VP, Business Group Chief Information Security Officer, US

Sun Life•Wellesley, MA

About The Position

The Vice-President, Business Group Information Security Officer, U.S. (BG CISO) is the senior security executive and trusted advisor to the U.S. Business Group President and leadership team. The role provides independent oversight and challenge of cyber risk, resilience, and security outcomes across Sun Life’s U.S. business, and serves as the primary bridge between business leadership and the enterprise Security function. Reporting directly to the global Chief Security Officer, the BG CISO translates enterprise security strategy into business-relevant actions and helps shape strategy, investment, priorities, and operating decisions. The role has direct and indirect leadership responsibility for approximately 10 security leads and advisors aligned to U.S. business priorities, product and platform risk, incident readiness, and stakeholder engagement. The BG CISO is accountable for business-group security oversight, executive advisory services, security governance, risk escalation, regulatory engagement, independent challenge, alignment of enterprise security services to business priorities, and operational ownership of Business Group Customer Identity and Access Management (CIAM) platforms and associated security outcomes. The role has delegated authority to establish security governance routines, direct assessments, challenge risk decisions, require remediation planning, recommend investments, and escalate material cyber and resilience concerns. Material disagreements about risk acceptance are escalated to the Global Chief Information Security Officer for review and discussion with the applicable Business Group President. The position does not own enterprise cyber defence operations, enterprise security platform engineering, vulnerability remediation, incident response operations, or second-line risk oversight unless expressly assigned. The position provides strategic security leadership; oversees cyber risk, controls, third-party risk, and regulatory compliance; and partners with Enterprise Security on security services, controls, and CIAM alignment. It provides security leadership for major initiatives, acquisitions, client commitments, partnerships, and technology transformations, and supports secure adoption of cloud, AI, automation, and digital solutions. During significant cyber incidents, operational disruptions, and crises, the BG CISO serves as the senior security executive for the Business Group, coordinating with relevant enterprise and business functions. The role also oversees cyber and operational resilience preparedness, promotes security culture, and leads security professionals across a complex global matrix. The ideal candidate brings the credibility of a security leader and the mindset of a business executive, enabling growth and innovation while ensuring risks are understood, governed, and managed. The stated salary range is $220,000–$300,000, with eligibility for discretionary short- and long-term annual incentive awards. Sun Life describes its environment as flexible, inclusive, and collaborative and lists comprehensive benefits, including vacation and sick time, paid family, parental and adoption leave, medical coverage, life and AD&D insurance, disability programs, a partially paid sabbatical program, a 401(k) employer match, stock purchase options, and an employer-funded retirement account.

Requirements

University degree in Information Security, Computer Science, Technology, Risk Management, Business, or a related discipline.
15 or more years of progressive experience in cybersecurity, information security, technology risk, risk management, or related disciplines.
Experience advising senior global executives on technology and cyber risk matters.
Experience operating in highly regulated environments.
Proven ability to influence strategic and investment decisions at an executive level.
Experience leading large-scale transformation, risk, or security initiatives.
Deep understanding of information security, cyber risk, regulatory requirements, and resilience frameworks.
Strong business acumen and ability to translate technical risks into business impacts.
Exceptional stakeholder-management and executive-communication skills.
Strong understanding of enterprise technology, cloud, data, AI, and digital platforms.
Strategic leadership ability to anticipate and address emerging risks and opportunities.
Strong judgment, influence, and decision-making capability.
Ability to lead through influence in a matrixed global organization.

Nice To Haves

Relevant security certification preferred, such as CISSP, CISM, CRISC, CGEIT, or equivalent.

Responsibilities

Serve as the primary security advisor to the Business Group President and executive team, and represent the Business Group within the CISO organization and the CISO organization within the Business Group.
Define and drive Business Group security strategy in alignment with enterprise security priorities and business objectives; integrate security into business strategy, transformation, digital strategy, and operational decisions.
Report significant changes in risk, provide timely executive insights and data, challenge risk decisions, and escalate material cyber, technology, resilience, and security risks through governance channels.
Influence multi-year security, resilience, and technology-risk investment strategies and business priorities, balancing risk management with commercial and strategic objectives.
Build trusted relationships with business and technology executives and facilitate collaboration between business stakeholders and enterprise security teams.
Oversee the Business Group’s cyber risk posture, control effectiveness, and security outcomes; ensure material risks are identified, assessed, escalated, remediated, or formally accepted in line with enterprise risk appetite.
Facilitate cyber risk assessments across applications, platforms, systems, business processes, and transformation initiatives; evaluate threats, vulnerabilities, and business impacts, and recommend protections based on threat-informed analysis.
Advise business leaders on risk decisions and evolving threat implications, working with the Global Cyber threat intelligence team.
Oversee Business Group-specific third-party cyber risk involving critical vendors, strategic partners, outsourced services, and technology providers.
Lead Business Group security governance, reporting, and representation on governance forums, executive committees, and risk councils.
Oversee management of applicable cybersecurity, technology-risk, operational-resilience, regulatory, legal, and policy requirements; represent the Business Group in regulatory examinations, supervisory reviews, external assessments, and cybersecurity audits.
Hold leaders accountable for remediation of audit findings, regulatory issues, and control deficiencies.
Partner with Enterprise Security to align security services and controls with Business Group needs and ensure CIAM capabilities align with enterprise architecture, standards, resilience requirements, and regulatory obligations.
Provide security leadership for major initiatives, acquisitions, client commitments, strategic partnerships, and technology transformations, including cyber due diligence, risk assessment, integration planning, and oversight of remediation commitments.
Enable secure adoption of cloud, AI, automation, and digital solutions, and oversee information protection, data security, AI security, and emerging-technology risks.
Champion secure-by-design practices throughout technology and business initiatives.
Serve as senior security executive for the Business Group during significant cyber incidents, operational disruptions, and crises; coordinate with incident response, business continuity, legal, privacy, risk, communications, and business leadership.
Oversee cyber and operational resilience preparedness, including continuity and crisis-management alignment, scenario testing, simulations, recovery planning, and remediation actions.
Foster a strong security culture, promote accountability for risk management, and drive awareness and adoption of security best practices.
Lead a network of business-aligned security leaders and professionals across the Business Group and affiliate entities, providing strategic direction, oversight, and coordination in a complex global matrix.
Present cyber risk, resilience, security posture, and emerging threats to executive committees, governance forums, and board-level audiences as required; represent the enterprise security function and Business Group with executives, regulators, auditors, and industry forums.

Benefits

Generous vacation and sick time.
Paid family, parental, and adoption leave.
Medical coverage.
Company-paid life and AD&D insurance.
Disability programs.
Partially paid sabbatical program.
401(k) employer match.
Stock purchase options.
Employer-funded retirement account.
Flexible, inclusive, and collaborative work environment that supports career growth.
Eligibility for discretionary short- and long-term annual incentive awards based on individual and business performance.