VP, Business Group Chief Information Security Officer, US

Sun Life•Wellesley, MA

2d•$220,000 - $300,000

About The Position

The Vice-President, Business Group Information Security Officer, U.S. (BG CISO) is the senior security executive for Sun Life’s U.S. business and a trusted advisor to the Business Group President and leadership team. Reporting directly to the Global Chief Security Officer, the BG CISO is the primary bridge between the business and enterprise Security function, providing independent oversight and challenge of cyber risk, resilience, and security outcomes across the business group. The role leads a team of approximately 10 security leads and advisors aligned to U.S. business priorities, product and platform risk, incident readiness, and stakeholder engagement. The BG CISO defines and drives business-group security strategy in alignment with enterprise priorities and business objectives. The position translates complex cyber risks into business impacts and informs strategy, investment, priorities, and operating decisions. It has delegated authority to establish security governance routines, direct assessments, challenge risk decisions, require remediation planning, recommend investment priorities, and escalate material concerns. The role also has operational ownership of Business Group Customer Identity and Access Management (CIAM) platforms and associated security outcomes, while partnering with Enterprise Security to align those capabilities with enterprise architecture, standards, resilience requirements, and regulatory obligations. The role oversees cyber risk posture, security governance, regulatory engagement, third-party risk, security integration and transformation, and business-group resilience preparedness. During significant cyber incidents or operational disruptions, the BG CISO serves as the senior security executive for the business group and coordinates with relevant enterprise and business functions. The position enables secure growth and adoption of cloud, AI, automation, and digital technologies, and promotes security culture and accountability. It does not own enterprise cyber defence operations, enterprise security platform engineering, vulnerability remediation, incident response operations, or second-line risk oversight unless expressly assigned.

Requirements

University degree in Information Security, Computer Science, Technology, Risk Management, Business, or a related discipline.
15+ years of progressive experience in cybersecurity, information security, technology risk, risk management, or related disciplines.
Experience advising senior global executives on technology and cyber risk matters.
Experience operating in highly regulated environments.
Proven ability to influence strategic and investment decisions at an executive level.
Experience leading large-scale transformation, risk, or security initiatives.
Deep understanding of information security, cyber risk, regulatory requirements, and resilience frameworks.
Strong business acumen and ability to translate technical risks into business impacts.
Exceptional stakeholder management and executive communication skills.
Strong understanding of enterprise technology, cloud, data, AI, and digital platforms.
Strategic leadership ability to anticipate and address emerging risks and opportunities.
Strong judgment, influence, and decision-making capability.
Ability to lead through influence in a matrixed global organization.

Nice To Haves

Relevant security certifications such as CISSP, CISM, CRISC, CGEIT, or equivalent.

Responsibilities

Serve as the primary security advisor to the Business Group executive team and Business Group President.
Define and drive the Business Group security strategy aligned with enterprise priorities and business objectives.
Integrate security considerations into business strategy, transformation initiatives, digital strategies, and operational decisions.
Report significant changes in risk to appropriate leaders and escalate material risks through governance forums.
Provide timely insights and data to support executive decision-making, prioritization, and risk-based trade-offs.
Influence multi-year security, resilience, and technology risk investment strategies.
Identify emerging threats, trends, and regulatory developments and develop mitigation strategies.
Build trusted relationships with business and technology executives and facilitate collaboration between business stakeholders and enterprise security teams.
Represent the Business Group within the CISO organization and the CISO organization within the Business Group.
Oversee the Business Group’s cyber risk posture, control effectiveness, security outcomes, risk assessments, and remediation or formal risk acceptance processes.
Support business leaders in making risk decisions consistent with enterprise policies and risk appetite.
Monitor threat intelligence and advise leaders on risk implications and required actions.
Oversee Business Group-specific third-party cyber risk for critical vendors, strategic partners, outsourced services, and technology providers.
Lead Business Group security governance and reporting; represent Security on business governance forums, executive committees, and risk councils.
Oversee applicable cybersecurity, technology risk, operational resilience, regulatory, legal, and policy requirements.
Represent the Business Group during regulatory examinations, supervisory reviews, external assessments, and cybersecurity audits.
Hold leaders accountable for remediation of audit findings, regulatory issues, and control deficiencies.
Partner with Enterprise Security to ensure security services and controls meet Business Group needs.
Provide security leadership for major initiatives, acquisitions, client commitments, strategic partnerships, and technology transformations, including due diligence, risk assessment, integration planning, and remediation oversight.
Enable secure adoption of cloud, AI, automation, and digital solutions, embedding cybersecurity, data protection, privacy, and governance controls throughout the lifecycle.
Oversee information protection, data security, AI security, and emerging technology risks.
Champion a secure-by-design approach across technology and business initiatives.
Serve as the senior security executive for the Business Group during significant cyber incidents, operational disruptions, and crisis events, coordinating with relevant functions and leaders.
Oversee cyber and operational resilience preparedness, including continuity and crisis-management alignment, scenario testing, simulations, recovery planning, and remediation oversight.
Foster a strong security culture, promote leader and employee accountability, and drive awareness and adoption of security best practices.
Lead and coordinate a network of business-aligned security leaders and professionals across the Business Group and affiliate entities in a complex global matrix.
Present cyber risk, resilience, security posture, and emerging threats to executive committees, governance forums, and board-level audiences as required.
Represent the enterprise security function and Business Group with senior executives, regulators, auditors, and industry forums.
Lead through influence, balance risk management with commercial and strategic objectives, and provide constructive challenge when risks warrant escalation.

Benefits

Generous vacation and sick time.
Paid family, parental, and adoption leave.
Medical coverage.
Company-paid life and AD&D insurance.
Disability programs.
Partially paid sabbatical program.
401(k) employer match.
Stock purchase options.
Employer-funded retirement account.
Flexible, inclusive, and collaborative work environment that supports career growth.
Discretionary short- and long-term annual incentive awards based on individual and business performance.