AVP, Threat and Vulnerability Management

Sunlife; Toronto; Hybrid; CAD 165,000 - 235,000; Full time

Benefits offered by this job

Hybrid work model

Pension plan

Stock options

Savings programs

Professional development

Job summary

Sun Life is seeking an AVP, Threat & Vulnerability Management to lead its global vulnerability lifecycle, threat intelligence, and offensive/defensive security programs. You will partner with Security Engineering, Compliance, and Operations to reduce risk across Sun Life’s enterprise.

The role emphasizes maturity in vulnerability management, incident response, and application security, with a mandate to translate complex risks into actionable executive insights.

Qualifications

• 15+ years of cybersecurity experience, with leadership of enterprise security programs.
• Strong understanding of vulnerability management, threat intel, and application security.
• Certifications such as CISSP, CISM, GIAC, OSCP, GCTI or CSSLP preferred.

Responsibilities

• Lead enterprise Vulnerability Management lifecycle and reporting.
• Oversee threat intelligence collection, analysis and operationalization.
• Direct Red Team / Offensive security engagements and Blue Team defenses.
• Drive security incident management and mature incident response processes.
• Oversee Application Security platforms, testing and secure DevOps integration.
• Provide executive reporting on remediation progress and risk trends.

Skills

Vulnerability management

Threat intelligence

Application security

Red team / offensive security

Blue team / defensive security

Incident response

Leadership & program management

Secure coding / DevSecOps

Regulatory compliance / audits

Communication to executives

Education

Industry certifications (CISSP/CISM/GIAC/OSCP/CSSLP)

Tools

Vulnerability scanning tools

AppSec testing platforms

Cloud security tooling

Automation / scripting

Threat intelligence platforms

Job description

You are as unique as your background, experience and point of view. Here, you’ll be encouraged, empowered and challenged to be your best self. You'll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights. Every day, you'll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do.

At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful.

When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives.

Discover how you can make a difference in the lives of individuals, families and communities around the world.

Job Description

About the job

Job Description

As the AVP, Threat & Vulnerability Management (TVM) within Digital Security Threat Management (DSTM) under Security, Risk & Crisis Management (SRC), you will lead Sun Life’s global capability for identifying, assessing, prioritizing, and mitigating cyber vulnerabilities and threats across the enterprise. You will oversee multiple sub‑disciplines—vulnerability management, red teaming, threat intelligence, defensive security (blue team), application security platform & testing, and incident management & process development—ensuring Sun Life maintains a resilient and compliant security posture.

This role partners closely with Security Engineering & Advisory, Technology Risk & Compliance, Security Governance & Client Programs, Security Initiatives & Awareness, and Security Operations to drive measurable improvements in cyber resilience and reduce enterprise attack surface.

What will you do?

Key Responsibilities

• Enterprise Vulnerability Management Leadership

You are the Responsible Person/Contact for the enterprise Vulnerability Management Directive, overseeing the entire vulnerability lifecycle across Sun Life: identification, prioritization, reporting, remediation governance, and compliance monitoring.

Your VM program encompasses:

• Internal and external vulnerability scanning
• Database scanning
• Security Scorecard monitoring
• Threat‑intel‑driven vulnerability monitoring
• Classification of vulnerabilities and zero‑day response
• Audit, Client and Regulatory responses.
• Management of platforms related to Vulnerability Management.
• Produce Senior Leadership and Executive Reporting for all areas of Vulnerability Management.

Cyber Threat Intelligence & Hunting

• Lead the collection, analysis, and operationalization of internal and external threat intelligence.
• Monitoring global threats affecting Sun Life brands, staff, infrastructure, and clients
• Identifying indicators of compromise, campaign activity, and attacker behaviors
• Producing actionable threat briefings for Security teams, Technology Risk, and senior leadership.
• Maintain relationships with intelligence‑sharing communities, industry groups, and government partners.
• Ensure threat intelligence directly informs detection engineering, vulnerability prioritization, and offensive testing.
• Perform continuous Threat Hunting activities based on Cyber Threat Intelligence and internal Red/Blue team information.
• Develop and refine use cases based on threat intelligence and work with Security Operations and Engineering teams to implement for alerting to Defensive Security teams.

Red Team / Offensive Security Oversight

• Application, network, social engineering, and physical penetration tests
• Adversary emulation engagements
• Intelligence Led Penetration Testing
• Executes Security Control validation testing to ensure coverage and identify gaps across security controls.
• Ensure offensive testing aligns with threat intelligence and focuses on high‑risk assets and emerging attack vectors.
• Partner with technology teams to validate remediation effectiveness.
• Translate offensive findings into prioritized remediation actions and long‑term security improvements.

Blue Team / Defensive Security Oversight

• Responds to detections from security controls
• Ensure defensive capabilities evolve based on threat intelligence and offensive testing results.
• Partner with Offensive Security, Cyber Threat Intelligence and Security Operations to enhance detection coverage, reduce dwell time, and improve alert fidelity.

Security Incident & Process Management

• Responds to security incidents and takes appropriate actions
• Govern the maturity of incident response processes, playbooks, and readiness exercises.
• Ensure consistent, high‑quality incident handling with clear communication and post‑incident reviews.

Application Security Platforms

• Oversee application security scanning capabilities including static, dynamic, software composition and mobile analysis.
• Partner with DevOps teams to ensure application security capabilities are integrated into DevOps pipelines.
• Identify systemic application security weaknesses and drive long‑term remediation strategies.
• Provide secure development guidance and support targeted developer training in partnership with the AVP of Security Initiatives, Training & Awareness.
• Ensure application security findings are integrated into enterprise vulnerability reporting.

