VP, Business Group Chief Information Security Officer, Asia Greater Hong Kong Area

You are as unique as your background, experience and point of view. Here, you’ll be encouraged, empowered and challenged to be your best self. You'll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights. Every day, you'll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do.

At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful.

When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives.

Discover how you can make a difference in the lives of individuals, families and communities around the world.

Job Description:

The Vice-President, Business Group Information Security Officer (BG CISO) serves as a senior security leader and partner to the Business Group leadership team and Business Group President. Acting as the senior security executive for the Business Group and the primary bridge between the business and enterprise Security function, the BG CISO provides independent oversight and challenge of cyber risk, resilience and security outcomes across the business group.

Major Accountabilities

Strategic Security Leadership and Vision

Serve as the primary Security advisor to the Business Group executive team and Business Group President.

Accountable for defining and driving the Business Group security strategy, aligned to enterprise security priorities and business objectives.

Ensure security considerations are integrated into business strategy, transformation initiatives, digital strategies, and operational decision-making.

Report significant changes in risk to appropriate levels of leadership on a periodic and event-driven basis.

Exercise independent challenge and escalate material cyber, technology, resilience and security risks through appropriate governance forums when risk exposure exceeds established risk appetite or remediation commitments are not achieved.

Deliver timely insights and data to enable informed executive decision-making, prioritization, and risk-based trade-offs.

Influence and shape multi-year security, resilience, and technology risk investment strategies, ensuring resource allocation aligns with business priorities, regulatory expectations and evolving threat landscapes.

Identify emerging threats, trends, and regulatory developments that may impact the Business Group and proactively develop mitigation strategies.

Business Partnership & Influence

Build trusted relationships with business and technology executives.

Act as the voice of the Business Group within the CISO organization and as the voice of the CISO organization within the Business Group.

Facilitate effective collaboration between business stakeholders and enterprise security teams.

Influence business group investment priorities and strategic trade-offs related to cyber risk, resilience, regulatory obligations, and secure technology adoption

Cyber Risk Management

Accountable for the Business Group’s cyber risk posture, control effectiveness and security outcomes, ensuring material risks are identified, assessed, escalated, remediated, or formally accepted through appropriate governance and in alignment with enterprise risk appetite.

Facilitate cyber risk assessments across application/platform/system levels to identify vulnerabilities and potential threats, analyze impacts, and recommend protection required based on threat modeling.

Support business leaders in making informed risk decisions consistent with enterprise policies and risk appetite.

Work with the Global Cyber threat intelligence team and monitor evolving threat landscapes and advise leaders on risk implications and required actions.

Provide oversight of BG specific third-party cyber risk related to critical vendors, strategic partners, outsourced services, and technology providers, ensuring security risks are appropriately identified, assessed, governed, monitored and escalated as appropriate.

Provide independent security advice on material risk acceptance decisions and ensure risks exceeding approved appetite or delegated authority are escalated to the appropriate enterprise and business governance forums.

Governance, Regulatory & Compliance

Lead security governance activities within the Business Group.

Oversee regular reporting and ensure alignment to global functional teams

Represent Security on business governance forums, executive committees, and risk councils.

Ensure effective management of applicable cybersecurity, technology risk, operational resilience, regulatory, legal, and policy requirements within the Business Group.

Represent the Business Group during regulatory examinations, supervisory reviews, external assessments and cybersecurity-related audits.

Hold leaders accountable to effective remediation of audit findings, regulatory issues, and control deficiencies.

Security Integration & Transformation

Partner with the enterprise security team to ensure security services and controls meet the needs of the Business Group.

Provide security leadership for major initiatives, acquisitions, client commitments, strategic partnerships, and technology transformations, including cyber due diligence, risk assessment, integration planning, and oversight of material remediation commitments.

Enable secure adoption of emerging technologies, including cloud, AI, automation, and digital solutions, ensuring appropriate cybersecurity, data protection, privacy, and governance controls are embedded throughout the lifecycle.

Provide oversight of information protection, data security, AI security and emerging technology risks ensuring critical information assets are protected and used responsibly and in compliance with regulatory and enterprise requirements.

Champion a secure-by-design approach across technology and business initiatives.

Incident Preparedness & Resilience

Serve as the senior security executive for the Business Group during significant cyber incidents, operational disruptions, and crisis events, coordinating with enterprise incident response, business continuity, legal, privacy, risk, communications, and business leadership to support timely decisions, escalation, recovery and reporting.

Oversee the Business Group’s cyber and operational resilience preparedness, including alignment with business continuity and crisis management, scenario testing, crisis simulations, recovery planning and oversight of resulting remediation actions.

Oversee the Business Group’s cyber risk assessment program across critical applications, platforms, systems, business processes, and transformation initiatives, ensuring material vulnerabilities, and threats are evaluated, prioritized, and addressed based on business impact and threat-informed analysis.

Security Culture & Awareness

Foster a strong security culture across the Business Group.

Promote accountability for risk management among leaders and employees.

Drive awareness and adoption of security best practices.

Leadership & Talent Development

Lead a network of business-aligned security leaders and professionals from across the Business Group and affiliate entities, providing strategic direction, oversight, and coordination of security priorities within a complex global matrix environment.

Present cyber risk, resilience, security posture, and emerging threats to executive committees, governance forums, and board-level audiences as required.

Lead through influence across complex matrixed environments.

Represent both the enterprise security function and business group with senior executives, regulators, auditors, and within industry forums.

Demonstrate executive presence and credibility with senior leaders.

Balance risk management with commercial and strategic objectives.

Drive informed decision-making under ambiguity and changing conditions.

Act as a trusted advisor capable of challenging constructively when risks warrant escalation.

Qualifications

Education

University degree in Information Security, Computer Science, Technology, Risk Management, Business, or a related discipline.

Relevant security certifications preferred (CISSP, CISM, CRISC, CGEIT, or equivalent).

Experience

15+ years of progressive experience in cybersecurity, information security, technology risk, risk management, or related disciplines.

Experience advising senior global executives on technology and cyber risk matters.

Experience operating in highly regulated environments.

Proven ability to influence strategic and investment decisions at an executive level.

Experience leading large-scale transformation, risk, or security initiatives.

Key Knowledge & Skills

Deep understanding of information security, cyber risk, regulatory requirements, and resilience frameworks.

Strong business acumen and ability to translate technical risks into business impacts.

Exceptional stakeholder management and executive communication skills.

Strong understanding of enterprise technology, cloud, data, AI, and digital platforms.

Strategic leader with the ability to anticipate and address emerging risks and opportunities.

Strong judgment, influence, and decision-making capability.

Ability to lead through influence in a matrixed global organization.

Success Profile

The ideal candidate combines the credibility of a security leader with the mindset of a business executive. They are a trusted advisor to senior leaders, capable of enabling growth and innovation while ensuring risks are effectively understood, governed, and managed.

At Sun Life, we cultivate a High-Performance, Caring Culture that empowers our people to achieve outstanding results, embrace continuous growth, and create meaningful impact. We succeed together by fostering an inclusive environment where wellbeing, collaboration, and accountability are equally valued.

We offer 5-day work, attractive salary, MPF, group life and group medical insurance; and excellent career development opportunities to the right candidate.

We are an equal opportunity employer and welcome applications from all qualified candidates. Application forms and resume will be kept for a period of 24 months after completion of the recruitment process. (All information will be held in strict confidence and only be used for recruitment purpose).

Job Category:

General Management

Posting End Date:

26/11/2026