About Michael Georg
DORA | NIS2 | AI-Act | CRA | IT-Audit Defense | Third-Party Risk Management (TPRM) | Compliance | ISO 27001 | BSI Grundschutz | Digital Operational Resilience Testing (DORT) | SBOM-Strategien | GRC | ToM | sfO | Verfahren | Massnahmen | Richtlinien | Prozesse | Operations | Ausschreibungs-Recht | IKS
1. IT-Regulatorik & IT-Compliance
Schwerpunkte: Ganzheitliche Umsetzung und Prüfung von DORA, NIS2, AI-Act (KI-Verordnung), Cyber Resilience Act (CRA), Data Act, SOX IT-GC (US)
Dokumentation: Erstellung rechtssicherer Policies, ToMs, Prozess-/Service-Beschreibungen und SLAs -BIA, BCM
Spezialwissen: Blue Guide, Maschinenverordnung, IDW EPS 528, CSSF 25/881 sowie EBA/EIOPA/ESMA Guidelines
2. Audit Prep, Management & Defense (High-End)
OSI-Erfahrung: Vorbereitung und Verteidigung von On-Site Inspections (OSI) und Prüfungen durch EZB, BaFin (§44 KWG) , CSSF, FINMA und BSI
Prüfungsbegleitung: Management von IT-Jahresabschlussprüfungen (JAP), Remediation/Mitigation von Findings, Vermeidung von Bußgeldern
3. Third-Party Risk Management (TPRM) & Cloud Governance
Supply Chain Security: Management von Drittpartei-Risiken, Wertschöpfungskettenanalyse und Implementierung von SBOM (xBoM) Strategien
Cloud-Sicherheit: Compliance-Prüfung und Due Diligence für Outsourcing-Vorhaben zu AWS, Azure, Google Cloud und Salesforce
Vertragsgestaltung: Unterstützung bei komplexen Outsourcing-Verhandlungen und Exit-Strategien
4. IT-Risikomanagement & Resilience
Methodik: ERM, IRM, BIA, BCM und Aufbau von Meldeketten nach regulatorischen Anforderungen & internationalen Standards (NIST, ISO 2700x, ITIL, COBIT)
Testing: Konzeption und Durchführung von Resilience-Tests und Szenario-basierten Risikoanalysen, Legal Requirements
5. Projektbegleitung & Coaching
Interim Management: Proaktive Compliance-Begleitung von IT-Projekten (DevSecOps) und Sparringspartner für Projektleitungen
Awareness: Durchführung Management-Workshops / Schulungsprogramme zur Vermittlung gesetzlicher Kompetenzanforderungen
English
Native or bilingual
German
Native or bilingual
Can work on-site
St. Gallen (up to 50km)
Experience
- GREY APEInterim Advisor EU IT Regulation Compliance: #NIS2, #DORA, #CRAOctober 2023 - Today (2 years and 8 months)I will help you comply with regulations including but not limited to NIS2, DORA, CRA, etc., and go beyond simply rephrasing the WHAT but help you with the HOW and WHY as only informed and reasoned decisions will last in the long term
- FREELANCERIndependent external ICT Risk Control FunctionNovember 2024 - Today (1 year and 7 months)I serve as an independent external (interim/virtual/fractional) IT Risk & Compliance Control Function in the form of a fully outsourced service or supporting and consulting existing functions as a complementary service
- FREELANCERIT Audit Preparation and DefenseJuly 2023 - Today (2 years and 11 months)2. Documentation & evidence• - Ensuring complete and up-to-date documentation (e.g. guidelines, SOPs, controls)• - Systematic archiving of relevant emails, contracts and protocols• - Proof of implementation and compliance with internal and regulatory requirements5. Follow-up & lessons learned• - Review of audit results and identification of areas for optimization• - Development and implementation of measures to close identified gaps• - Documentation and sharing of findings for future audits• - got no LMS but Intranet? got you covered...
Recommendations
Be the first to recommend Michael Georg
Help this freelancer shine by sharing your experience working together.
These freelancer profiles also match your criteria
Agatha Frydrych
Backend Java Software Engineer
4.7
(3)
2
Baptiste Duhen
Fullstack developer
4.6
(4)
5
Amed Hamou
Senior Lead Developer
4
(2)
7
Audrey Champion
Web developer
4.3
(3)
4
Education
- Project Management Foundations: Schedules Implementing the NIST Risk Management Framework Project Management Simplified Certified Information Systems Auditor (CISA) Exam Business EthicsProject Management Foundations: Schedules Implementing the NIST Risk Management Framework Project Management Simplified Certified Information Systems Auditor (CISA) Exam Business Ethics
- Outsourcing Software Packaging and Distribution - RfQLZPD2004Outsourcing Software Packaging and Distribution - RfQ