Sun Life · 11 hours ago
AVP, Threat and Vulnerability Management
Wellesley Hills, Massachusetts
Full-time
Hybrid
Director/Executive
15+ years expSun Life is a leading financial services company that focuses on helping individuals achieve lifetime financial security. They are seeking an AVP, Threat and Vulnerability Management to lead the global capability for identifying and mitigating cyber vulnerabilities and threats across the enterprise, while ensuring a resilient security posture through collaboration with various security teams.
FinanceFinancial ServicesInsurance
Responsibilities
You are the Responsible Person/Contact for the enterprise Vulnerability Management Directive, overseeing the entire vulnerability lifecycle across Sun Life: identification, prioritization, reporting, remediation governance, and compliance monitoring
Your VM program encompasses: Internal and external vulnerability scanning, Database scanning, Security Scorecard monitoring, Threat‑intel‑driven vulnerability monitoring, Classification of vulnerabilities and zero‑day response, Audit, Client and Regulatory responses, Management of platforms related to Vulnerability Management, Produce Senior Leadership and Executive Reporting for all areas of Vulnerability Management
You oversee the Cyber Threat Intelligence (CTI) and Cyber Threat Hunting (CTH) function responsible for: Lead the collection, analysis, and operationalization of internal and external threat intelligence, Monitoring global threats affecting Sun Life brands, staff, infrastructure, and clients, Identifying indicators of compromise, campaign activity, and attacker behaviors, Producing actionable threat briefings for Security teams, Technology Risk, and senior leadership, Maintain relationships with intelligence‑sharing communities, industry groups, and government partners, Ensure threat intelligence directly informs detection engineering, vulnerability prioritization, and offensive testing, Perform continuous Threat Hunting activities based on Cyber Threat Intelligence and internal Red/Blue team information, Develop and refine use cases based on threat intelligence and work with Security Operations and Engineering teams to implement for alerting to Defensive Security teams
You lead the Offensive Security (Red Team) program, which conducts: Application, network, social engineering, and physical penetration tests, Adversary emulation engagements, Intelligence Led Penetration Testing, Executes Security Control validation testing to ensure coverage and identify gaps across security controls, Ensure offensive testing aligns with threat intelligence and focuses on high‑risk assets and emerging attack vectors, Partner with technology teams to validate remediation effectiveness, Translate offensive findings into prioritized remediation actions and long‑term security improvements
You lead the Defensive Security (Blue Team) program, which: Responds to detections from security controls, Ensure defensive capabilities evolve based on threat intelligence and offensive testing results, Partner with Offensive Security, Cyber Threat Intelligence and Security Operations to enhance detection coverage, reduce dwell time, and improve alert fidelity
You lead the Security Incident team which: Responds to security incidents and takes appropriate actions, Govern the maturity of incident response processes, playbooks, and readiness exercises, Ensure consistent, high‑quality incident handling with clear communication and post‑incident reviews
Oversee application security scanning capabilities including static, dynamic, software composition and mobile analysis, Partner with DevOps teams to ensure application security capabilities are integrated into DevOps pipelines, Identify systemic application security weaknesses and drive long‑term remediation strategies, Provide secure development guidance and support targeted developer training in partnership with the AVP of Security Initiatives, Training & Awareness, Ensure application security findings are integrated into enterprise vulnerability reporting
Leads Sun Life’s Application Security Testing function, owning the strategy, execution, and continuous improvement of the enterprise testing framework, Ensure critical applications have penetration testing performed on an annual basis, Ensures results are consistent, high‑quality, repeatable, and meet enterprise governance expectations, Drives adoption of advanced testing approaches, including AI‑assisted vulnerability remediation and testing enhancements
Partner with: Security Engineering & Advisory on architecture alignment, secure design, and technical remediation, Technology Risk & Compliance to ensure alignment with regulatory expectations, audit requirements, and risk frameworks, Security Governance & Client Programs to support client assurance, governance reporting, and due diligence, Security Initiatives, Training & Awareness to develop training based on recurring vulnerability, threat, and AppSec trends, Security Operations to enhance detection, response, and threat hunting capabilities
Define KPIs, KRIs, and dashboards that measure vulnerability exposure, application security maturity, remediation performance, and threat trends, Deliver regular briefings to senior leadership, risk committees, and the board, Translate complex technical risks into clear business impacts and recommended actions, Provide transparent reporting on remediation performance, threat landscape changes, and exposure reduction progress, Provide updates to regulatory bodies regarding the security posture or any related incidents
Qualification
Required
15+ years of cybersecurity experience, with deep expertise in vulnerability management, threat intelligence, application security, or offensive/defensive security
Proven leadership experience managing technical teams and enterprise‑scale security programs
Strong understanding of vulnerability scanning tools, AppSec testing platforms, cloud security, and threat intelligence technologies
Demonstrated expertise in Red and Blue Team operations, including hands‑on knowledge of adversary emulation, penetration testing (web, network, cloud), threat hunting, incident detection and response, malware analysis, and validation of security controls across complex enterprise environments
Deep understanding of secure coding practices, shift left practices, application security capabilities, CI/CD pipelines, and DevSecOps principles
Experience working in regulated industries and supporting audits, regulators, and client assurance programs
Excellent communication skills with the ability to influence senior executives and technical teams
Demonstrated ability to lead through complexity, ambiguity, and rapid change
Certifications such as CISSP, CISM, GIAC, OSCP, GCTI, or CSSLP
Experience with automation, secure SDLC, and large‑scale application security programs
Background in cyber risk quantification or exposure analytics
Experience with cloud‑native security tooling and modern application architectures
Benefits
Flexible hybrid work model.
Pension, stock and savings programs to help build and enhance your future financial security
Work and professional development that is united by our Purpose: to help Clients and Employees achieve lifetime financial security and live healthier lives
A friendly, collaborative and inclusive culture
Be part of our continuous improvement journey in developing the next greatest digital enterprise experience.
Competitive salary and bonus structure influenced by market range data
The opportunity to move along a variety of career paths with amazing networking potential
Company
Sun Life
Sun Life is a leading financial services organization dedicated to helping people achieve lifetime financial security and live healthier lives.
10001+ employees
H1B Sponsorship
Sun Life has a track record of offering H1B sponsorships. Please note that this does not
guarantee sponsorship for this specific role. Below presents additional info for your
reference. (Data Powered by US Department of Labor)
Distribution of Different Job Fields Receiving Sponsorship
Represents job field similar to this job
Trends of Total Sponsorships
2025 (22)
2024 (27)
2023 (18)
2022 (18)
2021 (12)
2020 (13)
Funding
Current Stage
Public CompanyTotal Funding
$1.05B2024-05-13Post Ipo Debt· $548.79M
2023-07-04Post Ipo Debt· $500M
2000-03-24IPO
Leadership Team
Kevin Strain
President & CEO
Luc Nhon Ly
Chief Executive Officer
Recent News
2025-12-02
MarketScreener
2025-12-02
South China Morning Post
2025-11-27
Company data provided by crunchbase