DEEN
Contact
Menu
HomeProject experience
02

Project experience.
Responsibility in detail.

From international EDR and SOC leadership to security architecture and incident response: 31 project profiles describe responsibilities, roles and contributions across different industries. Clients are presented anonymously.

Experience by area of work

Relevant experience.
Ready to explore.

31 profiles · Engagements and selected workstreams. Related project phases are grouped together. Open a profile for tasks and technologies.

01

Engagement started 01/2025

International wholesale group

Cyber defense maturity & group-wide security metrics

Connecting an evidence-based maturity assessment with metrics governance, management reporting and international forensic readiness.

My role
Security Metrics Lead · Cyber Defense Assessment Lead
Explore tasks & technologiesClose details

Tasks and contribution

  • Assess cyber defense capabilities using NIST CSF 2.0: scoring model, differentiated targets, gap analysis and a traceable assessment report.
  • Review existing KPIs and specify revised definitions with measurement populations, formulas, evidence references and traceability to source data.
  • Develop a group-wide security metrics programme with clear governance and decision-oriented management reporting.
  • Design internationally deployable forensic capabilities with evidence-preservation profiles and country-specific tiers.
Technologies & methods

NIST CSF 2.0 · Security KPI Engineering · OSMS · Forensic Readiness

02

02/2025 – 12/2025

International wholesale group

Global EDR responsibility & SOC operations

EDR and SOC initiatives across 35+ country organisations in an environment with more than 60,000 assets: central platform ownership, international operations and coordination of critical security incidents.

My role
Head of Endpoint Detection & Response · SOC Operations Lead
Explore tasks & technologiesClose details

Tasks and contribution

  • Manage the CrowdStrike Falcon platform, develop policies and integrate EDR into SOC processes.
  • Align detection use cases with operational requirements; develop telemetry and data quality with security engineering.
  • Coordinate responses to critical incidents across security operations, threat intelligence and business stakeholders.
Technologies & methods

CrowdStrike Falcon · Google Chronicle · Cisco XDR

03

Workstream within the 2025 EDR engagement

International wholesale group

Endpoint Control: Trellix → CrowdStrike

Migration of endpoint control capabilities across around 24 countries. This profile details a workstream within the EDR/SOC engagement described above.

My role
Leadership of the cross-country Device Control migration
Explore tasks & technologiesClose details

Tasks and contribution

  • Align technical requirements and existing policies for the transition from Trellix to CrowdStrike Device Control.
  • Coordinate central security functions and local operational owners within the migration programme.
  • Work on USB controls, policy translation and opportunities for API-based automation.
Technologies & methods

Trellix · CrowdStrike Falcon Device Control · API

04

03/2023 – 12/2024

International energy trading

SOC processes, SIEM use cases & security KPIs

Development of cybersecurity operations, spanning structured SIEM onboarding, service processes, metrics and risk-based alert prioritisation.

My role
Cybersecurity Engineer SOC · Process and metrics advisory
Explore tasks & technologiesClose details

Tasks and contribution

  • Optimise and document SIEM use cases; structure application onboarding and works council documentation.
  • Refine end-to-end processes and KPIs for SIEM, EDR, NDR, XDR, threat hunting, threat intelligence, vulnerability and incident management.
  • Develop a criticality model for risk-based SIEM alerts; support quality assurance and provider management for threat intelligence and threat hunting.
Technologies & methods

SIEM · ISMS · Security KPIs · Risk-based Alerting

05

08/2020 – 03/2023

International energy trading

IAM and directory migration with redesigned JML processes

Replacement of a legacy in-house IAM and directory system, including connected subsystems and interfaces.

My role
Advisory and implementation support for IAM, directory services and processes
Explore tasks & technologiesClose details

Tasks and contribution

  • Support migration of the corporate directory service to an IAM solution and Active Directory Lightweight Directory Services.
  • Redesign joiner, mover and leaver processes and support their implementation.
  • Identify data quality issues and implement corrections to improve consistency across connected systems.
Technologies & methods

IAM · AD LDS · Directory Services · Joiner / Mover / Leaver

06

09/2022 – 10/2022

International enterprise

CISO and taskforce support following ransomware

Advisory following an incident involving data theft, encryption and extortion at an overseas corporate site.

My role
Strategic incident response advisory to the CISO and taskforce
Explore tasks & technologiesClose details

Tasks and contribution

  • Structure the incident response approach with the CISO and taskforce.
  • Prioritise actions and support communication and coordination between internal and external stakeholders.
  • Assess impact, recommend remediation measures and support their implementation.
Technologies & methods

Incident Response · Crisis Coordination · Remediation

07

02/2022 – 12/2022

Industrial enterprise

Information security advisory & disaster recovery review

Support to the CISO on security policies, priority areas and the assessment of existing recovery processes.

