INTERIM CISO · MSSP AND SOC ADVISORY · NIS2
Research & Consulting by Johannes Kresse. I take ownership of security strategy and security operations, lead teams on an interim basis and move organisations from reactive point measures to resilient, measurable security operations.
SERVICES
Nine service areas, one standard: security measures that fit the organisation, work in daily operations and stand up to management, auditors and customers.
01
Ownership of your security strategy for a defined period. I take on the CISO role, manage risk, lead your security team, align stakeholders and keep security operations effective until the permanent position is filled.
02
From service promise to scalable operations. I support managed security service providers with service design, platform architecture, processes and metrics, so that SOC services are delivered economically and create measurable value for clients.
03
Building and developing security operations: team structure, roles, tooling, processes and KPIs. The result is a SOC that is resilient, measurable and aligned with your business objectives.
04
End-to-end incident response playbooks from preparation through detection and containment to lessons learned. Complemented by vulnerability management programmes that identify, prioritise and verifiably remediate weaknesses.
05
Structured assessment of the efficiency and maturity of your security operations. I identify gaps, benchmark the current state against recognised industry standards and deliver a prioritised roadmap with actionable measures.
06
Vendor-neutral support in selecting security tools: requirements analysis, market overview, evaluation matrix and decision paper. You invest in technologies that fit your processes, your team and your budget.
07
Guidance for security tool rollouts from pilot to regular operations. I define success criteria for proofs of concept, manage vendors and integration partners and secure the handover into operations.
08
Comparison of your organisational and technical measures with the requirements of the NIS2 Directive and its national transposition. You receive a traceable gap analysis, a risk classification and a prioritised action plan for management and business units.
09
Tailored consulting engagements aligned with the goals, risk profile and maturity of your organisation. No off-the-shelf framework, but an approach that fits your situation and lasts in daily operations.
PROFILE
With 21 years in cybersecurity and 16 years of leadership experience in enterprises and managed service environments, I bring a practitioner's perspective to every engagement. As interim CISO and strategic advisor I take ownership of your security organisation and lead it from reactive point measures to resilient, measurable operations.
My foundation is operational experience on both sides of the market. I have built and led in-house security operations centres, designed and scaled managed security offerings for service providers, and been responsible for security organisations in corporations, mid-sized companies and regulated sectors such as finance and energy. I know security operations from daily practice, not only from frameworks, and I know how to translate requirements from ISO 27001, NIS2 and sector-specific regulation into processes that hold.
This background is why I can not only advise on the services offered but take responsibility for them. Strategy, operations, technology selection and compliance interlock: decisions are made with implementation in mind, implementations with evidence in mind.
CERTIFICATIONS
CAREER
Corporation, mid-sized business, fintech, consulting and service providers: each position has shown a different side of security operations. The complete profile is on LinkedIn.
2026 to present
Security operations design and advisory for the MSSP industry. Engagements in the finance and energy sectors.
2022 to 2026
Built hybrid SOC solutions for enterprise clients. Led a team of specialised management consultants, responsible for security and compliance projects, ISO 27001 and ISO 27035.
2022 to present
Building a network of security leaders and practitioners with regular events in more than 10 cities. Responsible for organisation, public relations and partnerships.
2021 to 2022
Established resilient security operations for a leading European fintech. Responsible for international incident management and vulnerability management and for a large team of cloud and network security experts.
2018 to 2021
Security operations consulting for large and mid-sized companies, establishing incident and vulnerability management processes, proofs of concept, later leading the MSSP business with pre-sales, service design and project delivery.
2017 to 2018
Global responsibility for network security and availability, vulnerability and incident management, cloud migration and cloud security on Azure. Led an international infrastructure and security team.
2016 to 2017
Security projects for aviation authorities and the air force: project management, acceptance testing and security requirements engineering for air traffic control software.
2015 to 2016
Led large IT security projects for DAX corporations: identity and access management, gap analyses and roadmaps, EDR and network security projects, budget and team responsibility.
2008
Microsoft compliance testing and reporting for AAA titles on PC and consoles in Madrid. A short, instructive look at quality assurance and certification in the games industry.
2007 to 2015
Eight years progressing from backup and network administrator through team lead network infrastructure to Manager Network & Communication. International network security, data centre networks, malware laboratories, business continuity and reporting to the board and CISO.
