Director of Cyber Security

Description

The International Code Council is the leading global source of model codes, standards, and building safety solutions. This includes product evaluation, accreditation, technology, training, and certification. ICC Codes, Standards, and solutions are used to ensure safe, affordable, and sustainable communities and buildings worldwide. While our roots are firmly planted in the development of the Codes and Standards, our growth allows us to offer many more services to support our Codes and Standards.

The Director of Cyber Security is responsible for defining, executing, and continuously improving ICC’s enterprise cybersecurity program, ensuring the confidentiality, integrity, and availability of ICC’s digital assets, intellectual property, member data, and operations. This role leads security strategy and governance aligned to the NIST Cybersecurity Framework 2.0, drives risk-based remediation, and embeds security into ICC’s platforms, cloud environments, and AI initiatives while enabling business growth.

This role also owns ICC’s security relationship with SWK Technologies, our managed security services and vCISO provider, ensuring outsourced security operations are effectively governed, measured, and integrated with ICC’s internal security program. In addition, the Director will lead ICC’s progression toward recognized third-party security certifications (e.g., SOC 2, ISO 27001) and expanded framework adoption (NIST 800-53), building the evidence, controls, and audit-readiness required to achieve them.

• Define and execute enterprise cybersecurity strategy aligned to business objectives and the oneICC agenda
• Establish and maintain security governance aligned to NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover)
• Lead cross-functional security initiatives and serve as a trusted security advisor to executive leadership
• Deliver a monthly security dashboard and quarterly board-level reporting through the CIO

• Develop and mature ICC’s enterprise risk management program, including risk assessment, internal audit, and remediation backlog
• Ensure compliance across PCI-DSS v4, GDPR, CCPA/state privacy, and Section 508 accessibility requirements
• Lead security assessments, gap analyses, and audit activities; maintain policies, standards, and controls
• Certification & Framework Maturity (New Focus Area)
• Own ICC’s roadmap toward recognized security certifications, beginning with SOC 2 Type II readiness and extending to ISO 27001
• Lead gap assessments, control design, and evidence collection required to pass formal certification audits
• Evaluate and adopt expanded frameworks such as NIST 800-53 alongside continued NIST CSF 2.0 maturation
• Reduce reliance on ad hoc customer security questionnaires by replacing them with certification-backed attestations
• Report certification milestones, timelines, and investment needs to the CIO and executive leadership

• Oversee security operations including SOC, SIEM, log coverage, and 24/7 monitoring
• Lead vulnerability management with SLA-based patching and regular scanning cadence
• Own the incident response program, including tabletop exercises, IR firm retainer, and ransomware readiness
• SWK Managed Security Services Oversight (New Focus Area)
• Serve as the primary internal owner of ICC’s security relationship with SWK Technologies, ICC’s outsourced vCISO and managed security services provider
• Govern SWK-delivered services including 24x7 SOC/SIEM monitoring, MDR/endpoint protection, vulnerability scanning, and vCISO advisory support
• Define and monitor SLAs, KPIs, and performance metrics for SWK security services; hold SWK…