Application Security Testing

• Leads Sun Life’s Application Security Testing function, owning the strategy, execution, and continuous improvement of the enterprise testing framework.
• Ensure critical applications have penetration testing performed on an annual basis.
• Ensures results are consistent, high‑quality, repeatable, and meet enterprise governance expectations.
• Drives adoption of advanced testing approaches, including AI‑assisted vulnerability remediation and testing enhancements.

Cross‑Functional Collaboration Partner with:

• Security Engineering & Advisory on architecture alignment, secure design, and technical remediation.
• Technology Risk & Compliance to ensure alignment with regulatory expectations, audit requirements, and risk frameworks.
• Security Governance & Client Programs to support client assurance, governance reporting, and due diligence.
• Security Initiatives, Training & Awareness to develop training based on recurring vulnerability, threat, and AppSec trends.
• Security Operations to enhance detection, response, and threat hunting capabilities.

Metrics, Reporting & Executive Communication

• Define KPIs, KRIs, and dashboards that measure vulnerability exposure, application security maturity, remediation performance, and threat trends.
• Deliver regular briefings to senior leadership, risk committees, and the board.
• Translate complex technical risks into clear business impacts and recommended actions.
• Provide transparent reporting on remediation performance, threat landscape changes, and exposure reduction progress.

Provide updates to regulatory bodies regarding the security posture or any related incidents.

What do you need to succeed?

Qualifications

• 15+ years of cybersecurity experience, with deep expertise in vulnerability management, threat intelligence, application security, or offensive/defensive security.
• Proven leadership experience managing technical teams and enterprise‑scale security programs.
• Strong understanding of vulnerability scanning tools, AppSec testing platforms, cloud security, and threat intelligence technologies.
• Demonstrated expertise in Red and Blue Team operations, including hands‑on knowledge of adversary emulation, penetration testing (web, network, cloud), threat hunting, incident detection and response, malware analysis, and validation of security controls across complex enterprise environments.
• Deep understanding of secure coding practices, shift left practices, application security capabilities, CI/CD pipelines, and DevSecOps principles.
• Experience working in regulated industries and supporting audits, regulators, and client assurance programs.
• Excellent communication skills with the ability to influence senior executives and technical teams.
• Demonstrated ability to lead through complexity, ambiguity, and rapid change.
• Certifications such as CISSP, CISM, GIAC, OSCP, GCTI, or CSSLP.
• Experience with automation, secure SDLC, and large‑scale application security programs.
• Background in cyber risk quantification or exposure analytics.
• Experience with cloud‑native security tooling and modern application architectures.

Leadership Competencies

• Strategic thinker with the ability to anticipate emerging threats and evolving attack surfaces.
• Strong decision‑making skills and the ability to operate effectively under pressure.
• Ability to build trust and drive alignment across diverse technology and business teams.
• High integrity, accountability, and a commitment to continuous improvement.
• Skilled at developing leaders, building high‑performing teams, building succession, supporting early‑career talent and fostering a culture of security excellence.
• Ability to deliver clear, concise communication of complex risk topics to senior leadership.
• Ability to influence across business units without authority.
• Skill in preparing regulatory‑grade evidence, narratives, and rationale.

Unique Requirements

This role requires Reliability Status Clearance. In addition to a law enforcement inquiry and a credit check, as part of your application, the Government of Canada will ask if you lived or travelled outside of Canada for 6-consecutive months during the last 5 years, and you must account for all activities during this time.

Important: Obtaining Reliability Status Clearance within a reasonable amount of time is a condition required to start employment for this role at Sun Life.

What’s in it for you?

• Great Place to Work® Certified for Most Trusted Executive Team in Canada – 2025, 2024 and 2023.
• Great Place to Work® Certified for Best Workplaces in Canada - 2025.
• Canada Order of Excellence for Mental Health at Work® certification from Excellence Canada. Sun Life is one of only four companies in Canada to ever receive this certification – 2024.
• Top Work Places® for Remote Work – Monster Canada - 2024
• Great Place to Work® Certified for Best Workplaces in Canada – 2024 and 2022.
• Great Place to Work® Certified for Best Workplaces for Women in Canada - 2024.
• Flexible hybrid work model. .
• Pension, stock and savings programs to help build and enhance your future financial security.
• Work and professional development that is united by our Purpose: to help Clients and Employees achieve lifetime financial security and live healthier lives.
• A friendly, collaborative and inclusive culture.
• Be part of our continuous improvement journey in developing the next greatest digital enterprise experience.
• Competitive salary and bonus structure influenced by market range data.
• The opportunity to move along a variety of career paths with amazing networking potential.

The Base Pay range is for the primary location for which the job is posted. It may vary depending on the work location of the successful candidate or other factors. In addition to Base Pay, eligible Sun Life employees participate in various incentive plans, payment under which is discretionary and subject to individual and company performance. Certain sales focused roles have sales incentive plans based on individual or group sales results.

Diversity and inclusion have always been at the core of our values at Sun Life. A diverse workforce with wide perspectives and creative ideas benefits our Clients, the communities where we operate and all of us as colleagues. We welcome applications from qualified individuals from all backgrounds.

Persons with disabilities who need accommodation in the application process, or those needing job postings in an alternative format, may e-mail a request to [e-mail].

We are proud to be a hybrid organization that offers our employees the choice and flexibility to work from both the office and virtually based on the needs of the business, our Clients and you.

We may use artificial intelligence to support candidate sourcing, screening, interview scheduling.

We thank all applicants for showing an interest in this position. Only those selected for an interview will be contacted.

Salary Range

165,000/165 000 - 235,000/235 000

Job Category

IT - Technology Services

Posting End Date

13/11/2026