Senior Information Security Analyst

Rogers Capital is seeking a Senior Information Security Analyst to support the Governance, Risk and Compliance function within Rogers Capital, reporting to the CISO.

The role covers information security governance, risk management, regulatory compliance, policy development, audit and assurance, data protection, vendor risk management, business continuity, and compliance reporting.

Key Responsibilities

1. Governance, Risk and Compliance

• Maintain security and technology risk registers and monitor the progress of risk-treatment plans.
• Support ISO 27x, local regulations compliance, and other security standards implementation and continuous improvement activities.
• Support preparation and submission of regulatory compliance reports and assist during FSC/BOM inspections or regulatory engagements.

2. Policies and Document Management

• Draft, review and/or publish security policies, standards, procedures and guidelines.
• Maintain documentation repositories and ensure appropriate version control, ownership, review and approval workflows.

3. Compliance Monitoring and Reporting

• Collect, analyse and report information security and compliance KPIs and KRIs.
• Prepare dashboards and management reports for the CISO and leadership.
• Execute periodic security-control compliance assessments.
• Support periodic user-access reviews and recertification exercises.
• Track control deficiencies and follow up on agreed corrective actions.

4. Data Protection and Privacy

• Support the DPO and CISO in managing data protection and privacy compliance activities.

5. Vendor Risk Management

• Assist in conducting and reviewing security and privacy risk assessments of vendors and service providers.
• Document assessment outcomes and follow up on vendor remediation plans.
• Support the completion of customer security questionnaires, due-diligence requests and evidence compilation.

6. Business Continuity and Disaster Recovery

• Support business continuity planning, including the completion and review of Business Impact Analyses.
• Coordinate BCP and disaster-recovery testing in line with ISO 22301.
• Ensure documentation of testing outcomes, lessons learned and remediation actions.
• Track identified gaps through to closure within agreed timelines.

7. Audit and Assessment Activities

• Plan, coordinate and support internal and external security, compliance and regulatory audits.
• Prepare audit scopes, checklists and assessment criteria aligned with relevant standards.
• Follow up on findings, observations and corrective-action plans.

Required Skills and Qualifications

• Degree in Cybersecurity, Computer Science, Information Systems or a related discipline.
• At least five years of experience in information security GRC, compliance, audit or risk management.
• Familiarity with AI and automation tools to improve efficiency in GRC processes is a big advantage.
• Broad understanding of the ISO 27x series, ISO 22301, the NIST Cybersecurity Framework, the Mauritius Data Protection Act 2017, EU GDPR, FSC requirements for financial institutions and Bank of Mauritius guidelines.
• Experience supporting or performing internal or external audits.
• Experience in risk assessments, compliance monitoring, policy development and remediation tracking.
• Certifications (in progress accepted): PECB ISO 27001 Lead Implementer or Lead Auditor and CISA.