DORA compliance: Ensuring all cloud services meet DORA requirements
- Minimizing operational risks: Reducing risks associated with cloud service usage
- Strengthening cyber resilience: Improving resistance against cyber attacks and other threats
- Ensuring business continuity: Ensuring critical business processes continue during outages or cyber attacks
Project scope:
- Assessment of all cloud services used
- Development and implementation of policies and procedures
- Conducting employee training
- Monitoring and reporting of DORA compliance
Project Leader - Cyber Security
Hessische Landesbank
- Identification of vulnerabilities and security gaps in personnel, processes and technology
- Conducting realistic attack simulations and scenarios (phishing campaigns, penetration tests, social engineering, DDoS simulation, Active Directory attack)
- Testing effectiveness of existing security measures and security team's response capability
- Remediation of vulnerabilities: Implementation of recommendations
- Improvement of security measures: Adaptation of security strategies, policies and processes
- Employee training: Raising awareness of cyber threats and strengthening security consciousness
Consultant - Cyber Security
Hessische Landesbank
- Inventory and risk assessment: Identifying critical systems, applications and data sets and conducting comprehensive risk assessment
- NIST CSF analysis: Comparing existing security measures with NIST CSF recommendations
- Design and implementation: Developing customized vulnerability management process based on NIST CSF functions
- Training and awareness: Conducting employee training to raise cybersecurity risk awareness
- Testing and evaluation: Verifying effectiveness through penetration tests and vulnerability analyses
Project Leader Cyber Security
Hessische Landesbank
- Assessment of current scanner infrastructure and functionalities
- Definition of cloud-based scanner requirements (performance, scalability, security)
- Selection of suitable cloud provider and scanner solution
- Creation of detailed migration plan
- Proof-of-concept execution
- Cloud environment setup and scanner installation
- Scanner configuration for specific requirements
- Integration with existing systems
- Development of automation mechanisms
- Comprehensive testing
- Vulnerability remediation and configuration optimization
- Documentation and training materials creation
- Data and configuration migration
- Parallel operation of old and new systems
- Old system decommissioning
Project Leader - Cyber Security
Hamburger Commercial Bank
- Conducting comprehensive §44 KWG audit: Identification and assessment of potential vulnerabilities and risks in business areas
- Closing findings in SSMK: Development and implementation of suitable measures to address identified deficiencies and improve compliance
Consultant - Cyber Security
Warburg
- Inventory: Recording and analysis of existing ISMS documentation, policies, processes and technical measures
- Gap analysis: Comparison of current state with ISO 27001 requirements, identification of gaps and vulnerabilities
- Risk assessment: Evaluation of identified risks regarding potential impacts
- Action planning: Development of action plan to close identified gaps and minimize risks
- Reporting: Creation of comprehensive audit report with gap analysis results, risk assessment and action plan
Project Leader
Telekom Security
- Consulting, testing and implementation services regarding ISO 27001, BSI-Grundschutz, KRITIS, NIS-2, GDPR, § 8a BSIG and B3S, Cloud Computing C5 in agile software development
- Conducting agile software development project management using Confluence and Jira
- Conducting workshops and training on secure software development
- Creating software development guidelines and process models
- Conducting BSI baseline protection checks
- Threat and vulnerability identification
- Creating security concepts based on BSI standards
- Risk analysis using ISO 31000
- Implementation of IT security measures for SAP, Cloud, Docker and containers
- Conducting penetration tests
- Integration of automated security procedures in DevSecOps
Compliance Auditor
Hessische Landesbank
- Planning: Development of detailed audit plan defining objectives, scope and methodology
- Execution: Conducting audit including data collection, interviews and document analysis
- Reporting: Creating audit report summarizing findings including identified risks and vulnerabilities
- Follow-up: Tracking implementation of audit recommendations
Penetration Tester
Hessische Landesbank
Team building: Selection and setup of penetration testing team with required expertise and experience, providing necessary tools and infrastructure
Development: Continuous evolution of penetration tests adapting to changing threats, including new attack scenarios and test methods
Execution: Regular penetration testing to continuously monitor and improve IT security, typically conducted by external specialists for objective assessment
Vulnerability Manager
Hessische Landesbank
Scope definition:
Determining critical IT assets for vulnerability scanning
Defining types of scans to be conducted
