Director of Cyber Security

Description

Company Summary:

The International Code Council is the leading global source of model codes, standards, and building safety solutions. This includes product evaluation, accreditation, technology, training, and certification. ICC Codes, Standards, and solutions are used to ensure safe, affordable, and sustainable communities and buildings worldwide. While our roots are firmly planted in the development of the Codes and Standards, our growth allows us to offer many more services to support our Codes and Standards.

Position Summary:

The Director of Cyber Security is responsible for defining, executing, and continuously improving ICC’s enterprise cybersecurity program, ensuring the confidentiality, integrity, and availability of ICC’s digital assets, intellectual property, member data, and operations. This role leads security strategy and governance aligned to the NIST Cybersecurity Framework 2.0, drives risk-based remediation, and embeds security into ICC’s platforms, cloud environments, and AI initiatives while enabling business growth.

This role also owns ICC’s security relationship with SWK Technologies, our managed security services and vCISO provider, ensuring outsourced security operations are effectively governed, measured, and integrated with ICC’s internal security program. In addition, the Director will lead ICC’s progression toward recognized third-party security certifications (e.g., SOC 2, ISO 27001) and expanded framework adoption (NIST 800-53), building the evidence, controls, and audit-readiness required to achieve them.

Essential Functions:

Strategy & Leadership

• Define and execute enterprise cybersecurity strategy aligned to business objectives and the oneICC agenda
• Establish and maintain security governance aligned to NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover)
• Lead cross-functional security initiatives and serve as a trusted security advisor to executive leadership
• Deliver a monthly security dashboard and quarterly board-level reporting through the CIO

Risk Management & Compliance

• Develop and mature ICC’s enterprise risk management program, including risk assessment, internal audit, and remediation backlog
• Ensure compliance across PCI-DSS v4, GDPR, CCPA/state privacy, and Section 508 accessibility requirements
• Lead security assessments, gap analyses, and audit activities; maintain policies, standards, and controls
• Certification & Framework Maturity (New Focus Area)
• Own ICC’s roadmap toward recognized security certifications, beginning with SOC 2 Type II readiness and extending to ISO 27001
• Lead gap assessments, control design, and evidence collection required to pass formal certification audits
• Evaluate and adopt expanded frameworks such as NIST 800-53 alongside continued NIST CSF 2.0 maturation
• Reduce reliance on ad hoc customer security questionnaires by replacing them with certification-backed attestations
• Report certification milestones, timelines, and investment needs to the CIO and executive leadership

Security Operations & Incident Response

• Oversee security operations including SOC, SIEM, log coverage, and 24/7 monitoring
• Lead vulnerability management with SLA-based patching and regular scanning cadence
• Own the incident response program, including tabletop exercises, IR firm retainer, and ransomware readiness
• SWK Managed Security Services Oversight (New Focus Area)
• Serve as the primary internal owner of ICC’s security relationship with SWK Technologies, ICC’s outsourced vCISO and managed security services provider
• Govern SWK-delivered services including 24x7 SOC/SIEM monitoring, MDR/endpoint protection, vulnerability scanning, and vCISO advisory support
• Define and monitor SLAs, KPIs, and performance metrics for SWK security services; hold SWK accountable in weekly/monthly partnership reviews
• Own privileged access governance for SWK, including break-glass account controls, admin account segmentation, and audit trail requirements
• Ensure clear delineation of responsibilities between SWK and internal ICC security/IT teams, closing gaps in escalation and incident ownership
• Evaluate SWK’s scope over time and recommend adjustments (in-source vs. outsource) as ICC’s internal cybersecurity capability matures

Content Protection & Data Privacy

• Establish content protection and IP security controls for Digital Codes (DRM, access control, unauthorized redistribution monitoring)
• Govern member PII across 58,000+ member records with appropriate classification, retention, and access controls
• Partner with General Counsel on content protection and litigation-support technical controls
• Identity, Architecture & Cloud Security
• Drive MFA enforcement, SSO coverage, privileged access management, and D365 role-based access control
• Embed security into system design, ERP (D365), AWS/Azure cloud platforms, and AI solutions
• Set standards for IAM and security controls in partnership with Architecture and Engineering

AI & Third-Party Risk Governance

• Establish AI governance controls for AI tool use, data handling, and vendor assessment in partnership with General Counsel
• Manage the third-party/vendor risk program, including assessments for exam delivery, LMS, payment processor, and D365 SI
• Assess third-party security posture and contractual/SLA compliance, including SWK and other managed service providers
• Team Leadership
• Build and lead a high-performing cybersecurity team; foster accountability and continuous improvement
• Drive enterprise security awareness, phishing simulation, and role-based training programs
• Partner with Infrastructure & Operations, Engineering, Architecture, AI Enablement, and TAMs to ensure cohesive, secure delivery

Secondary Functions:

• Support executive reporting, scorecards, and IT strategy/roadmap planning
• Assist with security budgeting, vendor management, and cyber insurance alignment
• All other duties as assigned

Requirements

Essential Skills and Education/Experience:

• Bachelor’s degree in a related field (Master’s preferred) or equivalent experience
• 10+ years of progressive cybersecurity experience
• 5+ years of leadership experience
• Experience leading or supporting SOC 2 and/or ISO 27001 certification efforts strongly preferred
• Experience managing outsourced/MSP or vCISO security relationships preferred
• Deep knowledge of NIST (CSF 2.0, 800-53), ISO 27001, and CIS frameworks
• Experience with SOC, SIEM, cloud security (AWS/Azure), and IAM
• Strong background in data protection, privacy compliance, and threat management
• Familiarity with third-party audit processes, control evidence collection, and compliance attestations
• Executive communication; ability to translate technical risk into business terms
• Ability to lead cross-functional teams and influence senior stakeholders
• Strong vendor management skills, with proven ability to hold managed service providers accountable to SLAs
• CISSP, CISM, CRISC, and/or cloud security certifications
• Experience with SOC 2/ISO 27001 auditor coordination (e.g., prior audit lead or liaison role) a plus

Physical Requirements:

• Ability to sit for extended periods while working at a computer or desk
• Occasional standing, walking, and reaching to access files or office supplies
• Manual dexterity for typing, filing, and handling office equipment
• Ability to lift and carry up to 20 pounds occasionally (e.g., office supplies, documents)
• Visual acuity to read printed and digital materials
• Auditory ability to communicate effectively in person and over the phone
• May need to climb stairs in multi-level office building
• Ability to travel up to 10-20% annually

Environmental Conditions:

• Indoor and Outdoor Environment
• Must be able to work in standard office environment with artificial lighting and climate control

Disclaimer:

This description is not an exhaustive list of all responsibilities, duties, and skills required. The company reserves the right to change or add duties to this position as business needs require.

International Code Council offers a competitive starting salary and comprehensive benefits package that includes paid vacation and sick time, health/dental/vision insurance, 401k with generous company match immediately vested, company paid basic life insurance, short-term and long-term disability coverage. Additional voluntary benefit offerings are available, such as critical illness insurance, flexible spending accounts, and pet insurance.

International Code Council provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, citizen status, religion, ancestry, national origin, age, disability, sex, marital status, military status, pregnancy, sexual orientation or any other basis prohibited by applicable federal, state or local employment laws or regulations in every location in which the company has facilities.