DE

Open to projects

Mohammadreza Tavakoli

Auditor for electronic identities and trust services

I audit trust service providers against eIDAS and ETSI EN 319 401/411 – as a certified ISO/IEC 27001 Lead Auditor with hands-on experience from critical energy infrastructure and from building AI agents myself.

Write to meSee projects

CurrentTÜV TRUST IT GmbH · TÜV AUSTRIA Group

What I can build for you

Alongside the audit work, I build. If you have something in mind, get in touch – I will tell you honestly whether I am the right person for it.

Process automation

Repetitive work that someone does by hand today runs on its own afterwards – with a traceable log, so you can see what happened.

  • Browser extensions that drive portals without an API
  • Syncing data between systems that do not talk to each other
  • Reporting and monitoring instead of manual checks

Websites & applications

Fast, findable sites without needless weight – from a one-pager to an application with accounts and a database. This site is one example.

  • Company and profile sites, multilingual
  • Applications with login, database and reporting
  • Technical findability: structured data, load time, accessibility

AI agents & integration

Putting AI where it actually holds up – and securing it where it does not. I know both sides: how to build it and how it is attacked.

  • Agents that see multi-step tasks through reliably
  • Connecting language models to existing systems
  • Testing for prompt injection and unintended behaviour

Research

Bachelor thesis · 2026 · Grade 1.7

Autonomous AI agents in cybercrime

Risks, scenarios and options for companies

This thesis examines how autonomous AI agents change the threat landscape in cyberspace – deliberately from the attacker’s perspective, with a focus on protecting companies. The central finding: what matters is not that AI makes attacks possible, but that it turns scalability, adaptivity and persistence into something operational. Working through three attack scenarios – autonomous reconnaissance, AI-assisted social engineering and agentic exploitation – it identifies recurring weakness patterns in companies and derives organisational, technical and strategic options from them.

Read the thesis →

About

At TÜV TRUST IT (part of the TÜV AUSTRIA Group) I audit electronic identities and trust services: audit and certification projects against eIDAS and the ETSI standards EN 319 401 and EN 319 411, on site at trust service providers in Germany and abroad.

Before that I spent two and a half years at a transmission system operator – critical infrastructure in the energy sector. The work covered building and running an ISMS to ISO/IEC 27001, risk analysis, preparing internal and external audits, and turning controls from the standard into tasks someone can actually track.

Alongside that I have been building software for years: a trading journal, a complete automation solution made of a browser extension and a server, websites, and applications built on AI agents. My bachelor thesis examined what autonomous AI agents mean in the hands of attackers. That double role is why, on AI topics, I can do more than quote the standard – I know how these systems actually break.

Areas of focus

Standards & frameworks

  • eIDAS / eIDAS 2.0
  • ETSI EN 319 401
  • ETSI EN 319 411
  • ISO/IEC 27001
  • ISO/IEC 2700x series
  • BSI IT-Grundschutz
  • DIN SPEC 27076

Audit & governance

  • Audit and certification projects
  • Building and running an ISMS
  • Risk management
  • Compliance & reporting
  • Business continuity management
  • Security awareness

AI & development

  • AI agents
  • LLMs / GenAI
  • Prompt engineering
  • Prompt injection & jailbreaking
  • Workflow automation
  • Web and app development

Career

  1. since 09/2026

    (Junior) Auditor – Electronic identities & trust services (eIDAS)

    TÜV TRUST IT GmbH · TÜV AUSTRIA Group · Köln

    • Audit and certification projects against eIDAS and ETSI (EN 319 401/411), in Germany and abroad
    • On-site review and assessment of security concepts at trust service providers (TSP/QTSP), with detailed audit reports
    • Developing certification procedures further, supporting accreditation processes, working with supervisory authorities

  2. 10/2024 – 03/2026

    Working student, information security – OT governance & OT management

    Amprion GmbH · Transmission system operator, critical energy infrastructure · Pulheim

    • Building and maintaining security policies to meet ISO/IEC 27001 and internal requirements
    • Preparing, supporting and following up internal and external audits (including ENTSO-E OPDE)
    • Reviewing risk analyses and checking supplier statements for compliance
    • Turning ISMS controls into trackable tasks (Jira)
    • Producing ISMS reporting for standards committees and the executive board as a basis for decisions
    • Designing and running company-wide security awareness campaigns

  3. 09/2023 – 09/2024

    Working student, system management for process data processing (PDV)

    Amprion GmbH · Pulheim-Brauweiler

    • Handling tickets in process control technology (OT), applying security policies to PDV systems
    • Setting up and hardening configuration laptops (BitLocker, anti-virus, patch management)

Certifications

2026

ISO/IEC 27001:2022 Lead Auditor

Mastermind Assurance · Personal certification

2025

IT-Grundschutz-Praktiker

BSI

2025

CyberRisikoCheck nach DIN SPEC 27076

BSI

Education

2022 – 2026

Bachelor of Science – Cyber Security Management

Hochschule Niederrhein · Mönchengladbach

Final grade 2.0 (German scale). Focus: ISO/IEC 27001 & ISMS, BSI IT-Grundschutz, risk analysis, business continuity management, data protection, IT law. Practical project: auditing a company against ISO/IEC 27001.

Languages

  • Germannative
  • Persiannative
  • Englishfull professional (C1)
  • Frenchintermediate (B1)

Selected projects

2026

City-Reinigung Leverkusen – company website

Website for a dry cleaner that has been working in Leverkusen since 1976: services from shirt care to leather dyeing, two locations, collection and shipping. The focus was on being found locally – whoever searches for fur or leather cleaning in Leverkusen should land here.

2026

Take Haghighi – trilingual community website

Website for a Persian-speaking congregation in Cologne, in Persian, German and English. Persian is set right to left – which affects not just the text but the entire layout. Plus proper hreflang markup and structured data, so each language version is recognised as one.

2024 – present

E-commerce automation platform

End-to-end automation of a dropshipping operation: a browser extension driving the marketplace front-end, plus a dedicated server for order data, reporting and monitoring. Covers listing creation, price and stock tracking, and order fulfilment.

See all projects →

Got something in mind?

Tell me briefly what it is about. You will get an honest assessment – including when that means someone else is a better fit.

Write to mem.tavakoli@itavakoli.com