Bill Dunnion's move from Calian to Mitel CISO: career path and stated priorities

The 2024 appointment

Mitel announced Bill Dunnion as its Chief Information Security Officer in a Business Wire release dated April 18, 2024. The release sets out the scope of the job in plain terms. Dunnion will oversee Mitel’s information security strategy, security architecture, and security standards compliance.

The release credits him with more than two decades of experience across industries. It names three earlier employers. Before joining Mitel, Dunnion held IT and cybersecurity leadership positions at Calian Ltd, 2Keys Security Solutions, and Bell Canada.

In the release, Mitel's Chief Information Officer, Jamshid Rezaei, points to Dunnion's experience in implementing and operationalizing cybersecurity policies and procedures. Dunnion's own quoted statement focuses on working with the combined Mitel and Unify teams to build what he calls a cohesive and comprehensive security program.

The Calian role that came just before

The Business Wire release gives his title at Calian as Senior Director of Corporate Cybersecurity. It says he led the development, implementation and operation of Calian's corporate cybersecurity program. It also names the frameworks he worked within. He operationalized the program within the NIST framework and ensured compliance with ISO and SOC2 standards.

A Calian blog page gives a slightly different title. That page introduces him as Director, Corporate Cybersecurity, in a post about AI and machine learning risks published on the CIO Association of Canada website. The page does not explain the difference between the two titles. The Calian summary lists data retention and ownership, transparency and privacy, access control and unintended consequences as the issues organizations must manage.

A non-traditional path, in his own words

Dunnion's education is in engineering. The Mitel release says he has a degree in mechanical engineering from Queen's University in Kingston, Ontario.

In an interview first published by SafetyDetectives and reposted on Mitel's blog, he calls his path to Mitel "far from the traditional one." He describes moving from engineering into running a cyber practice and delivering services for startups. From there he moved into product marketing and manufacturing. That shift led to his first job at Mitel as a product marketing manager.

On Mitel's "We're In!" podcast, he says the CISO job is his second period at the company. He describes the first as product marketing work for Mitel. He calls that first period a five-year stint. He says several people he worked with 25 years ago are still at Mitel, which he says made his return easier.

He also explains how telecom led him into security. On the podcast, he splits his career into two halves. He says the move to voice over IP introduced him to IT and then to security. He says the second half of his career has been in IT security, with roles in sales, marketing, product management and delivery.

How he describes the job

In the SafetyDetectives interview, Dunnion describes the CISO duties in nearly the same words as the April 18, 2024 release: strategy, architecture and standards compliance. He says his engineering and product background helps him understand Mitel from more than a security angle.

On the podcast, he links that mixed background to how he sees the purpose of security. He frames the core question as how to conduct business safely.

He also addresses personal liability for CISOs. In his view, recent cases where CISOs were held liable centered less on the breach itself and more on how it was handled and communicated. He says he asked his employer a specific question, and he recommends that other CISOs ask it too.

Volunteer community work also runs through his career. The release says he chairs the Canadian Cyber Forum in Ottawa as a volunteer. On the podcast, he says he co-founded the group as a security meetup about seven years before the interview.

Stated priorities: ISO compliance and the Unify integration

In the SafetyDetectives interview, Dunnion names his top priority directly. He connects this to European customers. He says high-profile breaches and supply chain attacks have led many European organizations to expect providers to show strict data protection and business continuity planning.

He describes the integration of Unify as pivotal for Mitel's security work. He says it changed the company's scope. He adds that this growth made it harder to keep communications secure, compliant and uninterrupted across multiple platforms.

He ties the compliance work to Mitel's wider technology plans. He names ISO/IEC 27001 as a standard Mitel saw as essential after the Unify acquisition, especially in heavily regulated sectors. He also says compliance helps sales teams clear mandatory security assessments during procurement.

On the choice between integrating systems and migrating them after a merger, he says Mitel starts from customer and business requirements. He says integration often suits cases where speed and continuity matter most. He says migration fits better when the goal is modernization, such as meeting ISO standards or reducing the attack surface.

Integration risks, AI and suppliers

For licensing, policy alignment and shadow IT, Dunnion describes discovery as the first step. Mitel addresses these risks proactively, he says, He says risk assessments follow, along with approved alternatives and internal awareness efforts to drive adoption.

On AI, he says merger periods attract attackers and that generative AI helps them craft convincing phishing. For defense, he describes behavioral analytics and anomaly detection during the integration window. He also describes training work. On the podcast, he calls himself a self-declared skeptic about AI. He cites a public Siemens case in which developers pasted code into the public version of OpenAI's tool. He uses the case to warn that organizations must understand where their data goes.

For a communications vendor, he sees a specific exposure. He says chat, file sharing and voice tools are now tightly integrated, so external parties on a call may see information they should not.

On supply chain security, he says Mitel's suppliers would likely number in the thousands. He describes how he decides where to focus. By his account, a supplier of pens and paper with no IT connection is low risk. A managed service partner with broad access to the environment is high risk and gets the closer due diligence.