Senior IT PM & Governance & Operational Resilience Consultant | Financial Services

Conceptualization, authorship and finalization of the IT PROD SEC service catalog with eight standardized security services (S-ID001–S-ID008).

Development of consistent service components & deliverables, RACI assignments as well as SLA and KPI definitions per service.

Integration of BaFin document requirements under DORA into the service descriptions.

Coordination with IT, compliance, risk and operations for the professional validation of all service descriptions.

Specifically for governance & monitoring: definition of the governance cadence, evidence delivery processes, audit support and definition of measurable KPIs and measurement methodology.

Ensured that all services are documented in a standardized, measurable and audit-proof way.

Result: Approved service catalog with eight services as a binding basis for delivery, governance and audits; transparent SLAs/KPIs per service and DORA/BAIT/MaRisk-compliant documentation with clear responsibilities and evidence management.

Technologies and tools: Confluence, Jira, ServiceNow, Microsoft PowerPoint, Microsoft Visio, Office 365.

Analyzed existing Business Continuity Management (BCM) processes with regard to DORA RTS 86 Article 26.

Identified gaps against regulatory requirements and developed a tailored action plan to close these gaps.

Revised all existing Business Continuity Plans (BCPs), including all nine relevant scenarios with a focus on third-party dependencies.

Defined test strategies to verify BCP effectiveness and held regular alignments with IT, risk management and compliance.

Adapted BCPs to the technical and organizational specifics of Lloyds Bank Germany.

Result: Fully revised, DORA-compliant Business Continuity Plans; strengthened operational and digital resilience, implemented a regular test plan including RTO/RPO definitions and emergency communication paths, and preparation for supervisory audits.

Technologies and tools: Office 365, Confluence, Jira.

Supported the implementation of the requirements of the Digital Operational Resilience Act (DORA) as well as regulatory requirements from BAIT and MaRisk.

Reviewed, redesigned and negotiated third-party contracts to ensure compliance with BAIT, MaRisk and DORA.

Developed a comprehensive SLA and control framework covering all requirements from DORA/RTS.

Revised and redesigned policies for IT governance, ICT risk management, information security management, monitoring, outsourcing and procurement.

Ensured fulfillment of BaFin document requirements under DORA.

Adapted the outsourcing strategy to the requirements of DORA and MaRisk.

Planned the Digital Operational Resilience (DOR) strategy to strengthen the operational resilience of the IT infrastructure.

Designed the IT asset management strategy and supported the implementation of the information network under DORA.

Developed a risk-based methodology (tool) for evaluating PS 951, ISAE 3402, SOC 1, SOC 2, SOX, PCI DSS and KRITIS audit reports.

Trained employees in third-party risk management and created a procedure for audits.

Supported the execution and assessment of audit reports from key service providers and suppliers.

Responsible for creating the information register.

Result: Successful alignment of IT and security processes with BAIT, MaRisk and DORA/RTS; introduction of an SLA and control framework and a risk-based audit report evaluation to increase organizational resilience.

Technologies and tools: Confluence, Jira, Microsoft PowerPoint, Microsoft Visio, Office 365.

Contributed to a group-wide project to modernize the architecture as part of the Credit Risk Architecture Modernisation Program at Erste Bank Group in Austria and CEE.

Aimed at consolidating and modernizing the entire risk portfolio, including replacing mainframe-heavy processing in Austria and harmonizing systems in the CEE countries.

Integrated new requirements (Basel IV-compliant rating models, early warning systems, property revaluations) into the target architecture.

Ensured compatibility and performance of the new environment for batch processing and online channels, as well as integration of internal and external data sources (e.g., KSV, CRIF).

Reviewed contracts, managed service providers and renegotiated terms for the redesigned target environment.

Combined enabler and business epics in a proof of concept for functional validation.

Implemented an OpenShift environment for computing and used DB2 on z/OS and PostgreSQL on RHEL for data management.

Prepared for the long-term replacement of the central ADABAS database for risk management through data replication and streaming.

Applied PMI, SAFe Lean Portfolio Management, IT GRC assessments, KPIs and Lean Guardrails.

Result: A high-performance, future-proof target architecture with improved performance, higher regulatory compliance and unified risk systems in Austria and CEE.

Technologies and Tools: Experian, FICO, SAS, Confluence, Jira, ITSM, ITAM, central authorization application, cross-platform banking applications, z/OS, ADABAS, DB2, PostgreSQL, Google Cloud, Red Hat OpenShift Container Platform, Kafka.

Supported implementation of regulatory requirements from BaFin and EBA and ensured IBM’s contractual obligations.

Focused on encrypted data transmission in a complex IT environment with IBM z Systems and AIX Power Systems.

Analyzed an environment with around 1,500 AIX Power Systems and one of the largest DB2 installations in Europe.

Identified gaps in meeting encrypted data transmission requirements in an environment with over 70 savings bank associations.

Prepared a final report with a detailed plan to fix deficiencies and define necessary implementation measures.

Defined technical interventions in applications, databases, web application servers and branch workstations.

Created a management summary to prioritize the program and the team backlog for an Enabler Agile Release Train (ART).

Documented the as-is state and created enabler epics.

Evaluated the IBM Global Security Kit (GSkit) in the DevOps environment.

Prepared a requirements specification with user stories for all eight network segments in the ART.

Planned and coordinated internal processes with the Certification Authority (CA) and resource planning for enabler PIs in the ART.

Defined Definition of Done and review processes for system testing, acceptance and maintenance.

Documented audit and investigation capabilities and test procedures for use by internal IT compliance.

Regulatory and Methodology: Implemented requirements from the BaFin circular dated 16.08.2021, BAIT, MaRisk, BIS; applied PMI, SAFe (Product Owner/Product Manager), KPIs and Lean Guardrails.

Technologies and Tools: Confluence, Jira, ITSM, ITAM, central authorization application, cross-platform banking applications, z/OS, AIX, DB2, RACF, GSkit, WebSphere, Apache.

Conducted a preliminary study and developed a phased implementation plan to consolidate and harmonize supplier contracts and external partner data.

Objective: Eliminated lack of transparency in collaboration between public administration and external partners caused by missing change management during the agile transformation of IT application development.

Analyzed the impact of not having a LACE team (Lean-Agile Center of Excellence) and an APMO (Agile Program Management Office).

Reviewed audit reports from the Austrian Court of Audit and internal audit.

Used audit reports and stakeholder interviews to create epics to identify legal requirements and business needs.

Analyzed data from the development value streams to assess complexity, costs, and efforts.

Applied SAFe for Government (Business Agility Assessment, Kanban at epic, solution, program, and team levels, Lean budget guardrails, participatory budgeting, MVPs, agile contracting).

Prepared an approximately 100-page preliminary study including a management summary, phase descriptions from epic documentation to user story, root cause analysis with 13 cause items, and a prioritized action plan.

Defined 9 organizational and 5 technological measures, including tool consolidation and feature implementation.

Created requirements and specification documents for program increments (PIs) and defined the target architecture for an end-to-end solution with API integration.

Planned 3 PIs (9–12 sprints), and managed resource allocation and budget approval via agile contracting.

Defined system testing, acceptance, and maintenance processes (definition of done, reviews, retrospectives, inspect & adapt).

Ensured audit and investigation readiness through standard applications and had a bidirectional influence on the long-term IT strategy and strategic themes.

Technologies and tools: Confluence, Jira, API integrations, cross-platform management tools.