My role
Information Security Advisor
Explore tasks & technologiesClose details

Tasks and contribution

  • Assess security issues and required action; advise on organisational standards and policies.
  • Review disaster recovery processes and documentation against business continuity objectives.
  • Identify gaps and recommend improvements to recovery and resilience.
Technologies & methods

Information Security Governance · Disaster Recovery · Business Continuity

08

2019 – 2020

International insurance group

SIEM taskforce: use cases, playbooks & incident analysis

Review and development of the detection and response chain across the SIEM, SOC and service providers.

My role
SIEM taskforce · SOC advisory and L2/L3 support
Explore tasks & technologiesClose details

Tasks and contribution

  • Validate, refine and create SIEM use cases and playbooks.
  • Perform end-to-end testing and review processes and interfaces between internal teams and providers.
  • Support the SOC in analysing and handling L2/L3 security incidents.
Technologies & methods

Elasticsearch · Logstash · Kibana · SIEM · Playbooks

09

01/2019 – 04/2019

Transport and logistics company

Network and security architecture for a new site

Establishing the technical foundation for a new company site, including networking, telephony and updated security policies.

My role
Network design and implementation support
Explore tasks & technologiesClose details

Tasks and contribution

  • Design and implement the network architecture for the new site.
  • Plan and support the VoIP transition, including selection and integration of hardware and software.
  • Adapt security policies to the new operating and technology environment.
Technologies & methods

Network Architecture · VoIP · Security Policy Design

10

01/2018 – 12/2018

International banking group

Central logging platform for near-time security analysis

Development of a central data platform to collect and analyse security-relevant logs in near real time.

My role
Coordination and support for planning and implementation
Explore tasks & technologiesClose details

Tasks and contribution

  • Coordinate the planning of a logging infrastructure based on Elastic Cloud Enterprise.
  • Support architecture and data ingestion using Elasticsearch, Logstash and Kibana.
  • Support component deployment and integration, including scalability and data quality considerations.
Technologies & methods

Elastic Cloud Enterprise · Elasticsearch · Logstash · Kibana

11

10/2018 – 12/2018

International banking group

Network behaviour detection in the data centre

Introduction of a network behaviour anomaly detection solution to monitor internal data centre networks.

My role
Technical implementation support
Explore tasks & technologiesClose details

Tasks and contribution

  • Support the introduction of Cisco Stealthwatch in a banking environment.
  • Support deployment for detecting anomalous behaviour within data centre networks.
Technologies & methods

Cisco Stealthwatch · Network Behavior Anomaly Detection

12

09/2017 – 01/2018

International banking group

Requirements analysis for VPN harmonisation

Assessment of whether different VPN operating environments could be consolidated while meeting their business and technical requirements.

My role
Requirements analysis and feasibility assessment
Explore tasks & technologiesClose details

Tasks and contribution

  • Review and document requirements across the individual VPN operating environments.
  • Assess existing solutions for compatibility and consolidation opportunities.
  • Present benefits, risks and recommendations to support decision-making.
Technologies & methods

VPN · Network Security · Requirements Engineering

13

08/2016 – 09/2017

International banking group

NBAD & UEBA: assessment, selection and proof of concept

A combined profile of the 2016 assessment and preparation phase and the subsequent 2017 proof of concept for network and user behaviour analytics.

My role
Technology assessment and PoC support
Explore tasks & technologiesClose details

Tasks and contribution

  • Assess requirements, deployment options, data availability and suitable solutions.
  • Define scope, scenarios and evaluation criteria for the proof of concept.
  • Present findings on detection quality, integration and operational effort to support selection decisions.
Technologies & methods

NBAD · UEBA · Proof of Concept · Evaluation Criteria

14

01/2016 – 12/2016

Managed security service provider

SOC and CERT design for managed security services

Support for the planning and development of a SOC/CERT offering for enterprise customers.

My role
Advisory and coaching on SOC/CERT design
Explore tasks & technologiesClose details

Tasks and contribution

  • Review SOC and CERT concepts and support their development.
  • Align enterprise customer requirements with the planned service offering.
  • Support the planning and documentation of the operating concept.
Technologies & methods

SOC · CERT · MSSP · Service Design

15

01/2016 – 08/2016

International banking group

IDS/IPS and data centre segmentation

Assessment of data centres and the core network for intrusion detection/prevention deployment and network segmentation.

