Vanja M.

About

My goal is simple: turning risk, regulation, and secure AI adoption into a competitive advantage.

I have spent eighteen years in information security and risk, most recently as CISO at Finoa, a BaFin-regulated crypto-asset service provider, where I established the IT risk and cybersecurity control environment and put AI controls in place ahead of the EU AI Act obligations that took effect in August 2026.

I have worked all three lines of defense. I started in network and security engineering, moved into security architecture at adidas, spent two years in internal audit, and have led second-line risk and security functions since. That range is why I can sit in a design review with engineers and in a board update on the same day.

What I care about right now: AI is absorbing the manual middle of governance work, evidence collection, control testing, regulatory mapping. That makes the human part more important, not less. Someone still has to decide what good looks like, ask what the tool did not ask, and put their name behind the answer. I use AI in my own control work, including tooling I built myself, and I govern it to the same standard as any AI the business adopts.

The frameworks and regulation behind that work: DORA, BaFin ZAIT, ISO 27001, EU AI Act, NIST AI RMF, NIST CSF, SOC 2, MITRE ATT&CK and ATLAS.

CISSP. ISACA Advanced in AI Security Management, exam passed August 2026, certification application submitted. Open FAIR Foundation. CCSK.

Open to CISO and principal-level information security and risk roles in Berlin or remote. Working language English.

Specialties

• CISO / Security Leadership
• Cybersecurity Consulting
• Governance & Compliance
• Risk Management

Skills

• Information security
• Information risk
• Cybersecurity
• AI governance
• DORA
• BaFin
• ISO 27001
• Consulting
• Mentoring
• Policy definition

40 skills in total

Licenses & Certifications

• ITIL Foundation

  AXELOS

  Issued Sep 2014

• Open FAIR Foundation

  The Open Group

  Issued Jul 2026

• CISSP

  ISC²

  Issued Jul 2026

5 certifications in total

Experience

• Head of ICT Risk Office & Chief Information Security Officer

  Finoa

  Jan 2025 — Jul 2026

  Berlin, Germany

• Zalando Payments GmbH

  • Principal InfoSec Risk Manager

    Sep 2021 — Dec 2024

    Berlin, Germany

  • Senior InfoSec Risk Manager

    Feb 2021 — Aug 2021

    Berlin, Germany

7 experiences in total

Education

• E-Business

  BASc

  Unknown

Recent posts