Information Security & Data Protection Officer

About the role

The Information Security & Data Protection Officer will ensure the organisation’s information security management system (ISMS) and data protection framework remain effective, compliant and continuously improving. This role works closely with IT and business units to embed security and privacy controls across all processes.

Key responsibilities

• Maintain and improve the ISMS in line with ISO/IEC 27001 requirements.
• Monitor and enforce information security policies, standards and procedures.
• Conduct risk assessments, vulnerability reviews and support risk treatment activities.
• Track corrective actions, non‑conformities, audit findings and improvement plans.
• Assist with internal and external audits, including ISO 27001 certification audits.
• Identify security gaps and recommend remediation measures.
• Manage information security incidents – reporting, investigation, documentation and follow‑up.
• Coordinate staff awareness campaigns, phishing simulations and security training.
• Support compliance with the Mauritius Data Protection Act, maintain processing records and ensure data accuracy, confidentiality and retention.
• Monitor data handling practices and promote privacy awareness among stakeholders.
• Prepare compliance reports, documentation and evidence for audits and regulatory inspections.

Required profile

• Degree in Information Technology, Cybersecurity or a related field.
• 3‑5 years of experience in information security, compliance, risk management or data protection.
• Familiarity with ISO/IEC 27001 controls and audit processes.
• Knowledge of the Mauritius Data Protection Act or similar privacy regulations.

Required skills

• ISO 27001 implementation and audit
• Risk assessment and treatment
• Vulnerability assessment
• Incident management
• Data protection compliance