My role
Security architecture and feasibility assessment
Explore tasks & technologiesClose details

Tasks and contribution

  • Assess network structure, data flows, existing controls and requirements.
  • Evaluate technical integration, operational impact and options for IDS/IPS and segmentation.
  • Document recommendations and implementation steps, including dependencies and risks.
Technologies & methods

IDS / IPS · Network Segmentation · Data Centre Security

16

11/2015 – 12/2015

International banking group

Quality assurance for SIEM use cases

Review of implemented detection use cases against requirements, detection logic and documentation needs.

My role
Technical quality assurance
Explore tasks & technologiesClose details

Tasks and contribution

  • Review use cases against requirements and security objectives; assess logic, thresholds and conditions.
  • Document data dependencies, review findings and recommendations for the project team.
Technologies & methods

SIEM · Use Case Validation · Detection Quality

17

05/2014 – 11/2015

International banking group

International security logging & forensic archiving

Design of a group-wide logging infrastructure with requirements for integrity, retention and subsequent use in investigations.

My role
Planning and security architecture
Explore tasks & technologiesClose details

Tasks and contribution

  • Plan the collection, processing and centralisation of security-relevant data from different systems.
  • Incorporate requirements for tamper-resistant archiving, traceability and forensic analysis into the design.
Technologies & methods

Security Logging · Log Integrity · Retention · Digital Forensics

18

04/2015

International enterprise

Security assessment following a data leak

Assessment of security posture and priority areas following a reported data leak.

My role
Security assessment and remediation advisory
Explore tasks & technologiesClose details

Tasks and contribution

  • Assess vulnerabilities, threats and gaps in existing controls based on risk.
  • Review internet-exposed servers, firewalls and VPN gateways for security configuration and protection requirements.
  • Develop structured checklists for security reviews at corporate sites.
Technologies & methods

Security Assessment · Internet Exposure · Site Audits

19

03/2014

International enterprise

Forensic investigation of a communications server

Investigation of potential manipulation and sabotage following a reported data leakage incident.

My role
Digital forensics and technical analysis
Explore tasks & technologiesClose details

Tasks and contribution

  • Perform forensic analysis of server logs, configurations and access records.
  • Identify unauthorised changes and relevant evidence for further investigation.
Technologies & methods

Server Forensics · Log Analysis · Configuration Analysis

20

02/2014

Industrial enterprise

Black-box penetration test of external infrastructure

Security assessment of externally accessible systems from the perspective of an attacker without internal system knowledge.

My role
Penetration testing and vulnerability assessment
Explore tasks & technologiesClose details

Tasks and contribution

  • Assess externally accessible infrastructure through penetration testing and vulnerability scanning.
  • Evaluate findings and prioritise immediate mitigation measures.
Technologies & methods

Black-box Penetration Testing · Vulnerability Scanning

21

08/2013 – 04/2014

International automotive manufacturer

Project leadership across four IAM initiatives

Project responsibility across role and access management, directory integration and interfaces.

My role
Project Lead, Identity & Access Management
Explore tasks & technologiesClose details

Tasks and contribution

  • Coordinate the extension of a transfer module between directory services and a new integration path for group and departmental information.
  • Oversee development of a web service interface for access provisioning.
  • Coordinate migration of existing authorisation roles within the programme.
Technologies & methods

IAM · Role Management · Directory Services · Web Services

22

09/2013 – 12/2013

Telecommunications provider

SOC processes, CERT integration & evidence preservation

Development of standardised SOC processes incorporating an existing CERT and forensic workflows.

My role
SOC and incident management process design
Explore tasks & technologiesClose details

Tasks and contribution

  • Design collaboration and escalation paths between the SOC and the existing CERT.
  • Develop a process for the collection, preservation and storage of forensic evidence.
  • Define incident management workflows and responsibilities from detection through post-incident review.
Technologies & methods

SOC · CERT · Incident Management · Chain of Custody

23

07/2013 – 08/2013

International banking group

Forensic data preservation & analysis

Preservation and examination of multiple data sources as part of an internal investigation.

My role
Digital forensics and evidence preservation
Explore tasks & technologiesClose details

Tasks and contribution

  • Create forensic copies of NAS, server and tape storage data.
  • Analyse preserved data for relevant evidence while maintaining data integrity.
Technologies & methods

Digital Forensics · NAS · Server · Tape Storage

24

03/2013

Transport operator in Sweden

White-box security review of an IAM portal

Assessment of an authorisation portal with access to source code, architecture documentation and system configurations.

