Senior Cyber Security Assessment Consultant / Assessment Team

Project overview

For our end client in the KRITIS regulated energy sector, we are looking for an experienced Cyber Security Assessment Consultant (m/f/d) or a correspondingly qualified expert team for freelance support in conducting a comprehensive IT/OT Security Assessment.

The required qualifications and competencies can also be covered by a team of several specialized consultants. Therefore, it is not absolutely necessary for a single person to fulfill all requirements.

The focus is on assessing the actual security and implementation level based on NIST CSF and ISO/IEC 27001/27002. In addition to reviewing existing security measures and governance structures, the focus is on the effectiveness of implemented security controls, a sound market benchmark, and the development of concrete, prioritized recommendations for action.

Project Framework:

• Start: 05.11.2026
• Duration: Initially until 31.12.2026, with an option for extension (6+ months targeted)
• Utilization: Approx. 40 person-days until the end of 2026 (total volume for the team)
• Location: Remote within Germany, Onsite assignments in Frankfurt am Main upon agreement
• Contract Type: Freelance project support
• Project Language: German

Responsibilities

• Conducting a comprehensive Cyber Security maturity and GAP assessment of the IT and OT security landscape based on NIST CSF and ISO/IEC 27001/27002
• Reviewing the actual implementation of ISO/IEC 27001 controls (Annex A / ISO 27002) through document analysis, interviews, evidence collection, and sample effectiveness checks
• Assessing existing ISMS structures, security processes, and regulatory requirements in the KRITIS environment
• Conducting an organizational control and role effectiveness analysis to review responsibilities and the practical implementation of security controls
• Analyzing governance structures and collaboration between central security requirements and decentralized organizational units
• Conducting on-site inspections and structured interviews with relevant departments and security officers
• Creating a sound market benchmark for positioning the existing IT/OT security level
• Identifying security gaps and developing a prioritized, practice-oriented catalog of measures
• Creating a final report including a management presentation of the assessment results and recommendations for action

Requirements

Mandatory Requirements (to be demonstrated by the service provider or the entire team):

Skills:

Do you have extensive experience in assessing and auditing complex IT/OT security landscapes in the KRITIS environment, or can you cover the required competencies together with other specialized consultants?

Then send your current CV as a Word document, stating your availability, your daily rate, and the requirements you cover, to *@*.com.

The submission of individual specialists to supplement an existing assessment team is also expressly welcome.

• Proven audit procedure competence according to § 8a Abs. 3 BSIG for IT security audits for KRITIS operators
• Active certifications as ISO/IEC 27001 Lead Auditor and ISO/IEC 27001 Lead Implementer (both required)
• Demonstrable experience in maturity and GAP assessments for KRITIS operators based on ISO 27001, including document reviews, interviews, and on-site inspections
• Sound OT/ICS security competence, including in the context of ISA/IEC 62443
• Minimum 5 years of experience in ISMS / ISO 27001 auditing and implementation
• Minimum 3 years of experience in OT/ICS Security (ISA/IEC 62443, MITRE ATT&CK for ICS)
• Minimum 3 years of experience with maturity assessments, NIST CSF, and benchmarking
• Minimum 2 years of experience with KRITIS regulations (§ 8a BSIG, NIS2)
• Sound methodology for ISO 27001 implementation review, including structured evidence collection and sample effectiveness testing
• Experience in organizational control/role effectiveness analysis and conducting meaningful market benchmarks
• Relevant project references in the KRITIS environment, especially in the areas of energy supply, transport, and OT security
• Experience in the structured, management-oriented preparation of complex security assessment results and recommendations for action
• ISO/IEC 27001/27002, ISMS, Lead Auditor, Lead Implementer
• NIST Cybersecurity Framework (CSF), Security Maturity Assessment, GAP Analysis
• OT/ICS Security, ISA/IEC 62443, MITRE ATT&CK for ICS
• KRITIS, § 8a BSIG, NIS2
• Security Governance, Control Effectiveness, Risk Assessment
• Security Benchmarking, Auditing, Measure Planning

Project details

• Start: ab sofort
• Duration: 2 Monate
• Remote: remote
• Location: Frankfurt, Deutschland, DE
• Languages: German