Tool selection:
Selecting appropriate vulnerability scanners and analysis tools
Configuring tools for specific requirements
Scan execution:
Planning and conducting vulnerability scans
Documenting all vulnerabilities
Analysis and assessment:
Analyzing scan results for severity and potential risk
Prioritizing vulnerabilities based on criticality
Reporting and recommendations:
Creating comprehensive vulnerability report with detailed descriptions and remediation recommendations
Presenting report to management
Penetration Tester
Hessische Landesbank
Design and planning:
Creating vulnerability scan concept considering specific requirements
Selecting appropriate tools and methods
Defining project timeline and resources
Scan execution:
Conducting automated and manual vulnerability scans
Analyzing results and identifying vulnerabilities
Documenting findings and creating reports
Vulnerability remediation:
Supporting remediation of identified vulnerabilities
Verifying effectiveness of remediation measures
Reporting and recommendations:
Creating comprehensive project results report
Formulating web application security improvement recommendations
IT Risk Manager
Hessische Landesbank
- Analysis and assessment: Regular evaluation of IT infrastructure and processes to identify vulnerabilities and risks
- Risk management framework development and implementation
- Policies and procedures creation and updates
- Training and awareness programs
- Regular reporting on IT risk management status
- Collaboration with other departments and external partners
Process Designer
Hessische Landesbank
Current state analysis: Assessing existing IT infrastructure, identifying vulnerabilities and risks, analyzing current security policies and procedures
Target state definition: Defining requirements for vulnerability management process
Process design:
Vulnerability identification through regular scans and security alerts
Vulnerability assessment and prioritization
Vulnerability remediation through patches, configuration changes or additional controls
Monitoring and reporting
Implementation: Introducing new process including staff training and technology integration
Evaluation and improvement: Regular review and adjustment of process
IT Security Project Leader
Hessische Landesbank
- Analysis and assessment: Identifying current and potential vulnerabilities in IT systems and processes
- Design and implementation of security measures to strengthen First Line of Defense
- Threat defense mechanisms for cyber attacks and malware
- Incident response process development
- Training and awareness programs
- Continuous monitoring and adaptation of First Line of Defense
SIEM Advisor
AXA
- SIEM concept: Review and update of overarching SIEM concept including objectives and responsibilities
- Use cases: Identifying and adapting relevant use cases for specific threats and risks
- Playbooks: Developing detailed instructions for security incident response
- Log policies: Review and adaptation of log policies for security information collection
Project Manager
New York Life
- Review of current cyber security strategy
- Analysis of cyber threat situation
- Cyber security checks based on ISACA, NIST Framework, U.S. Banking Regulators
- Integration of cyber security controls into FFIEC Assessment Tool
- IS risk assessment (ISO31000)
- ISMS, policies, and strategies adaptation
ISMS Lead Auditor
GAZPROM
Inventory and analysis:
Recording all relevant processes, systems and documents
Analyzing ISMS documentation compliance
Identifying potential vulnerabilities
Internal audit execution:
Creating detailed audit plan
Conducting stakeholder interviews
Assessing security measure effectiveness
Documenting findings
Action plan development:
Developing specific remediation measures
Prioritizing measures by risk
Defining responsibilities and timelines
Implementation support:
Supporting measure implementation
Verifying effectiveness through follow-up audits
ISMS Lead Auditor
AOK
- Ensuring compliance with Gematik and KRITIS requirements for electronic health card
- Data center area audit at EQUINIX data center
ISMS Lead Auditor
Oldenburgische Landesbank
Internal audit for ISO 27000 certification preparation including:
- Documentation review against standard requirements (KRITIS)
- Management system practical application and effectiveness verification
- Banking regulation compliance check (MaRisk, etc)
IT Security Project Leader
AXA
Inventory:
Analysis of existing ISM documentation
Assessment of current security measures
Stakeholder interviews
Gap analysis:
Comparison with ISO 27001:2013 requirements
Gap identification and documentation
Risk assessment:
Impact assessment of identified gaps
Gap prioritization
Action plan:
Detailed gap analysis report
Risk assessment
Remediation plan
Budget planning
ISMS Lead Auditor
TenneT
Internal audit for ISO 27000 certification preparation including:
- Documentation review against standard requirements (KRITIS)
- Practical application and effectiveness verification
- IT security law and energy provider regulation compliance check
- Power plant facility inspection
IT Security Consultant
Amazon
