VP, Business Group Chief Information Security Officer, US

Sun Life Financial; Wellesley (MA); On-site; USD 220,000 - 300,000; Full time

Job summary

Sun Life Financial in the United States seeks a Vice-President, Business Group Information Security Officer (BG CISO) to lead security strategy, risk oversight, and resilience for the U.S. business group, reporting to the Global CISO.

You will translate cyber risk into business decisions, guide governance, coordinate with enterprise security, manage a team of ~10 security leads, and partner with executives to protect assets while enabling growth.

Qualifications

• Education: University degree in Information Security, Computer Science, Technology, Risk Management, Business, or related discipline.
• Relevant security certifications preferred (CISSP, CISM, CRISC, CGEIT, or equivalent).
• Experience: 15+ years of progressive experience in cybersecurity, information security, technology risk, risk management, or related disciplines.
• Experience advising senior global executives on technology and cyber risk matters.
• Experience operating in highly regulated environments.
• Proven ability to influence strategic and investment decisions at an executive level.
• Experience leading large-scale transformation, risk, or security initiatives.

Responsibilities

• Strategic Security Leadership and Vision – define and drive the Business Group security strategy aligned to enterprise priorities and business objectives.
• Business Partnership & Influence – build trusted relationships with business and technology executives and influence investment priorities.
• Cyber Risk Management – own the Business Group’s cyber risk posture, control effectiveness, and security outcomes; oversee third-party cyber risk for critical vendors.
• Governance, Regulatory & Compliance – lead security governance activities and ensure alignment to global teams; manage audits and regulatory obligations.
• Security Integration & Transformation – partner with enterprise security for secure technology adoption, including cloud, AI, and digital solutions; ensure governance controls.
• Incident Preparedness & Resilience – lead during significant cyber incidents and coordinate recovery actions.
• Security Culture & Awareness – promote security accountability and awareness.
• Leadership & Talent Development – lead security leaders across the Business Group and present risk to executives.

Skills

Executive leadership

Cyber risk management

Security governance

Strategic planning

Stakeholder management

Regulatory compliance

Cloud security

Education

University degree in Information Security, Computer Science, Technology, Risk Management, Business, or related discipline

Job description

Job Purpose

The Vice-Preédent, Business Group Information Security Officer, U.S. (BG CISO) serves as a senior security leader and partner to the Business Group leadership team and Business Group President. Acting as the senior security executive for the Business Group and the primary bridge between the business and enterprise Security function, the BG CISO provides independent oversight and challenge of cyber risk, resilience and security outcomes across the business group. The U.S. BG CISO is accountable for cyber risk, resilience, and security outcomes for Sun Life’s U.S. business, a core Health & Protection platform focused on group benefits, dental, disability, life and absence-management solutions, with operations primarily in the United States and connectivity to enterprise shared services and technology teams. Reporting directly to the global Chief Security Officer, this role is responsible for ongoing emphasis on automation, service delivery, cybersecurity resilience and secure growth. Direct and indirect reports include a team of ~10 security leads and advisors aligned to U.S. business priorities, product/platform risk, incident readiness, and stakeholder engagement. The BG CISO partners closely with executives, technology leaders, risk partners, and the enterprise security team to protect critical assets, enable innovation, strengthen resilience, and ensure risks are understood and managed within the organization's risk appetite. The BG CISO is accountable for providing independent business-aligned security oversight while enabling growth, innovation and transformation across the Business Group. The role translates complex cyber and security risks into business impacts and shapes strategy, investments, priorities, and operating decisions across the Business Group.

Scope, Decision Authority and Key Interfaces

The Vice-Preédent, Business Group Information Security Officer serves as the senior security executive and trusted advisor to the Business Group President and leadership team. The role is accountable for cyber risk oversight, executive advisory services, security governance, resilience alignment, regulatory engagement, and independent challenge across the assigned business group. The Vice-Preédent translates enterprise security strategy into business-relevant actions while ensuring cyber risk, resilience, regulatory obligations, and security priorities are appropriately considered within business decisions and transformation initiatives. The Vice-Preédent has delegated authority to establish business-group security governance routines, direct security assessments, challenge risk decisions, require remediation planning, recommend security investment priorities, and escalates material cyber and resilience concerns through appropriate governance channels. Within approved authorities, the role provides independent advice and challenge regarding cyber risk, resilience, technology transformation, regulatory obligations, third-party risk, and risk acceptance decisions. Where management disagreement exists regarding material cyber risk acceptance, the matter will be escalated to the Global Chief Information Security Officer for review and discussion with the applicable Business Group President before a final decision is made. The role is accountable for business-group security oversight, executive advisory services, risk escalation, independent challenge, alignment of enterprise security services to business priorities, and operational ownership of Business Group Customer Identity and Access Management (CIAM) platforms and associated security outcomes. The role does not own enterprise cyber defence operations, enterprise security platform engineering, vulnerability remediation, incident response operations, or second-line risk oversight except where responsibilities are expressly assigned. The Vice-Preédent works closely with Enterprise Security leaders to ensure Business Group CIAM capabilities remain aligned with enterprise architecture, security standards, resilience requirements, and regulatory obligations. Matters escalated to the Chief Information Security Officer would typically include significant cyber or operational resilience concerns, material breaches of risk appetite, major regulatory matters, unresolved management actions, significant third-party security issues, material client commitments, or disagreements regarding risk acceptance, prioritization, or investment decisions.

