About
I’m a seasoned cybersecurity professional with experience spanning both hands-on technical work and executive leadership. Since 2016, I’ve worked across roles such as penetration testing and security research, and I later moved into managerial and strategic positions including CISO and Deputy CSO responsibilities -- always with a focus on building security that works in the real world.
Since 2020, my core focus has been building and scaling cybersecurity programs and helping organizations mature their security capabilities. As CISO at Deutsche Bahn Connect GmbH, and later as SISO and Deputy CSO at Taurus SA, I’ve led end-to-end program development -- from defining strategy and governance to driving execution, measurement, and continuous improvement. Today, I serve as CISO at Lindenhofgruppe in Bern.
Alongside industry work, I’ve been teaching cybersecurity since 2017. I regularly deliver courses in cybersecurity (see below for full list) -- ranging from IT forensics and reverse engineering to organizational cybersecurity -- most recently at the Fernfachhochschule Schweiz.
I care about pragmatic security: translating technical risk into clear decisions, building sustainable structures, and enabling teams to deliver securely without slowing down the business.
IT Security Frameworks and Technologies
The following keyword list provides a short excerpt of the frameworks, regulation, and technologies I have worked with in recent years.
- ISMS, Audit: ISAE 3402 + 3000, SOC 2, ISO 27001:2022, IT Grundschutz, DB RRiL 114.02ff., TISAX, CMMI and NIST Maturity Models
- Regulatory Compliance:DORA, NIS2, FINMA Circulars, GDPR, Swiss DSG, CRA, EU AI Act
- Security Assessment: OWASP, MITRE ATT&CK
- Personal Certifications: CISSP, CISM, CIPM
- Security Areas: Mobile Security, Network Security, LLM Security, Azure Security
- Reverse Engineering: x86/x64, ARM, dex, WASM
- Security Testing: Mobile Apps, IoT + OT, Cloud Infrastructures
- Security Tools: Wireshark, Burp, Nmap, Nessus, IDA Pro, Ghidra, angr
Resume
Professional Experience (excerpt)
Chief Information Security Officer
2025 - Present
Lindenhofgruppe AG, Bern, Switzerland
- Lead the enterprise information security strategy, governance, and risk management for a major hospital group delivering interdisciplinary care across multiple sites in Bern.
- Build and run the cybersecurity program (policies, controls, metrics, assurance, reporting) to protect sensitive patient and business data while enabling safe clinical operations and digital transformation.
- Establish executive reporting and security maturity measurement to steer investment, prioritize risk treatment, and drive continuous improvement across the organisation.
- Strengthen operational resilience through incident response readiness, crisis coordination, and cross-functional exercises with IT and clinical stakeholders.
- Drive “security by design” across key initiatives, including identity and access management, third-party risk management, and vulnerability management practices.
Senior Information Security Officer & Deputy CSO
2023 - 2025
Taurus SA, Geneva, Switzerland
- Lead the successful ISO 27001:2022 certification and handled ongoing compliance with controls matching requirements from FINMA circulars, ISAE 3402, and emerging EU regulations (DORA, NIS2, CRA).
- Developed security maturity models (CMMI-based) to measure and improve the overall cybersecurity capabilities, aligning strategic planning with best practices and regulatory obligations.
- Orchestrate the convergence of cybersecurity measures with business objectives, strategically investing in solutions that secure vital assets and reduce risk exposure.
- Continuously improve security policies, processes and operations to match global standards and organizational goals, and implement a maturity model for the organisation reflecting its security strategy.
- Manage the vulnerability management programme and the integration of Static Application Security Testing and Dynamic Application Security Testing within development pipelines to enhance software security.
Chief Information Security Officer
2020 - 2023
DB Connect GmbH, Frankfurt am Main, Germany
- Guide the design, development and deployment of secure technical architectures and organization processes to build organizational capabilities and ensure compliance with international information security standards.
- Drive business and cyber risk strategy alignment to manage risk through value investments, thereby protecting business assets through an understanding of the threat landscape and an effectively managed cyber risk program.
- Management and continuous improvement of the organization's security policies, information security operations, and security-relevant communication policies.
- Management of internal IT security assessments and incident response procedures.
Information Technology Security Consultant
2018 - 2020
Self-employed Freelancer, Erlangen, Germany
- Security assessments and penetration testing on mobile applications and system back-ends with a focus on Android and iOS applications, as well as REST and SOAP back-ends.
- I worked alone, as well as with other industry experts on projects from the fintech, automotive, and critical infrastructure sectors which required deep understanding of application and network security, and familiarity with the ISO 27001 and NERC CIP standards.
- I conducted expert workshops with developers and incident response specialists focusing on penetration testing and forensic incident response scenarios, among others for the German Federal Police.
Education (excerpt)
Lecturer (Cybersecurity, Mobile Security, Reverse Engineering)
2017 - Present
Fernfachhochschule Schweiz (FFHS), DHBW Mannheim, Hochschule Heilbronn, Hochschule München, Hochschule Albstadt-Sigmaringen
- Lectured on cybersecurity governance, mobile application security, reverse engineering, IT forensics, and AI security fundamentals.
- Conducted project-based learning, practical labs, and supervised student research on cutting-edge security topics.
- Focused on network security, mobile threats, business continuity management, AI regulatory compliance, and secure software development.
Doctor of Engineering in Computer Science
2016 - 2020
Friedrich-Alexander University Erlangen-Nürnberg, Erlangen, Germany
With additional research stays abroad at:
San Jose State University, San Jose, USA
Universidade Federal do Paraná, Curitiba, Brazil
- While working as a Ph.D. researcher I focused on app security and malware analysis, especially app hardening solutions against reverse engineering, UI security mechanisms, back-end security, and automated vulnerability screening, e.g., fuzzing and vulnerability scanners.
- In parallel, I also worked as a teaching assistant for courses in “Reverse Engineering”, “IT Forensics”, and “Incident Response”, conveying complex scenarios and techniques to Bachelor’s and Master’s students.
- During this time I had to familiarize myself with many industry standards in IT security, e.g., ISO 27001, OWASP, and ITIL, and leading analysis tools used in penetration testing & forensic analysis, like IDA Pro, Wireshark, Burp Suite, and the Nessus Vulnerability Scanner.
- My research resulted in more than ten publications, my successful participation in bug bounty programs, among others Google's bug bounty program, and a more secure and transparent mobile ecosystem we use every day.
Doctoral thesis: Android Application Hardening: Attack Surface Reduction and IP Protection Mechanisms
Visiting Researcher Cybersecurity
2019
Universidade Federal do Paraná, Curitiba, Brazil
- Research project: Security assessment of mobile solutions and back-end security of Brazils four major banks.
- The project resulted in several design flaws and vulnerabilities that were responsibly disclosed and the publication “The internet banking [in] security spiral: Past, present, and future of online banking protection mechanisms.” which was published and presented at the 14th International Conference on Availability, Reliability and Security 2019.
Master of Science in Computer Science
2014 - 2016
Friedrich-Alexander University Erlangen-Nürnberg, Erlangen, Germany
- Major focus: IT security & cryptography, software development & architectures, distributed systems & cloud computing.
- During my Masters I participated in IT security capture the flag events, gaining expertise in diverse IT security areas, especially about internals of operating systems based on UNIX, several exploit techniques and program analysis.
Master Thesis: Dynamic Deobfuscation of Virtualization-based Packed Binaries