My role
White-box penetration testing and architecture review
Explore tasks & technologiesClose details

Tasks and contribution

  • Review the IAM portal’s source code, architecture and configurations for vulnerabilities.
  • Document identified weaknesses with specific remediation recommendations.
Technologies & methods

IAM · White-box Penetration Testing · Code Review · Architecture Review

25

01/2013 – 06/2013

International automotive manufacturer

Security assessment in production environments

Work within an international project team assessing critical weaknesses in production environments, including targeted attack considerations.

My role
Security assessment within an international project team
Explore tasks & technologiesClose details

Tasks and contribution

  • Support planning and coordination of weakness assessments in production environments.
  • Support execution and monitoring of assessments, taking advanced persistent threat scenarios into account.
Technologies & methods

Production Security · Vulnerability Assessment · APT

26

08/2012 – 12/2012

Telecommunications provider

Security concept for data centre offshoring

Assessment and design of security requirements for moving data centre operations abroad.

My role
IT security concept development
Explore tasks & technologiesClose details

Tasks and contribution

  • Identify risks to the confidentiality, integrity and availability of affected data and systems.
  • Design controls for access, encryption, segmentation and security monitoring.
Technologies & methods

Data Centre Operations · Access Controls · Segmentation · Security Monitoring

27

07/2012 – 12/2012

International logistics group

Security assessment of a parcel locker system

Assessment of product security and potential attack scenarios as a foundation for SIEM-based security monitoring.

My role
Security assessment and detection design
Explore tasks & technologiesClose details

Tasks and contribution

  • Analyse security posture, model attack scenarios and define relevant attack indicators.
  • Assess network and security components for SIEM integration and recommend suitable detection use cases.
Technologies & methods

Product Security · Attack Modelling · SIEM · Detection Use Cases

28

05/2012 – 06/2012

International enterprise · Germany

Forensic evidence preservation and law-enforcement handover

Digital evidence preservation with integrity verification, malware analysis and documented handover.

My role
Forensic preservation and analysis
Explore tasks & technologiesClose details

Tasks and contribution

  • Create forensic images, verify their integrity and analyse them for malicious content.
  • Prepare evidence for documented handover to law enforcement.
Technologies & methods

Forensic Imaging · Integrity Verification · Malware Analysis

29

03/2012

International enterprise · Italy

Forensic evidence preservation in a white-collar crime case

Preservation of multiple devices and documentation of the evidence chain for proceedings concerning white-collar crime.

My role
Digital evidence preservation
Explore tasks & technologiesClose details

Tasks and contribution

  • Create forensic images of multiple devices and verify their authenticity.
  • Document the chain of custody and preservation steps.
Technologies & methods

Forensic Imaging · Chain of Custody · Authenticity Verification

30

08/2009 – 08/2013

International logistics group

Security management, risk-based triage & anti-phishing

A multi-year engagement spanning incident management, central SIEM, taskforce leadership and security reporting.

My role
Security management · SIEM advisory · Taskforce leadership
Explore tasks & technologiesClose details

Tasks and contribution

  • Develop incident categories and criticality calculations; introduce a risk-based incident triage approach in the client environment in 2010.
  • Support the introduction of ArcSight ESM, develop attack scenarios and use cases, and analyse security incidents.
  • Design and lead an anti-phishing taskforce; develop security reporting and helpdesk training on new processes.
Technologies & methods

ArcSight ESM · Risk-based Triage · Incident Management · Anti-Phishing

31

06/2009 – 07/2009

Bank in Saudi Arabia

Concept proposal for a security operations centre

Preparation of a SOC concept proposal to support a planned security monitoring and response capability.

My role
SOC concept development
Explore tasks & technologiesClose details

Tasks and contribution

  • Describe the core components of the proposed SOC and how they would work together.
  • Bring together SIEM integration, incident response workflows and governance in the concept proposal.
Technologies & methods

SOC Design · SIEM · Incident Response · Governance

Direct contact

Let’s discuss
your requirements.

A short description of your situation, the role you need and the intended timeframe is enough to start. We can then discuss the expertise and scope of responsibility your initiative requires.

Send an email

Remote from the EU · International engagements · German & English

Your choice applies to this browser and can be changed here at any time.

Necessary storage

Always active

We store your choice in local browser storage for 180 days, so you do not have to repeat it on every visit. The entry contains no visitor identifier.

Hosting & access data

This choice does not switch off access-data processing by the hosting provider. Details of IONOS Webhosting and WebAnalytics are available in the privacy notice.

Privacy noticeLegal notice