INITIATIVES
Alongside client work I publish public, source-based decision aids. Both platforms are continuously maintained and available without registration.
DIRECTORY · DACH
Curated directory of SOC-as-a-Service, MDR and MSSP providers for the German-speaking market. Services, technologies and certifications made comparable, with a map of Germany, sources per provider and open data. No ranking, no rating.
VENDOR COMPARISON · VULNERABILITY DATA
English-language comparison of firewall, router and VPN vendors based on public vulnerability data. Five factors, adjustable weighting, transparent methodology and open data endpoints for decision-makers and engineers.
COMMUNITY
I am a co-founder of the Security Meetup, which started in Leipzig in 2022 and today takes place regularly in more than 10 cities across Germany and Austria. The network brings security leaders and practitioners to one table: professional exchange instead of a sales stage, and an open door for newcomers.
I am responsible for organisation, partnerships and the development of the community, and I am proud of what has grown from a first round in Leipzig.
CONTACT
Whether an interim mandate, building or reviewing your security operations, selecting and implementing security tools or a NIS2 gap analysis: a first conversation clarifies the situation, the goals and a sensible scope.
I work on site and remotely, in German and English, for enterprises, public bodies and managed security service providers in the German-speaking region and beyond.
LEGAL
Information in accordance with Section 5 of the German Digital Services Act (DDG). This English version is provided for convenience; the German version is legally binding.
Professional title. Independent consultant for information security (Interim CISO, MSSP and SOC advisory). Not a regulated profession in Germany.
Liability for content. The content of this website has been prepared with great care. No guarantee is given for the accuracy, completeness or timeliness of the content. Statements about services describe my consulting offering and do not constitute a binding offer. Scope, deliverables and fees are agreed individually in writing.
Liability for links. This website contains links to external websites of third parties over whose content I have no influence. The respective provider or operator is always responsible for the content of linked pages. No unlawful content was apparent at the time of linking. Should I become aware of legal infringements, I will remove such links promptly.
Copyright. Texts, graphics and the design of this website are protected by copyright. Reproduction, editing or distribution beyond the limits of copyright law requires my written consent. Company names and trademarks mentioned belong to their respective owners and serve identification only.
Dispute resolution. I am neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board.
This website is an information page about my consulting services. It sets no cookies for visitors, uses no external analytics, font or embedding services and loads all content from its own server. This English version is provided for convenience; the German version is legally binding.
Johannes Kresse, Kiefernweg 10, 04552 Borna, Germany.
General contact: jk@johanneskresse.com
Privacy enquiries: datenschutz@johanneskresse.com
When you access this website, the hosting provider processes technical access data (IP address, time, requested address, transferred data volume, referrer and user agent) in server log files. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in secure and stable operation. The data is not merged with other sources. Log files are deleted or anonymised after 14 days at the latest.
To understand how often this website is used, page views are counted per day, separated into humans, AI crawlers and other bots. For this purpose the server evaluates the user agent of each request. In browsers, a small script reports one page view to this website's own server after the page has loaded. No cookies are set and no data is stored in your browser.
To count unique visitors, a shortened hash is formed from the IP address, the user agent and a random value that changes daily. The IP address itself is not stored. The hash is deleted after two days at the latest. Only daily totals per category and agent name are stored permanently, for example "Humans: 120 views". No conclusions about individual persons can be drawn from this. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in the needs-based development of this website. You can object by disabling JavaScript or by sending an informal message.
The fonts Satoshi and Clash Display are served locally from this website's own server. No content is loaded from third-party servers; no Google Fonts, no tracking pixels, no embedded maps or videos.
This website links to LinkedIn and to the websites of my initiatives (socmap.de, riskacceptedperimeter.com, securitymeetup.de). Data is only transferred to the respective operator when you click a link; their privacy policy then applies.
If you contact me by e-mail or telephone, your details are processed to handle the enquiry and to prepare or perform a contract (Art. 6 (1) (b) and (f) GDPR). The data is deleted as soon as it is no longer required and no statutory retention obligations apply. Information you share about your organisation's security posture is treated as confidential from the first contact onwards.
The administration area of this website (WordPress) uses technically necessary session cookies for logged-in editors only. Visitors to the public pages receive no cookies.
You have the right to access, rectification, erasure, restriction of processing, data portability and objection under Art. 15 to 21 GDPR. You may also lodge a complaint with a data protection supervisory authority, for example the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte).
