About this site
A brief description of the platform
Systems support people — people create value
Too often, systems and standards are seen as constraints rather than support. In reality, well-designed processes should empower people — not slow them down. When systems are simple, understood, and truly integrated into daily work, they stop being a burden and start creating real business value.
This platform focuses on cyber resilience, GRC, and information security in industrial environments. It combines ISMS, TISAX ®, and risk management with a practical, human-centric approach — bridging the gap between requirements and real-world operations in IT and OT.
All content on this website reflects my personal perspective and does not represent the views of any organization I am connected with.
More about me
My journey in GRC and industrial cybersecurity is driven by a focus on making standards practical and usable in everyday operations
This section provides a deeper view of my experience, working style, and what shapes my approach
Each step is a practical milestone, not just a certificate
Experience
My experience is rooted in production environments, where I bridge standards (IATF 16949, ISO 27001, TISAX ®) with real-world operations. I focus on audits, risk management, and preparing organizations for external assessments and customer requirements.
I specialize in turning formal requirements into practical, repeatable processes that work in daily practice.
Key areas:
• Audit readiness (TISAX ®, ISO 27001, customer-specific)
• Process audits (VDA 6.3 & CQI and other standards)
• Risk management in quality and information security
• Management system documentation
• Employee training and awareness
• Collaboration with certification bodies and global teams
Approach
My work focuses on translating complex requirements into solutions that are clear, effective, and usable in daily operations. I treat audits and standards as tools that support the organization rather than as control mechanisms.
I rely on clear communication, strong process understanding, and cross-functional cooperation—especially at the intersection of quality, IT, and production. The goal is always the same: solutions that are not only compliant, but also efficient and accepted by the people who use them.
LAB
In parallel, I develop my own technical environment related to information security, including virtualization, backup strategies, monitoring, and automation (IoT / OT).
This practical work helps me better understand the technical side of security systems and supports a more effective connection between management systems and real infrastructure.
Selected Certificates & Key Milestones
A selection of key credentials and achievements in quality, security, and GRC
Q&A: Experience, Approach & Practice
How do you turn complex requirements into something that actually works in daily operations?
The key is understanding the process first, not the requirement. I start from how work is really done, then map requirements onto it. In many cases, it’s not about adding new procedures, but structuring what already exists. This reduces resistance and increases adoption.
What is the most common mistake made when implementing standards like ISO 27001 or TISAX ®?
Treating requirements as documentation tasks instead of operational improvements. When the focus is only on “having it written,” systems become disconnected from reality. The real value comes when requirements are embedded into processes and decision-making.
How do you approach audits to make them effective instead of stressful?
I treat audits as structured conversations about processes, not inspections. The goal is to understand how things work and identify gaps early. When people see audits as support rather than control, the quality of information and cooperation improves significantly.
How do you balance strict compliance with operational efficiency?
Compliance is non-negotiable, but the form of implementation is flexible. The decision is whether to integrate a requirement into existing processes or create something new. The best solutions meet requirements while remaining simple and usable.
What role does communication play in GRC and industrial cybersecurity?
A critical one. Even the best-designed system will fail if people don’t understand it. Clear communication translates requirements into everyday language and builds cooperation across departments like production, quality, and IT.
How does your technical lab support your work in management systems?
It allows me to test and understand how systems behave in practice—virtualization, monitoring, backups, and automation. This helps bridge the gap between formal requirements and real infrastructure, making decisions more practical and grounded.
How do you typically approach solving complex problems?
I focus on data and simplicity. Methods like 5Why, supported by facts, are often enough to identify root causes. More advanced tools are useful, but clarity and structured thinking usually bring the fastest results.
What motivates you to keep developing in this field?
The combination of structure and change. Standards provide a framework, but every environment is different. There is always something to improve, optimize, or better understand.