Information Security and Data Protection Officer

About the role

The Information Security and Data Protection Officer will help maintain, monitor and continuously improve the organisation’s Information Security Management System (ISMS) and data‑protection compliance framework. The role aligns with ISO/IEC 27001 and the Mauritius Data Protection Act.

Key responsibilities

• Assist in the upkeep and continual improvement of the ISMS according to ISO/IEC 27001.
• Support enforcement of security policies, standards, procedures and guidelines.
• Participate in risk assessments, vulnerability reviews and risk‑treatment activities.
• Track corrective actions, non‑conformities, audit findings and improvement plans.
• Support internal and external audits, including certification audits.
• Identify security gaps and recommend remediation measures.
• Manage information security incidents – reporting, investigation, documentation and escalation.
• Collaborate with IT and other departments to embed security requirements in projects.
• Coordinate staff awareness campaigns, phishing simulations and training sessions.
• Assist with compliance to the Mauritius Data Protection Act, maintain processing records and ensure data accuracy, confidentiality and retention.
• Monitor organisational data‑handling practices and promote privacy awareness.

Required profile

• Degree in Information Technology, Cybersecurity or a related field.
• 3‑5 years of experience in information security, compliance, risk management or data protection.
• Familiarity with ISO/IEC 27001 controls and audit processes.
• Knowledge of the Mauritius Data Protection Act or similar privacy regulations.

Required skills

• ISO 27001 implementation and audit
• Risk assessment and treatment
• Vulnerability assessment
• Incident management
• Data protection compliance