Governing information security and usage of AI through technical judgement, operational leadership, business application
My goal is simple: turning risk, regulation, and secure AI adoption into a competitive advantage.
I have spent eighteen years in information security and risk, most recently as CISO at Finoa, a BaFin-regulated crypto-asset service provider, where I established the IT risk and cybersecurity control environment and put AI controls in place ahead of the EU AI Act obligations that took effect in August 2026.
I have worked all three lines of defense. I started in network and security engineering, moved into security architecture at adidas, spent two years in internal audit, and have led second-line risk and security functions since.
That range is why I can sit in a design review with engineers and in a board update on the same day. What I care about right now: AI is absorbing the manual middle of governance work, evidence collection, control testing, regulatory mapping. That makes the human part more important, not less.
Someone still has to decide what good looks like, ask what the tool did not ask, and put their name behind the answer. I use AI in my own control work, including tooling I built myself, and I govern it to the same standard as any AI the business adopts.
The frameworks and regulation behind that work: DORA, BaFin ZAIT, ISO 27001, EU AI Act, NIST AI RMF, NIST CSF, SOC 2, MITRE ATT&CK and ATLAS. CISSP. ISACA Advanced in AI Security Management, exam passed August 2026, certification application submitted. Open FAIR Foundation. CCSK.
Open to CISO and principal-level information security and risk roles in Berlin or remote. Working language English.
Heelr is the cybersecurity services marketplace by Cyberr. Compare verified providers, agree scope and pay through protected payments.