Cybersecurity& Data Privacy Analyst

The Cybersecurity and Data Privacy Analyst will be responsible for supporting the organization’s efforts to protect information assets, ensure compliance with data protection laws, and implement effective cybersecurity controls. The role involves overseeing information systems, managing incidents, and ensuring that personal data is handled in compliance with the Rwanda Data Protection and Privacy Law and other applicable regulations.

· Excellent analytical and problem-solving skills. · Strong understanding of privacy principles, confidentiality, and ethical data handling. · Effective communication and training skills. · Ability to work cross-functionally with IT, legal, HR, and compliance teams. · Proactive, detail-oriented, and adaptable to evolving technologies and threats.

Cybersecurity · Implement and maintain information security controls aligned with ISO 27001 and NIST Cybersecurity Framework. · Conduct regular vulnerability assessments, penetration tests, and risk assessments on systems and infrastructure. · Monitor and respond to cybersecurity incidents, ensuring timely containment and remediation. · Support endpoint protection, access management, and incident response procedures. · Support security initiatives in organizational projects to ensure alignment with cybersecurity and data protection requirements. · Promote cybersecurity awareness and conduct staff training sessions. · Participate in third-party risk assessments and ensure vendors meet security standards. Data Privacy · Support compliance with the Rwanda Data Protection and Privacy Law and other applicable regional frameworks (e.g. GDPR). · Maintain and update records of Processing Activities. · Assist in conducting Data Protection Impact Assessments (DPIAs) and Privacy Threshold Assessments (PTAs). · Monitor data processing operations to ensure privacy by design and by default. · Handle data subject requests and liaise with the Data Protection Officer on breach notifications. · Ensure proper data sharing, transfer, and retention practices are in place.

· Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field. · Professional certifications such as CISSP, ISO 27001 Lead Implementer/Auditor, CIPP/E, or an equivalent advantage. · 2–4 years of experience in cybersecurity, IT risk, or data protection roles. · Familiarity with data privacy laws (Rwanda DPP, GDPR, etc.) and cybersecurity standards (ISO 27001, NIST CSF and more). · Strong understanding of risk management, incident response, and governance frameworks.