Project Lead

• Defined security concepts for all relevant applications running on the AWS cloud platform.
• Connected applications to BMW’s central SOC/Splunk.
• Performed regular penetration tests, IAST/SAST/DAST application scans.
• Ensured compliance with BMW regulations.

Achievements:

• Achieved over 95% on Security KPIs.
• Exceeded 90% on Compliance KPIs.

• Conducted Cloud Vendor Assessments (CVA) based on DCSO’s security domains (NIST/ISO).

Achievements:

• Completed over 10 assessments in 2022.
• Completed over 10 assessments in 2023.

• Defined the Information Security roadmap through 2025.
• Implemented an ISMS according to ISO 27001, enriched with NIST-800 and NIST CSF controls.
• Built a global IS organization and a 24/7 Incident Response Team.
• Conducted Business Impact Analysis and TCM/BCM planning.
• Designed and implemented endpoint protection, data classification, and data loss prevention concepts.

Achievements:

• Secured approval for the Information Security strategy and policy.
• Published IS and GRC policies.
• Established IS awareness programs and a management dashboard with defined KPIs.
• Set up an MDR Security Operations Center and Security Incident Response Team.
• Deployed endpoint protection on over 8,000 endpoints with Sentinel monitoring.
• Integrated data classification and DLP into business processes.

• Conducted an as-is analysis of existing IT infrastructure and services.
• Mapped business processes to IT services.
• Evaluated options for future IT strategy and organization.
• Proposed and defined the IT strategy based on these evaluations.

Achievements:

• Produced as-is documentation and business process maps.
• Reviewed the business impact analysis.
• Defined the IT strategy and handed over rollout preparation to the IT Manager.

• Aligned project pillars for Data Centre (DCC), Virtual Client (AVC), Global Mail (GM), AGN Network, and AGN security services.
• Monitored overall project budgets.
• Coordinated execution between projects and local CIOs in APAC.

Achievements:

• Successfully rolled out AGN, AGN security services, and GM in 2018.
• Completed the rollout for AVC and DCC in 2019.

• Defined and implemented information security concepts based on BSI 100-x and ISO 27000 series.
• Created an ISMS for over 20 locations and business units.
• Conducted audits and follow-up checks.

Achievements:

• Delivered BSI 100-1/2 and ISO 27000 series security concepts.
• Developed IT emergency plans based on BSI 100-4.
• Handed over the ISMS to my successor at the end of my tenure.

• Designed a new data center concept to meet regulatory requirements in multiple countries.
• Conducted BIA with RTO/RPO definitions.
• Managed project costs, budget, and milestones.

Achievements:

• Consolidated data center infrastructure from six to two global locations.
• Introduced DR concepts and reduced IT costs.

• Defined an IT governance policy according to CBRC, PBOC requirements, ISO 38500, and COBIT 5 standards.
• Aligned the policy with BMW AG and BMW Bank.
• Prepared a presentation for top management.

Achievements:

• Submitted and gained approval for the IT governance policy tailored to the Chinese market.

• Prepared business proposals summarizing security requirements.
• Designed information protection and DLP concepts.

Achievements:

• Finalized DLP concepts and carried out successful PoCs with various business cases.
• Provided handover including rollout preparations for operations.

• Conducted security workshops to clarify requirements.
• Provided information security guidance for protected R&D work.

Achievements:

• Delivered a complete information security framework for Audi R&D’s secure operations.