Director of Cyber Security

The International Code Council is the leading global source of model codes, standards, and building safety solutions. This includes product evaluation, accreditation, technology, training, and certification. ICC Codes, Standards, and solutions are used to ensure safe, affordable, and sustainable communities and buildings worldwide. While our roots are firmly planted in the development of the Codes and Standards, our growth allows us to offer many more services to support our Codes and Standards.

The Director of Cyber Security is responsible for defining, executing, and continuously improving ICC's enterprise cybersecurity program, ensuring the confidentiality, integrity, and availability of ICC's digital assets, intellectual property, member data, and operations. This role leads security strategy and governance aligned to the NIST Cybersecurity Framework 2.0, drives risk-based remediation, and embeds security into ICC's platforms, cloud environments, and AI initiatives while enabling business growth.

• Define and execute enterprise cybersecurity strategy aligned to business objectives and the oneICC agenda
• Establish and maintain security governance aligned to NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover)
• Lead cross-functional security initiatives and serve as a trusted security advisor to executive leadership
• Deliver a monthly security dashboard and quarterly board-level reporting through the CIO

• Develop and mature ICC's enterprise risk management program, including risk assessment, internal audit, and remediation backlog
• Ensure compliance across PCI-DSS v4, GDPR, CCPA/state privacy, and Section 508 accessibility requirements
• Lead security assessments, gap analyses, and audit activities; maintain policies, standards, and controls

• Own ICC's roadmap toward recognized security certifications, beginning with SOC 2 Type II readiness and extending to ISO 27001
• Lead gap assessments, control design, and evidence collection required to pass formal certification audits
• Evaluate and adopt expanded frameworks such as NIST 800-53 alongside continued NIST CSF 2.0 maturation
• Reduce reliance on ad hoc customer security questionnaires by replacing them with certification-backed attestations
• Report certification milestones, timelines, and investment needs to the CIO and executive leadership

• Oversee security operations including SOC, SIEM, log coverage, and 24/7 monitoring
• Lead vulnerability management with SLA-based patching and regular scanning cadence
• Own the incident response program, including tabletop exercises, IR firm retainer, and ransomware readiness

• Serve as the primary internal owner of ICC's security relationship with SWK Technologies, ICC's outsourced vCISO and managed security services provider
• Govern SWK-delivered services including 24x7 SOC/SIEM monitoring, MDR/endpoint protection, vulnerability scanning, and vCISO advisory support
• Define and monitor SLAs, KPIs, and performance metrics for SWK security services; hold SWK accountable in weekly/monthly partnership reviews
• Own privileged access governance for SWK, including break-glass account controls, admin account segmentation, and audit trail requirements
• Ensure clear delineation of responsibilities between SWK and internal ICC security/IT teams, closing gaps in escalation and incident ownership
• Evaluate SWK's scope over time and recommend adjustments (in-source vs. outsource) as ICC's internal cybersecurity capability matures

• Establish content protection and IP security controls for Digital Codes (DRM, access control, unauthorized redistribution monitoring)
• Govern member PII across 58,000+ member records with appropriate classification, retention, and access controls
• Partner with General Counsel on content protection and litigation-support technical controls

• Drive MFA enforcement, SSO coverage, privileged access management, and D365 role-based access control
• Embed security into system design, ERP (D365), AWS/Azure cloud platforms, and AI solutions
• Set standards for IAM and security controls in partnership with Architecture and Engineering

• Establish AI governance contro