AVP, Threat and Vulnerability Management

Job Description

Overview

As the AVP, Global Threat & Vulnerability Management (TVM) within Digital Security Threat Management (DSTM) under Security, Risk & Crisis Management (SRC), you will lead Sun Life’s global capability for identifying, assessing, prioritizing, and mitigating cyber vulnerabilities and threats across the enterprise. You will oversee multiple sub‑disciplines—vulnerability management, red teaming, threat intelligence, defensive security (blue team), application security platform & testing, and incident management & process development—ensuring Sun Life maintains a resilient and compliant security posture.

This role partners closely with Security Engineering & Advisory, Technology Risk & Compliance, Security Governance & Client Programs, Security Initiatives & Awareness, and Security Operations to drive measurable improvements in cyber resilience and reduce enterprise attack surface.

Key Responsibilities

1. Enterprise Vulnerability Management Leadership

You are the Responsible Person / Contact for the enterprise Vulnerability Management Directive, overseeing the entire vulnerability lifecycle across Sun Life : identification, prioritization, reporting, remediation governance, and compliance monitoring.

Your VM program encompasses :

• Internal and external vulnerability scanning
• Database scanning
• Security Scorecard monitoring
• Threat‑intel‑driven vulnerability monitoring
• Classification of vulnerabilities and zero‑day response
• Audit, Client and Regulatory responses.
• Management of platforms related to Vulnerability Management.
• Produce Senior Leadership and Executive Reporting for all areas of Vulnerability Management.

2. Cyber Threat Intelligence & Hunting

You oversee the Cyber Threat Intelligence (CTI) and Cyber Threat Hunting (CTH) function responsible for :

3. Red Team / Offensive Security Oversight

You lead the Offensive Security (Red Team) program, which conducts :

4. Blue Team / Defensive Security Oversight

You lead the Defensive Security (Blue Team) program, which :

5. Security Incident & Process Management

You lead the Security Incident team which :

6. Application Security Platforms

7. Application Security Testing

8. Cross‑Functional Collaboration

9. Metrics, Reporting & Executive Communication

Qualifications

Leadership Competencies

Strategic thinker with the ability to anticipate emerging threats and evolving attack surfaces.

What’s in it for you?