Information Security Framework und Risk Manager, Projekt Manager: IT Project und Compliance Manager

During Assignment at Arlanxeo
2018.10 - 2020.01
Arlanxeo Holding B.V., Maastricht
Role: GRC Manager Information Security
* Definition and Implementation of a new Information Security Governance model for a medium-sized
but globally acting chemical conglomerate after legal carve-out of group
* Design organizational structures, top policies (ISMS, Information Classification, Identity &
Access Controls, Security Incident Management), processes, role descriptions
* Define Information Security Risk Management framework, aligned with enterprise risk framework
* Perform risk assessments for new IT assets and services to be introduced
* Define and coordinate set-up activities of Chief Information Security team to ensure operational
readiness for day of handover responsibilities
* Support selection process of service partners and resources
* Manage operational set-up of function
* Serve as CISO delegate for meetings with key IT service providers
* Prepare group-wide quarterly committee meetings
* Prepare and facilitate information security audits performed by mother company

Fraud - Voice Records Archiving

* Development of a strategic service model for archiving platform and related eDiscovery
services, supporting enhancement of global service centre capabilities
* Design of additional modules to complement existing IT architecture, including network &
firewall enhancement, servers, storage, IT security controls, operating systems, data protection,
identity and access management process and controls, IT Operations management and disaster
recovery
* Create architectural and compliance documentation for archiving platform
* Conducting any required compliance and IT Security assessment
* Creation of Identity and Access Management Key Operating Procedure and work instructions
* Management of interface with control units
* Project- and financial planning in line with 2020 strategy
* Project management of implementation activities
* Project reporting
* GDPR (EU-Datenschutz-Grundverordnung EU-DSGVO): Gap-Analysis, compliance assessments and
mitigation planning for strategic archiving platforms

Role: Technical Information Security Officer and Compliance Officer
* Design, Auditing, documentation and monitoring of compliance with regard to IT-Grundschutz
requirements, ISO 27001, BAIT and Deutsche Bank policies & standards
* Creation and maintenance of policies, work instructions for usage and access of Archiving and
data retrieval systems, ensuring legal and regulatory compliance with regard to data storage,
data retrieval and data transfer

* Risk Management: Review and monitor global adherence of processes, policies and procedures,
business critical IT systems, and vendor engagements with regulatory, legal requirements and
company policies
* Policy Production: quality assurance/author/co-author of group-wide policies for records
management, meta data requirements, archiving, and handling of electronically stored information
* Audit Coordination: serve as interface with auditor, support managers to collect and prepare
evidences, track and report on evidence delivery progress; track mitigation progress on findings
* Information Security: Business Information Security Officer for business critical applications:
performing information security and compliance related assessments, creating Identity and Access
Management Key Operating Procedures, implementing standard access processes and role concepts
(incl. Segregation-of-Duty rules)
* Supporting project team to plan global implementation of GDPR requirements: Subject matter expert
to advise team members about existing protection mechanisms, controls and data storage concepts of
the bank

* Risk Management: Development of risk framework and procedures, risk assessments, risk mitigation
planning, risk reporting, risk mitigation status tracking and operational effectiveness testing of
implemented controls
* Policy Production: quality assurance/author/co-author of eDiscovery specific procedures (e.g.
preservation of meta data of court relevant electronically stored information)
* Audit Coordination: serve as interface with auditor, support managers to collect and prepare
evidences, track and report on evidence delivery progress; track mitigation progress on findings
* Information Security: BISO for business critical applications: performing information security
and compliance related assessments, creating ID and Access KOP, implementing standard access
processes and role concepts (incl. SoD rules)

* Interim manager - GFS Main BISO (roles & responsibilities according to ISMS standard role
definition; all overall business relevant decision making remains with Group Finance Chief BISO)
* Executing GFS transition management, coordinate transitioning of dedicated regular tasks into
Central IS Services and/or Group Finance ISG team as appropriate (in line with Global BISO Target
Operating Model)

Deutsche Bank AG, Group Information Security Office
Task: Reorganisation of the Business Information Security Officer Organisation
* Supporting internal Programme Management
* Overall programme planning and risk management
* Heading Programme Management Office
* Development of training concept
* Conducting training sessions for first wave of new joiners
* Conducting bi-weekly Advisory Committee Meetings with Chief BISOs
* Agreeing with divisional management on transition approach
* Setting up approach and work instructions for transition
* Providing logistical support for pilot transition team
* Management of Pilot
* Coordination of internal audit requests regarding Programme

Deutsche Bank AG, Global Technology, Eschborn, New York, London,
Moscow, Singapore
Task: Global Deployment and Support of Operational Risk Management Function
* Derivation and design of key processes from bank's risk framework and regulatory obligations
(e.g. Basel ii, MaRisk)
* Design of organizational interfaces with adjacent functions
* Implementation of global operational risk management service centre with regional support teams
* Process documentation
* Design and Implementation of global organizational ORM role model, determination of training
requirements and organizational Risk Management profiles
* Planning, preparation and conducting of global trainings, deployment of global network of risk
experts
* Design and Implementation of ORM reporting
* Analysis and evaluation of risks and mitigation measures
* Preparation and conducting of unit specific OR Workshops in order to identify most significant
risk prone areas
* Conducting of scenario analysis and survey of risk profiles
* Design, technical implementation and administration of communication portals, content generation
* Design and administration of risk inventory database
* Preparation of working basis (e.g. forms, databases, checklists) for ORM team and risk management
experts
* Support of internal audits
Role and Activities: Interim Manager and Process Expert
* Member of GT ORM core team
* Strategy Planner
* Workshop moderator, trainer and ORM helpdesk
* MS Sharepoint developer and administrator