VP, Business Group Chief Information Security Officer, US

Sun Life U.S. is one of the largest providers of employee and government benefits, helping approximately 50 million Americans access the care and coverage they need. Through employers, industry partners and government programs, Sun Life U.S. offers a portfolio of benefits and services, including dental, vision, disability, absence management, life, supplemental health, medical stop-loss insurance, and healthcare navigation. We have more than 6,400 employees and associates in our partner dental practices and operate nationwide.
At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful.
When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives.
Visit our website to discover how Sun Life is making life brighter for our customers, partners and communities.
Job Description:
VP, Business Group Information Security Officer, SL U.S. (BG CISO)
Job Purpose
The Vice-President, Business Group Information Security Officer, U.S. (BG CISO) serves as a senior security leader and partner to the Business Group leadership team and Business Group President. Acting as the senior security executive for the Business Group and the primary bridge between the business and enterprise Security function, the BG CISO provides independent oversight and challenge of cyber risk, resilience and security outcomes across the business group.
The U.S. BG CISO is accountable for cyber risk, resilience, and security outcomes for Sun Life’s U.S. business, a core Health & Protection platform focused on group benefits, dental, disability, life and absence-management solutions, with operations primarily in the United States and connectivity to enterprise shared services and technology teams.
Reporting directly to the global Chief Security Officer, this role is responsible for ongoing emphasis on automation, service delivery, cybersecurity resilience and secure growth. Direct and indirect reports include a team of ~10 security leads and advisors aligned to U.S. business priorities, product/platform risk, incident readiness, and stakeholder engagement.
The BG CISO partners closely with executives, technology leaders, risk partners, and the enterprise security team to protect critical assets, enable innovation, strengthen resilience, and ensure risks are understood and managed within the organization's risk appetite. The BG CISO is accountable for providing independent business-aligned security oversight while enabling growth, innovation and transformation across the Business Group. The role translates complex cyber and security risks into business impacts and shapes strategy, investments, priorities, and operating decisions across the Business Group.
Scope, Decision Authority and Key Interfaces
The Vice-President, Business Group Information Security Officer serves as the senior security executive and trusted advisor to the Business Group President and leadership team. The role is accountable for cyber risk oversight, executive advisory services, security governance, resilience alignment, regulatory engagement, and independent challenge across the assigned business group. The Vice-President translates enterprise security strategy into business-relevant actions while ensuring cyber risk, resilience, regulatory obligations, and security priorities are appropriately considered within business decisions and transformation initiatives.
The Vice-President has delegated authority to establish business-group security governance routines, direct security assessments, challenge risk decisions, require remediation planning, recommend security investment priorities, and escalate material cyber and resilience concerns through appropriate governance channels. Within approved authorities, the role provides independent advice and challenge regarding cyber risk, resilience, technology transformation, regulatory obligations, third-party risk, and risk acceptance decisions. Where management disagreement exists regarding material cyber risk acceptance, the matter will be escalated to the Global Chief Information Security Officer for review and discussion with the applicable Business Group President before a final decision is made.
The role is accountable for business-group security oversight, executive advisory services, risk escalation, independent challenge, alignment of enterprise security services to business priorities, and operational ownership of Business Group Customer Identity and Access Management (CIAM) platforms and associated security outcomes. The role does not own enterprise cyber defence operations, enterprise security platform engineering, vulnerability remediation, incident response operations, or second-line risk oversight except where responsibilities are expressly assigned. The Vice-President works closely with Enterprise Security leaders to ensure Business Group CIAM capabilities remain aligned with enterprise architecture, security standards, resilience requirements, and regulatory obligations.
Matters escalated to the Chief Information Security Officer would typically include significant cyber or operational resilience concerns, material breaches of risk appetite, major regulatory matters, unresolved management actions, significant third-party security issues, material client commitments, or disagreements regarding risk acceptance, prioritization, or investment decisions.
Major Accountabilities
Strategic Security Leadership and Vision
Serve as the primary Security advisor to the Business Group executive team and Business Group President.
Accountable for defining and driving the Business Group security strategy, aligned to enterprise security priorities and business objectives.
Ensure security considerations are integrated into business strategy, transformation initiatives, digital strategies, and operational decision-making.
Report significant changes in risk to appropriate levels of leadership on a periodic and event-driven basis.
Exercise independent challenge and escalate material cyber, technology, resilience and security risks through appropriate governance forums when risk exposure exceeds established risk appetite or remediation commitments are not achieved.
Deliver timely insights and data to enable informed executive decision-making, prioritization, and risk-based trade-offs.
Influence and shape multi-year security, resilience, and technology risk investment strategies, ensuring resource allocation aligns with business priorities, regulatory expectations and evolving threat landscapes.
Identify emerging threats, trends, and regulatory developments that may impact the Business Group and proactively develop mitigation strategies.
Business Partnership & Influence
Build trusted relationships with business and technology executives.
Act as the voice of the Business Group within the CISO organization and as the voice of the CISO organization within the Business Group.
Facilitate effective collaboration between business stakeholders and enterprise security teams.
Influence business group investment priorities and strategic trade-offs related to cyber risk, resilience, regulatory obligations, and secure technology adoption
Cyber Risk Management
Accountable for the Business Group’s cyber risk posture, control effectiveness and security outcomes, ensuring material risks are identified, assessed, escalated, remediated, or formally accepted through appropriate governance and in alignment with enterprise risk appetite.
Facilitate cyber risk assessments across application/platform/system levels to identify vulnerabilities and potential threats, analyze impacts, and recommend protection required based on threat modeling.
Support business leaders in making informed risk decisions consistent with enterprise policies and risk appetite.
Work with the Global Cyber threat intelligence team and monitor evolving threat landscapes and advise leaders on risk implications and required actions.
Provide oversight of BG specific third-party cyber risk related to critical vendors, strategic partners, outsourced services, and technology providers, ensuring security risks are appropriately identified, assessed, governed, monitored and escalated as appropriate.
Provide independent security advice on material risk acceptance decisions and ensure risks exceeding approved appetite or delegated authority are escalated to the appropriate enterprise and business governance fo