- Infrastructure assessment: Evaluating security of AWS services (EC2, S3, VPC, IAM)
- Application assessment: Analyzing security of AWS-hosted applications
- Data assessment: Reviewing sensitive data protection
- Compliance assessment: Evaluating compliance with security standards
- Automated and manual testing
- Documentation and reporting
IT Security Manager
COViS
- Vulnerability assessment based on CERT notifications, CVSSv3 and CVE
- Source code analysis
- Change Advisory Board membership as IT Security Manager
- DevOps process consulting in Salesforce environment
- Cloud network vulnerability scanning
- IS risk and threat analysis
- Security concept and management reporting creation
IT Security Manager
COViS
- Detailed audit report with vulnerability and risk identification
- Recommendations for identified vulnerability remediation
- Cloud infrastructure security improvement
- Cloud security policy creation
ISMS Lead Auditor
COViS
- ISMS audit finding resolution
- ISMS recertification preparation
- External auditor liaison
Co Lead Auditor
Investment Bank
- Analysis of penetration test results and measure distribution coordination
- Security documentation creation and alignment including presentation
IT Security Expert
Postbank
- STRIDE-based threat modeling and IS risk analysis
- IT security concept creation against unauthorized transfer of commands and data for cash withdrawals
Due Diligence Manager
Relais Colis
Assessment of:
- Security policies and procedures for information security, data protection and emergency management
- Technical infrastructure including network security and security software
- Data management and GDPR compliance
- Web applications and mobile apps security
- Risk management process
- Compliance with regulations and industry standards
- Security organization and personnel qualifications
IT Security Manager
DHL
- Compliance assurance: Ensuring all DPDHL Group business processes in European countries comply with regulations
- Risk minimization: Identifying and assessing compliance and information security risks
- Control implementation: Implementing and monitoring effective controls
- Standards establishment: Creating company-wide standards for European operations
IT Security Manager
DHL
SOC establishment including:
Conception and planning:
Requirements analysis
SOC design including personnel, processes, technology
Location selection
Implementation:
Technology procurement (SIEM, threat intelligence, IDS/IPS)
Process definition for monitoring and incident response
Team recruitment and training
Operations:
24/7 infrastructure monitoring
Incident response
Continuous improvement
IT Security Manager
DHL
- Process design and documentation including interfaces and RACI matrix
- Security incident classification and prioritization guidelines
- GRC tool Archer process operation and integration
- Training delivery (help desks, departments, developers, management)
- Reporting creation
- Security and risk analysis execution
Business Continuity Manager
DHL
- Business requirements analysis
- IT Service Continuity Management strategy creation
- Business Impact Analysis (BIA) execution
- Measure planning and BCM strategy development
IT Security Manager
DHL
PKI implementation for DHL post offices:
- Conception and design: PKI architecture development including hardware/software selection and certificate management process definition
- Implementation: CA, RA and repository setup, POS system integration
- Rollout: Component distribution and staff training
- Operations: Infrastructure monitoring and maintenance
IT Security Manager
DHL
- Process design and documentation including interfaces to other processes
- Security incident classification and prioritization guidelines
- Security analysis execution
Program Leader
DHL
POS system frontend migration to Windows platform:
- Analysis: Current system landscape and requirements assessment
- Design: Migration concept development
- Development: Software component adaptation
- Testing: Comprehensive system verification
- Rollout: Migration execution and staff training
- Support: Post-migration support provision
Senior Software Developer
Borland
- Java application development using J2EE technologies
- Interface design and implementation
- Unit and integration testing
- Bug fixing and performance optimization
- Collaboration with developers, architects and product owners
SAP Consultant
Deutsche Bank
Business process analysis:
Banking requirements gathering and analysis
Process optimization identification
Efficiency improvement concept development
Software solution design and development:
SAP banking application technical design
ABAP development
Standard solution customization
Zusammenfassung
Meine Leidenschaft ist es, Probleme zu lösen: Angefangen von der Modellierung bis hin zum Erarbeiten systematischen und automatischen Lösungswegen. Deshalb entschloss ich mich zu einem Informatikstudium. Beruflich wollte ich mich jedoch nicht ausschließlich mit Informatikthemen beschäftigen. Ebenso wichtig war mir Teamarbeit. Als Berater kann ich beides verbinden und so entschied ich mich zu einem Einstieg ins internationale IT-Projektmanagement.
