Security work with operational consequences
My career has taken me from risk and security management in high-security production to executive crisis exercises, critical infrastructure audits, and the development of my own advisory practice. The recurring task is to turn a requirement or an uncertain situation into decisions that people can carry out.
At Bundesdruckerei, from September 2012 to December 2018, I worked as a Risk and Security Manager and later as a consultant. I implemented emergency and crisis management processes, planned drills, and led a task force on new European Central Bank security requirements for banknote production.
That work included process and IT analyses, security concepts for international projects involving Afghanistan, Libya, and Venezuela, and the development of a control center with security and communication systems. These assignments required coordination between technical systems, operational teams, and management.
Since January 2019, I have led the advisory business I founded, KR Krisensicher Risikoberatung GmbH. My work spans crisis management, business continuity, information security, and the design and facilitation of exercises. Since January 2022, I have also held technical responsibility for critical infrastructure compliance services at Probatio Cert, including inspection processes and verification audits.
Selected implementation work
My assignments cover financial services, international manufacturing, healthcare, higher education, and energy.
Crisis management in finance
I implemented a crisis management system at a financial institution, aligned with its regulatory requirements. The assignment included planning, conducting, and evaluating several emergency drills.
Emergency preparedness in international industry
At an international semiconductor group, I worked on improvements to emergency management structures and delivered staff exercises and training for the emergency team.
IT emergency management in higher education
I implemented IT emergency management at a university and supported the assessment of protection needs for university data-center security concepts. This work connected recovery arrangements with the information and infrastructure the institution needed to protect.
Information security across sites and borders
My experience includes supporting an information security management system at a five-site hospital and managing a TISAX assessment project for an international steel group in Luxembourg. I have also audited information security management systems at energy network operators.
AI transformation in my own practice
I have reorganized parts of my own advisory business around AI agents, automation, and reusable knowledge. I use agentic AI systems to coordinate specialized agents for research, delivery, documentation, software development, and management support.
This changes the work of leading the business. I define each agent’s scope, set approval requirements, and supervise its work. I also use AI to build internal tools and automate software-development workflows.
I publish practical workflows through KrisensicherOS. Its agent profiles, templates, and playbooks support AI-assisted security governance, ISMS work, and crisis preparedness. You can also find my public work on GitHub.
I founded Gegenwaerts as an AI advisory initiative. My focus is how an organization changes its work and responsibilities when agents take on tasks that people previously performed.
My perspective on Organizational Singularity
Book: AI Management
Miriam Büxenstein and I co-authored AI Management: Organisation in agentischen Zeiten. The book examines how agentic AI changes organizational design, leadership, and the coordination of work.
We address the decisions behind implementation: how roles change, where decision authority sits, how knowledge is organized, and how leaders maintain responsibility as AI systems take on more work.
Published in German in 2026. AI Management on Google Books
Intergraf
I am an INTERGRAF Lead Auditor. I also advise and train organizations in the security printing industry, connecting security requirements with their implementation in daily operations.
INTERGRAF ISO 14298 addresses security printers and relevant manufacturers. INTERGRAF 15374 addresses suppliers to the security printing industry. My work connects these requirements with the procedures, responsibilities, and evidence an organization needs in its operations.
2022: information security requirements
I led the project to develop the information security chapter of the Intergraf Certification Requirements. The April 5, 2022, certification workshop in Lyon included my presentation on the Chapter B update.
Intergraf’s 2022 certification workshop agenda (PDF)
2026: AI requirements
In 2026, I am working on integrating AI requirements into security management. The organizational questions include who authorizes AI use, how information is protected, and how the resulting controls can be assessed.
Teaching
I teach security management through cases, organizational decisions, and the application of standards.
- NBS Northern Business School Hamburg: teaching on professional fields in security management since 2019; resilience, civil protection, and corporate security since 2021.
- Berlin School of Economics and Law: lecturer in International Security and Risk Management from 2017 to 2019, teaching in English.
- Intergraf Academy: training in security management for the security printing industry.
Intergraf Academy training programs
Education and professional qualifications
I have pursued doctoral studies at VSB Technical University of Ostrava since October 2025. My research focuses on the effectiveness and efficiency of crisis management approaches in organizational practice.
I hold an MBA in International Management from the Berlin School of Economics and Law (2018) and a B.Eng. in Hazard Control from Hamburg University of Applied Sciences (2012).
My professional qualifications include Lead Auditor ISO 27001 (PECB), Lead Auditor ISO 14298, Business Continuity Manager based on ISO 22301 and IT-Grundschutz, and Data Protection Officer (TÜV).
Methods I develop
I created P-DRIVEN as a structured operating model for crisis teams, cyber incidents, IT emergencies, and business continuity. It connects role allocation with problem solving, decision records, and follow-through.
With Prof. Dr. André Röhl, I develop Crisis Architecture, a project for organizational and municipal crisis resilience. It brings together C]ORE, M]ORE, and R3G, addressing resilience governance and capabilities alongside the identification and prioritization of risks.
I use these methods to design procedures and exercises around each organization’s responsibilities, resources, and operating context.