About me
I started with servers, not with buttons. It shows in the things I build.
Who does this
I started with the hardware, training as an electronics technician. Since 2006 I have run web hosting, domains and DNS on my own account, moving servers, databases and entire CMS installations — and in the same year I took on the server infrastructure of a network around 3D and computer graphics, which I own to this day. Once you have rolled back a migration in the middle of the night, you develop a different relationship to the question of what a website actually is: not a picture, but a system that runs — or does not.
A degree in interactive media at Augsburg University of Applied Sciences added the other half. Design and technology sat in the same programme there, and that is exactly how I have worked ever since: I design what I go on to build myself. That removes the handover — and with it the moment when a concept meets a "sorry, not technically possible".
From 2015 I was lead frontend engineer at the agency anfema in Munich, leading a team of permanent developers, working students and freelancers. The work there was software that has to run and grow for years: a presenter app for BMW dealerships in ten languages, IDnow’s video identification as an embeddable SDK, a promoter platform for several thousand users, Knauf’s augmented reality planner.
Since 2024 I have been information security officer at a group of around 600 people in six countries: ISO 27001, TISAX, SOC 2 and NIS2 sit with me. I was solely responsible for moving the entire ISMS to ISO 27001:2022. And because no off-the-shelf product covered what was actually needed, I built the GRC platform myself — SvelteKit, Node, Postgres, AWS. It now brings thirteen standards together in a single control model. Security work and software development are the same craft approached from two directions.
Alongside that I look after my own clients: a shop that turns phone snapshots into 3D figurines, a configurator for laser-engraved build plates, a firm of lawyers at the Federal Court of Justice, a Munich product design studio. That two of them involve 3D is no accident — the scene has been with me for almost twenty years. Very different houses, but all of them rest on the same conviction: a website is only finished when it runs without me.
Information Security Officer
Pixida · since 2024Since 2024 I have been responsible for information security across a group of around 600 people at sites in Germany, Brazil, Portugal, the USA, China and the United Arab Emirates — holding ISO 27001, TISAX, SOC 2 and NIS2. On top of that comes a GRC tool I build myself, which by now covers thirteen standards.
- People
- ~600 People
- Countries
- 6 Countries
- Standards owned
- 4 Standards owned
- Standards in the platform
- 13 Standards in the platform
- DE
- BR
- PT
- US
- CN
- AE
Owned by me
- ISO 27001
- TISAX
- SOC 2
- NIS2
Audits led and supported with: DEKRA (Germany) · Johanson Group LLP (USA)
In-house build
GRC platform — built from the ground up
No off-the-shelf product covered what a group with six sites and a dozen parallel standards actually needs. So I built the platform myself — from the data model through backend and interface to the permission concept and operations. By now it covers what elsewhere requires a licensed specialist application.
- SvelteKit
- TypeScript
- Node.js
- PostgreSQL
- AWS
- M365
- SCF
Governance & evidence
- Risk management with assessment and follow-up
- Opportunities and risks in one register
- Controls across thirteen standards
- Committees, meetings and minutes
- Audit evidence management
Workflows
- Software approval workflows
- Tasks with owners and deadlines
- Onboarding for new staff
- Annual planner and QM calendar
- Policies with approval and validity
Integration
- Microsoft 365 and SharePoint
- AWS environment
- Calendar integration
- Role-based access control
Reporting
- Dashboards with key figures
- Exports for auditors and management
- The Secure Controls Framework (SCF) as the basis for cross-standard consolidation
Additionally covered by the platform
- ISO 9001
- ISO 14001
- ISO 27017
- ISO 27018
- ISO 27701
- ISO 42001
- IATF 16949
- IEC 62443
- C5:2020
Led single-handedly
ISO 27001: transition to the 2022 revision
I was solely responsible for moving the entire ISMS from the 2016 edition to ISO/IEC 27001:2022 — from the gap analysis through a business impact analysis across every site to the passed external audit. The revision did not merely reshuffle controls: it demands evidence of which process carries the business, and how long the business holds without it.
- ISO 27001:2022
- Annex A
- SoA
- BIA
- RTO/RPO
- A.5.30
- Interne Audits
Analysis & planning
- Gap analysis against the new standard
- Project plan, milestones, responsibilities
- Alignment with management, IT and business units
- Training everyone involved on the new structure
Controls & applicability
- 93 controls in four themes instead of 114 in fourteen areas
- Eleven new controls introduced — including threat intelligence, cloud services, data leakage prevention, secure coding, monitoring and configuration management
- Statement of Applicability rebuilt, every inclusion and exclusion justified
- Control attributes made usable for reporting and filtering
Risk & continuity
- Risk methodology reworked: protection goals, likelihood, impact, treatment
- Business impact analysis across all sites: which process carries the business, and how long does it hold without it?
- Recovery time and tolerable data loss defined per process (RTO/RPO)
- ICT readiness for business continuity established per A.5.30
- Asset inventory and classification linked to the findings
Documentation & audit
- Policies, processes and procedures rewritten for the new terminology
- Internal audits across every business unit
- Readiness assessment ahead of the external audit
- Support through the recertification audit to the pass
Leading audits and passing them
I lead and support the audits for my standards myself — with DEKRA in Germany and the Johanson Group in the USA. From internal pre-assessment through evidence management to accompanying the external auditors on site. Plus risk management, supplier security and incident response coordination. The craft lies less in the document than in making sure the practice behind it actually happens.