Ausschlaggebend für meine Bewerbung bei der Deutschen Post DHL Group war die Perspektive, mein angesammeltes Wissen nun als Leiter in einem technischen Microsoft Migrationsprogramm anwenden zu können. In der Leitungsrolle konnte ich über den Tellerrand schauen und neue Herausforderungen – „Digital in Retail“ - annehmen: Wie sieht die Lieferkette der Zukunft aus? Was kennzeichnet eine erfolgreiche „Multichannel“-Strategie?
Mein Weg in die IT-Security der Deutschen Post DHL Group führte mich über den Aufbau eines Security Incident Managements. Hier habe ich gelernt, dass ein großes Cybersicherheitsereignis Milliarden von Euro an Vermögenswerten betreffen und einem hart erarbeiteten Ruf schaden kann. Der Selbstschutz berücksichtigt vorausschauende und widerstandsfähige Risikoüberlegungen bei der Geschäftsentscheidung und verbessert gleichzeitig den Sicherheitsschutz in der IT-Umgebung.
Als selbständiger Berater konnte ich viele Erfahrungen in unterschiedlichen nationalen, wie internationalen Branchen und Projekten sammeln. Nicht nur die Inhalte und fachlichen Themen helfen mir bei der täglichen Arbeit, auch die unterschiedlichen Perspektiven der ganz unterschiedlichen Kulturen.
Es gab ein Projekt, das alles andere als eine „Kuschelstudie“ war: Die Rahmenbedingungen waren herausfordernd, dass Team groß und das Projekt lief schon über ein Jahr. Doch ich erlebte viel Anerkennung und habe von meinen Kollegen trotz meiner Erfahrung nochmal enorm viel gelernt. Es gab viele Persönlichkeiten, bei denen ich denke: Unglaublich, was die alles wissen.
Das Vulnerability Management ist die sogenannte „first-line-of-defense“ gegen Cyber-Angriffe! In meinem internationalen Projekt in Europas größter Transaktionsbank wurde mir dies jeden Tag gezeigt. Das Identifizieren und Schließen kritischer Schwachstellen sorgt nicht nur dafür, dass IT-Systeme und geschäftskritische Anwendungen reibungslos laufen, es ist auch eine der Kernaktivitäten, die für die Sicherheit heutiger Unternehmen sorgen. Nicht gepatchte IT-Systeme oder offene kritische Schwachstellen sind anfällig für Cyberangriffe, und das Risiko ist alles andere als theoretisch. Log4j-Schwachstellen oder digitale Erpressungen mit Ransomeware zeigen, wie wichtig es ist, effektive Sicherheitsmaßnahmen gegen diese Cyber-Angriffe umzusetzen.
Sprachen
Ausbildung
Technische Universität - Berlin
Diplom · Informatik · Berlin, Deutschland · gut
Siemens Nixdorf - Essen
Berufsausbildung · Wirtschaftsinformatiker · Essen, Deutschland · gut
Erich Kästner Gesamtschule - Bochum
Abitur · Bochum, Deutschland · befriedigend
Zertifikate & Bescheinigungen
Crisc
Isaca
Certified Ethical Hacker
Cisa
Isaca
Cism
Isaca
Cissp
Isaca
Ähnliche Freelancer
Entdecken Sie andere Experten mit ähnlichen Qualifikationen und Erfahrungen.