VP, Business Group Chief Information Security Officer, Canada

You are as unique as your background, experience and point of view. Here, you'll be encouraged, empowered and challenged to be your best self. You'll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights. Every day, you'll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do.

At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful.

When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives.

Discover how you can make a difference in the lives of individuals, families and communities around the world.

Job Description:

VP, Business Group Information Security Officer, Sun Life Canada

Job Purpose

The Vice-President, Business Group Information Security Officer, Canada (BG CISO) serves as a senior security leader and partner to the Business Group leadership team and Business Group President. Acting as the senior security executive for the Business Group and the primary bridge between the business and enterprise Security function, the BG CISO provides independent oversight and challenge of cyber risk, resilience and security outcomes across the business group. The BG CISO, Sun Life Canada is accountable for cyber risk, resilience, and security outcomes for Sun Life Canada, one of the company's core markets and a leader in health, wealth and protection, serving Clients across Canada through group benefits, individual insurance, wealth, advice and distribution channels. The Canadian business is made up of complex ecosystems, requiring strong alignment with Canadian regulatory expectations, enterprise risk practices and digital/client-service priorities. Reporting directly to the global Chief Security Officer this position will have direct and indirect reports including a team of ~ 10 security leads and advisors aligned to the Canada business and subsidiary priorities including oversight of Dialogue security, product/platform risk, incident readiness, and stakeholder engagement. The BG CISO partners closely with executives, technology leaders, risk partners, and the enterprise security team to protect critical assets, enable innovation, strengthen resilience, and ensure risks are understood and managed within the organization's risk appetite. The BG CISO is accountable for providing independent business-aligned security oversight while enabling growth, innovation and transformation across the Business Group. The role translates complex cyber and security risks into business impacts and shapes strategy, investments, priorities, and operating decisions across the Business Group.

Scope, Decision Authority and Key Interfaces

The Vice-President, Business Group Information Security Officer serves as the senior security executive and trusted advisor to the Business Group President and leadership team. The role is accountable for cyber risk oversight, executive advisory services, security governance, resilience alignment, regulatory engagement, and independent challenge across the assigned business group. The Vice-President translates enterprise security strategy into business-relevant actions while ensuring cyber risk, resilience, regulatory obligations, and security priorities are appropriately considered within business decisions and transformation initiatives. The Vice-President has delegated authority to establish business-group security governance routines, direct security assessments, challenge risk decisions, require remediation planning, recommend security investment priorities, and elevate material cyber and resilience concerns through appropriate governance channels. Within approved authorities, the role provides independent advice and challenge regarding cyber risk, resilience, technology transformation, regulatory obligations, third-party risk, and risk acceptance decisions. Where management disagreement exists regarding material cyber risk acceptance, the matter will be escalated to the Global Chief Information Security Officer for review and discussion with the applicable Business Group President before a final decision is made. The role is accountable for business-group security oversight, executive advisory services, risk escalation, independent challenge, alignment of enterprise security services to business priorities, and operational ownership of Business Group Customer Identity and Access Management (CIAM) platforms and associated security outcomes. The role does not own enterprise cyber defence operations, enterprise security platform engineering, vulnerability remediation, incident response operations, o