Director of Cyber Security

Apply Job Type Full-time Description Company Summary: The International Code Council is the leading global source of model codes, standards, and building safety solutions. This includes product evaluation, accreditation, technology, training, and certification. ICC Codes, Standards, and solutions are used to ensure safe, affordable, and sustainable communities and buildings worldwide. While our roots are firmly planted in the development of the Codes and Standards, our growth allows us to offer many more services to support our Codes and Standards. Position Summary The Director of Cyber Security is responsible for defining, executing, and continuously improving ICC’s enterprise cybersecurity program, ensuring the confidentiality, integrity, and availability of ICC’s digital assets, intellectual property, member data, and operations. This role leads security strategy and governance aligned to the NIST Cybersecurity Framework 2.0, drives risk-based remediation, and embeds security into ICC’s platforms, cloud environments, and AI initiatives while enabling business growth. This role also owns ICC’s security relationship with SWK Technologies, our managed security services and vCISO provider, ensuring outsourced security operations are effectively governed, measured, and integrated with ICC’s internal security program. In addition, the Director will lead ICC’s progression toward recognized third-party security certifications (e.g., SOC 2, ISO 27001) and expanded framework adoption (NIST 800-53), building the evidence, controls, and audit-readiness required to achieve them. Essential Functions Strategy & Leadership Define and execute enterprise cybersecurity strategy aligned to business objectives and the oneICC agenda Establish and maintain security governance aligned to NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover)Lead cross-functional security initiatives and serve as a trusted security advisor to executive leadershipDeliver a monthly security dashboard and quarterly board-level reporting through the CIO Risk Management & Compliance Develop and mature ICC’s enterprise risk management program, including risk assessment, internal audit, and remediation backlogEnsure compliance across PCI-DSS v4, GDPR, CCPA/state privacy, and Section 508 accessibility requirementsLead security assessments, gap analyses, and audit activities; maintain policies, standards, and controlsCertification & Framework Maturity (New Focus Area)Own ICC’s roadmap toward recognized security certifications, beginning with SOC 2 Type II readiness and extending to ISO 27001Lead gap assessments, control design, and evidence collection required to pass formal certification auditsEvaluate and adopt expanded frameworks such as NIST 800-53 alongside continued NIST CSF 2.0 maturationReduce reliance on ad hoc customer security questionnaires by replacing them with certification-backed attestationsReport certification milestones, timelines, and investment needs to the CIO and executive leadership Security Operations & Incident Response Oversee security operations including SOC, SIEM, log coverage, and 24/7 monitoringLead vulnerability management with SLA-based patching and regular scanning cadenceOwn the incident response program, including tabletop exercises, IR firm retainer, and ransomware readinessSWK Managed Security Services Oversight (New Focus Area)Serve as the primary internal owner of ICC’s security relationship with SWK Technologies, ICC’s outsourced vCISO and managed security services providerGovern SWK-delivered services including 24x7 SOC/SIEM monitoring, MDR/endpoint protection, vulnerability scanning, and vCISO advisory supportDefine and monitor SLAs, KPIs, and performance metrics for SWK security services; hold SWK accountable in weekly/monthly partnership reviewsOwn privileged access governance for SWK, including break-glass account controls, admin account segmentation, and audit trail requirementsEnsure clear delineation of responsibilities between SWK and internal ICC security/IT teams, closing gaps in escalation and incident ownershipEvaluate SWK’s scope over time and recommend adjustments (in-source vs. outsource) as ICC’s internal cybersecurity capability matures Content Protection & Data Privacy Establish content protection and IP security controls for Digital Codes (DRM, access control, unauthorized redistribution monitoring)Govern member PII across 58,000+ member records with appropriate classification, retention, and access controlsPartner with General Counsel on content protection and litigation-support technical controlsIdentity, Architecture & Cloud SecurityDrive MFA enforcement, SSO coverage, privileged access management, and D365 role-based access controlEmbed security into system design, ERP (D365), AWS/Azure cloud platforms, and AI solutionsSet standards for IAM and security controls in partnership with Architecture and Engineering AI & Third-Party Risk Governance Establish AI governance controls for AI tool use, data handling, and vendor assessment in partnership with General CounselManage the third-party/vendor risk program, including assessments for exam delivery, LMS, payment processor, and D365 SIAssess third-party security posture and contractual/SLA compliance, including SWK and other managed service providersTeam LeadershipBuild and lead a high-performing cybersecurity team; foster accountability and continuous improvementDrive enterprise security awareness, phishing simulation, and role-based training programsPartner with Infrastructure & Operations, Engineering, Architecture, AI Enablement, and TAMs to ensure cohesive, secure delivery Secondary Functions Support executive reporting, scorecards, and IT strategy/roadmap planningAssist with security budgeting, vendor management, and cyber insurance alignmentAll other duties as assigned Requirements Essential Skills and Education/Experience: Bachelor’s degree in a related field (Master’s preferred) or equivalent experience10+ years of progressive cybersecurity experience5+ years of leadership experienceExperience leading or supporting SOC 2 and/or ISO 27001 certification efforts strongly preferredExperience managing outsourced/MSP or vCISO security relationships preferredDeep knowledge of NIST (CSF 2.0, 800-53), ISO 27001, and CIS frameworksExperience with SOC, SIEM, cloud security (AWS/Azure), and IAMStrong background in data protection, privacy compliance, and threat managementFamiliarity with third-party audit processes, control evidence collection, and compliance attestationsExecutive communication; ability to translate technical risk into business termsAbility to lead cross-functional teams and influence senior stakeholdersStrong vendor management skills, with proven ability to hold managed service providers accountable to SLAsCISSP, CISM, CRISC, and/or cloud security certificationsExperience with SOC 2/ISO 27001 auditor coordination (e.g., prior audit lead or liaison role) a plus Physical Requirements Ability to sit for extended periods while working at a computer or desk Occasional standing, walking, and reaching to access files or office supplies Manual dexterity for typing, filing, and handling office equipment Ability to lift and carry up to 20 pounds occasionally (e.g., office supplies, documents) Visual acuity to read printed and digital materials Auditory ability to communicate effectively in person and over the phone May need to climb stairs in multi-level office building Ability to travel up to 10-20% annually Environmental Conditions Indoor and Outdoor EnvironmentMust be able to work in standard office environment with artificial lighting and climate control Disclaimer This description is not an exhaustive list of all responsibilities, duties, and skills required. The company reserves the right to change or add duties to this position as business needs require. International Code Council offers a competitive starting salary and comprehensive benefits package that includes paid vacation and sick time, health/dental/vision insurance, 401k with generous company match immediately vested, company paid basic life insurance, short-term and long-term disability coverage. Additional voluntary benefit offerings are available, such as critical illness insurance, flexible spending accounts, and pet insurance. International Code Council provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, citizen status, religion, ancestry, national origin, age, disability, sex, marital status, military status, pregnancy, sexual orientation or any other basis prohibited by applicable federal, state or local employment laws or regulations in every location in which the company has facilities. Salary Description $160,000.00 - $180,000.00