Major Accountabilities

Strategic Security Leadership and Vision – Serve as the primary Security advisor to the Business Group executive team and Business Group President. Accountable for defining and driving the Business Group security strategy, aligned to enterprise security priorities and business objectives. Ensure security considerations are integrated into business strategy, transformation initiatives, digital strategies, and operational decision-dashmaking. Report significant changes in risk to appropriate levels of leadership on a periodic and event-driven basis. Exercise independent challenge and escalates material cyber, technology, resilience and security risks through appropriate governance forums when risk exposure exceeds established risk appetite or remediation commitments are not achieved. Deliver timely insights and data to enable informed executive decision-making, prioritization, and risk-based trade-offs. Influence and shape multi-year security, resilience, and technology risk investment strategies, ensuring resource allocation aligns with business priorities, regulatory expectations and evolving threat landscapes. Identify emerging threats, trends, and regulatory developments that may impact the Business Group and proactively develop mitigation strategies.

Business Partnership & Influence – Build trusted relationships with business and technology executives. Act as the voice of the Business Group within the CISO organization and as the voice of the CISO organization within the Business Group. Facilitate effective collaboration between business stakeholders and enterprise security teams. Influence business group investment priorities and strategic trade-offs related to cyber risk, resilience, regulatory obligations, and secure technology adoption.

Cyber Risk Management – Accountable for the Business Group’s cyber risk posture, control effectiveness and security outcomes, ensuring material risks are identified, assessed, escalated, remediated, or formally accepted through appropriate governance and in alignment with enterprise risk appetite. Facilitate cyber risk assessments across application/platform/system levels to identify vulnerabilities and potential threats, analyze impacts, and recommend protection required based on threat modeling. Support business leaders in making informed risk decisions consistent with enterprise policies and risk appetite. Work with the Global Cyber threat intelligence team and monitor evolving threat landscapes and advise leaders on risk implications and required actions. Provide oversight of BG specific third-party cyber risk related to critical vendors, strategic partners, outsourced services, and technology providers, ensuring security risks are appropriately identified, assessed, governed, monitored and escalated as appropriate.

Governance, Regulatory & Compliance – Lead security governance activities within the Business Group. Oversee regular reporting and ensure alignment to global functional teams. Represent Security on business governance forums, executive committees, and risk councils. Ensure effective management of applicable cybersecurity, technology risk, operational resilience, regulatory, legal, and policy requirements within the Business Group. Represent the Business Group during regulatory examinations, supervisory reviews, external assessments and cybersecurity-related audits. Hold leaders accountable to effective remediation of audit findings, regulatory issues, and control deficiencies.

Security Integration & Transformation – Partner with the enterprise security team to ensure security services and controls meet the needs of the Business Group. Provide security leadership for major initiatives, acquisitions, client commitments, strategic partnerships, and technology transformations, including cyber due diligence, risk assessment, integration planning, and oversight of material remediation commitments. Enable secure adoption of emerging technologies, including cloud, AI, automation, and digital solutions, ensuring appropriate cybersecurity, data protection, privacy, and governance controls are embedded throughout the lifecycle. Provide oversight of information protection, data security, AI security and emerging technology risks ensuring critical information assets are protected and used responsibly and in compliance with regulatory and enterprise requirements. Champion a secure-by-design approach across technology and business initiatives.

Incident Preparedness & Resilience – Serve as the senior security executive for the Business Group during significant cyber incidents, operational disruptions, and crisis events, coordinating with enterprise incident response, business continuity, legal, privacy, risk, communications, and business leadership to support timely decisions, escalation, recovery and reporting. Oversee the Business Group’s cyber and operational resilience preparedness, including alignment with business continuity and crisis management, scenario testing, crisis simulations, recovery planning and oversight of resulting remediation actions.

