Sven Zehl

Security and IT, built to hold up under scrutiny.

Sven Zehl · Information Security & IT Leadership · Berlin

I run technology functions end to end in regulated, internationally distributed organisations: information security, governance and risk alongside infrastructure, cloud, workplace and service management, with the budget and the board conversations that come with them.

Sven Zehl

Now

Director of Information Security and TechOps (IT), CISO

BaFin-regulated e-money institution · Berlin

I lead a multi-layered organisation with team leads across Security Engineering, Security GRC and Technical Operations, hold a Group-wide mandate across legal entities in five European countries, and own the IT and security budget, reporting to a founder. Internal IT runs as a function in its own right — identity and access, endpoint and workplace, the SaaS estate and service management — held to the same audit evidence standard as security. DORA here is an ICT mandate rather than a security project: ICT risk, the third-party register, incident reporting and resilience testing.

Before

Director of Security and Corporate IT, CISO

B2B SaaS company, part of a European software group

Security and corporate IT end to end, reporting to the CTO: disciplinary responsibility for the IT organisation and a mandate to turn internal IT into a scalable, business-aligned platform, alongside 24/7 security operations, detection and response, and application and infrastructure security. Full budget ownership for both, including investment decisions.

Head of Security Compliance

European health platform, four European entities

Group security compliance for a platform serving millions of patients and more than 300,000 healthcare professionals. Owned the certification portfolio — ISO 27001, ISO 27701, BSI C5 — delivered the first BSI C5 attestation for a healthcare SaaS provider in Germany, built the global compliance team and operating model, and led the investigation of a major security incident.

Head of Security Germany

Same platform, German entity

Built and led the German security function: strategy for the German organisation, security-by-design with product and engineering, incident management, and the interface to German regulators including the BSI and the data protection authorities. Led the security workstream of the vaccination booking cooperation with the Berlin Senate.

System Architect, Security Governance

Global industrial and IoT group, around 440 subsidiaries in some 60 countries

Owned the binding Group-wide policy for product and IoT security across Automotive, Industrial, IoT and Consumer Goods, and coordinated a network of more than 30 Product Security Officers. Represented the group in ISO/IEC JTC 1 SC 27 WG 4, ETSI TC CYBER and CEN/CENELEC JTC 13, aligning internal requirements with ETSI EN 303 645.

Head of IoT

German digital industry association, Berlin

Led the IoT domain at Germany’s leading digital industry association, later also acting head of AI and Big Data. Advised policymakers on IoT security and regulation, represented the German digital economy in national and EU-level committees, and drove position papers and industry guidelines.

Focus

  • Technology operating models and multi-layered organisations
  • Infrastructure, cloud and workplace operations
  • IT service management, vendor governance and budget ownership
  • Security Operations, detection and incident response
  • Product Security and Secure SDLC
  • Third-party and supply-chain risk
  • AI security, and guardrails for AI-assisted development
  • ISO 27001, NIS2, DORA, SOC 2, BSI C5
  • Standardisation and regulatory alignment

Background

Engineer and researcher before moving into technology leadership. Peer-reviewed publications at IEEE, ACM and IFIP venues with more than 300 citations, and standardisation work at ISO, ETSI and CEN/CENELEC.

  • DegreeM.Sc. Computer Engineering, TU Berlin
  • CertificationISO 27001 Lead Auditor
  • AwardBest Paper Award, European Wireless Conference 2017
  • TeachingLecturer, Berlin University of Applied Sciences (BHT), 2022–2023

Publications, speaking and teaching

Contact

sven@zehl.io