AWS cloud security
Network architecture and hardening of the cloud environment: VPC design, security groups, EC2 setup and the question of who may actually access what — and why.
Security that holds in everyday work
Policies, processes and awareness across several countries — set up so that people can work with them instead of working around them.
- ISMS
- GRC
- ISO 27001
- TISAX
- SOC 2
- NIS2
- SvelteKit
- AWS
- VPC
- EC2
- IAM
Agency years
anfema · 07/2015 – 05/2024As lead frontend engineer at the agency anfema in Munich and Augsburg I led a team of permanent developers, working students and freelancers. These projects were built during that time.
Working student → lead frontend engineer, fullstack & project management 07/2015 – 05/2024 Munich
anfema
2015 – 2024Agency website
A digital agency’s own presence is the hardest brief there is: it has to prove what the studio can do before a client has seen a single project. Bilingual, with the full project portfolio and a careers section that actually brings in applications.
My part: Frontend development, implementation
View project at anfema ↗- Frontend
- i18n DE/EN
- Portfolio
- Recruiting
MYSTAFFPILOT
2015 – 2024Promoter platform
A complete platform for handling promotion assignments — iOS and Android apps, a web portal for promoters and an internal application. It covers the entire path from recruiting through scheduling to invoicing and is used by several thousand people.
My part: Product owner and project lead, frontend, backend, UI/UX, billing logic
View project at anfema ↗- Product Ownership
- iOS & Android
- Web-Portal
- Billing
- PostgreSQL
Boston Consulting Group
2019 – 2023Internal applications
Four years of development for the Munich and Boston offices of one of the world’s leading management consultancies — with the demands on confidentiality and reliability that this environment takes for granted.
My part: Frontend, backend, deployment, project responsibility
- Frontend
- Backend
- Deployment
- Enterprise
Knauf
2019 – 2023ARoom — augmented reality app
A planning app for wall and ceiling elements that shows the result directly in the real room via markerless augmented reality. The real task: organising an enormous number of variants so that non-experts reach a design in just a few steps.
My part: Frontend, backend, project responsibility, testing
View project at anfema ↗- Augmented Reality
- SLAM
- Configurator
- API-Design
RECRUITEER
2022 – 2024Recruiting platform
Building a recruiting platform from interface to API — including product ownership, test coverage and documentation, so the team could keep building independently after handover.
My part: Frontend, backend, testing, documentation, PO/PM
- Product Ownership
- Testing
- CI/CD
- Docker
Lokato
2016 – 2020Platform & design
Four years of continuous responsibility for a Munich product: design, frontend, backend and deployment in one pair of hands — still my favourite way of working.
My part: Frontend, backend, deployment, UI/UX, design, testing
- Fullstack
- UI/UX
- Nginx
- Deployment
HAIR HAUS
2018 – 2022Frontend development
Frontend work for a wholesaler with a grown system landscape — the kind of project where integrating with what exists demands more care than the interface itself.
My part: Frontend development
- Frontend
- Legacy-Integration
- SCSS
Further clients
- BMW
- Audi
- IDnow
- Pingonaut
- Takeda
- Zurich
- Paulaner
- Unitymedia Kabel BW
- CLX Europe
- Seven.One Entertainment
+ NDA
Alongside these came numerous further projects that may not be shown publicly for contractual reasons.
Career
- since 05/2024
Information Security Officer
Pixida GmbH·Munich
Information security for around 600 people in six countries: transitioning the ISMS to ISO 27001:2022, TISAX preparation, SOC 2, internal audits, risk management — plus the self-built GRC platform.
- since 12/2021
Owner
C4DNetwork Group·Augsburg
A network around 3D and computer graphics that I have been part of since 2006 and took over in December 2021 — run from Augsburg ever since. That closeness to the 3D scene is why projects like 3D Memories and PlateForge sit so naturally with me.
- 07/2015 – 05/2024
Working student → lead frontend engineer, fullstack & project management
anfema GmbH·Munich
From working student to owning the entire frontend team and its technology decisions over nine years. Plus backend and UI/UX work, looking after long-running B2B and B2E applications across their whole lifecycle, project management including quotes and invoicing — and onboarding new developers and working students.
- since 07/2006
Owner
CGHostGroup·Augsburg
Design, development, server and system migrations, maintenance and bespoke client solutions — on my own account for almost twenty years.
- 2006 – 2012
Technical administrator
C4DNetwork Group·Berlin
Running and securing the server infrastructure, including development — this is where I learned what systems look like under load and under attack.
Education
- 10/2013 – 09/2018
BA Interactive Media
Technische Hochschule Augsburg
Design and technology within one degree programme — the reason the two have stayed together in my work.
- 11/2006 – 05/2010
Apprenticeship as electronics technician
Completed with certificate
Starting with the hardware — before any of it was about software.
Certifications
- ISMS Security Officer nach ISO/IEC 27001:2022 ICO
- ISMS ISO 27001:2022 Professional ICO
- ISMS ISO 27001:2022 Foundation ICO
- Open Telekom Cloud Architect Deutsche Telekom
- Open Telekom Cloud Practitioner Deutsche Telekom
- Open Telekom Cloud Essentials Deutsche Telekom
- Open Telekom Cloud Fundamentals Deutsche Telekom
- SAFe Product Owner / Product Manager (6.0) Scaled Agile Inc.· 2024
Languages
- German Native
- English Fluent