Security Culture & Awareness – Foster a strong security culture across the Business Group. Promote accountability for risk management among leaders and employees. Drive awareness and adoption of security best practices.

Leadership & Talent Development – Lead a network of business-aligned security leaders and professionals from across the Business Group and affiliate entities, providing strategic direction, oversight, and coordination of security priorities within a complex global matrix environment. Present cyber risk, resilience, security posture, and emerging threats to executive committees, governance forums, and board-level audiences as required. Lead through influence across complex matrixed environments. Represent both the enterprise security function and business group with senior executives, regulators, auditors, and within industry forums. Demonstrate executive presence and credibility with senior leaders. Balance risk management with commercial and strategic objectives. Drive informed decision-making under ambiguity and changing conditions. Act as a trusted advisor capable of challenging constructively when risks warrant escalation.

Qualifications

• Education University degree in Information Security, Computer Science, Technology, Risk Management, Business, or a related discipline.


• Relevant security certifications preferred (CISSP, CISM, CRISC, CGEIT, or equivalent).


• Experience 15+ years of progressive experience in cybersecurity, information security, technology risk, risk management, or related disciplines.


• Experience advising senior global executives on technology and cyber risk matters.


• Experience operating in highly regulated environments.


• Proven ability to influence strategic and investment decisions at an executive level.


• Experience leading large-scale transformation, risk, or security initiatives.

Key Knowledge & Skills

• Deep understanding of information security, cyber risk, regulatory requirements, and resilience frameworks.


• Strong business acumen and ability to translate technical risks into business impacts.


• Exceptional stakeholder management and executive communication skills.


• Strong understanding of enterprise technology, cloud, data, AI, and digital platforms.


• Strategic leader with the ability to anticipate and address emerging risks and opportunities.


• Strong judgment, influence, and decision-making capability.


• Ability to lead through influence in a matrixed global organization.

Success Profile

The ideal candidate combines the credibility of a security leader with the mindset of a business executive. They are a trusted advisor to senior leaders, capable of enabling growth and innovation while ensuring risks are effectively understood, governed, and managed.

Salary Range

Salary Range: $220,000 - $300,000

At our company, we are committed to pay transparency and equity. Your actual base salary will be determined based on your unique skills, qualifications, experience and education. In addition to your base salary, this position is eligible for discretionary short and long-term annual incentive awards based on your individual performance as well as the overall performance of the business. We are dedicated to creating a work environment where everyone is rewarded for their contributions.

Benefits

• generous vacation and sick time


• market-leading paid family, parental and adoption leave


• medical coverage


• company paid life and AD&D insurance


• disability programs


• a partially paid sabbatical program

Inclusion & Diversity

We are committed to fostering an inclusive environment where all employees feel they belong, are supported and empowered to thrive. We are dedicated to building teams with varied experiences, backgrounds, perspectives and ideas that benefit our colleagues, clients, and the communities where we operate. We encourage applications from qualified individuals from all backgrounds.

We will make reasonable accommodations to the known physical or mental limitations of otherwise-qualified individuals with disabilities or special disabled veterans, unless the accommodation would impose an undue hardship on the operation of our business. Please email [e-mail] to request an accommodation.

For applicants residing in California, please read our employee California Privacy Policy and Notice.

We do not require or administer lie detector tests as a condition of employment or continued employment.

Sun Life will consider for employment all qualified applicants, including those with criminal histories, in a manner consistent with the requirements of applicable state and local laws, including applicable fair chance ordinances. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

Job Category

General Management

Posting End Date

30/10/2026

Shine together At Sun Life, you can be your most brilliant self. Our supportive, flexible, and inclusive work environment is one where you – and your career – can thrive. Whatever your aspirations, collaborative leaders and colleagues are ready to help you learn, grow, and succeed. Make life brighter We’re a global company with a passion for people. Our purpose is to help Clients achieve lifetime financial security and live healthier lives. As a team of 30,000 across 26 countries, our impact is far-reaching, and locally relevant There’s power in numbers. As part of Sun Life’s growing team, you have an impact on people in your community and around the world. Shape the future With an optimistic eye on a brighter future, we drive to innovate. Be part of leading change, push boundaries and try new ways of working. Use data to drive bold actions. Be agile and pivot as we test and learn. At Sun Life, we’re driving transformation, sustainability and innovation for our Clients, employees, partners, and communities. Join us. Together, we can make the future brighter. Join a top employer for a brighter future. Visit Sun Life Careers