Director of Cyber Security

International Code Council; Country Club Hills (IL); On-site; USD 160,000 - 180,000; Full time

Benefits offered by this job

Health insurance

401k with match

Paid vacation and sick time

Life insurance

Job summary

International Code Council (ICC) is seeking a Director of Cyber Security to define and execute ICC’s enterprise cybersecurity program, aligning with NIST CSF 2.0 and driving risk-based remediation across platforms and cloud environments. The role includes governance, third‑party risk, and leading responsibility for certifications with SWK and internal teams.

The position requires 10+ years in cybersecurity, 5+ years in leadership, and experience with SOC 2 and ISO 27001.

Qualifications

• Bachelor’s degree in a related field or equivalent experience.
• 10+ years of progressive cybersecurity experience.
• 5+ years of leadership experience.
• Experience with SOC 2 and ISO 27001 certification efforts preferred.
• Experience managing outsourced/MSP or vCISO relationships preferred.
• Deep knowledge of NIST CSF 2.0, 800-53, ISO 27001, CIS frameworks.
• Experience with SOC, SIEM, cloud security (AWS/Azure), and IAM.
• Ability to translate technical risk into business terms.

Responsibilities

• Define and execute enterprise cybersecurity strategy aligned to ICC objectives.
• Lead governance under NIST CSF 2.0 and drive program maturity.
• Oversee security operations, incident response, and vulnerability management.
• Own relationships with SWK Technologies and external security providers.
• Lead certifications readiness (SOC 2 II, ISO 27001) and audit activities.
• Provide executive reporting and secure budget alignment.
• Foster cross-functional collaboration across IT, legal, and business units.

Skills

Cybersecurity leadership

NIST CSF 2.0

Executive communication

Vendor management

Risk-based remediation

Cloud security

IAM

Audit coordination

Education

Bachelor’s degree in a related field

Master’s degree preferred

Tools

SOC/SIEM

AWS/Azure security

D365 security

Job description

The International Code Council is the leading global source of model codes, standards, and building safety solutions. This includes product evaluation, accreditation, technology, training, and certification. ICC Codes, Standards, and solutions are used to ensure safe, affordable, and sustainable communities and buildings worldwide. While our roots are firmly planted in the development of the Codes and Standards, our growth allows us to offer many more services to support our Codes and Standards.

Job Type

Full-time

Position Summary

The Director of Cyber Security is responsible for defining, executing, and continuously improving ICC’s enterprise cybersecurity program, ensuring the confidentiality, integrity, and availability of ICC’s digital assets, intellectual property, member data, and operations. This role leads security strategy and governance aligned to the NIST Cybersecurity Framework 2.0, drives risk-based remediation, and embeds security into ICC’s platforms, cloud environments, and AI initiatives while enabling business growth. This role also owns ICC’s security relationship with SWK Technologies, our managed security services and vCISO provider, ensuring outsourced security operations are effectively governed, measured, and integrated with ICC’s internal security program. In addition, the Director will lead ICC’s progression toward recognized third-party security certifications (e.g., SOC 2, ISO 27001) and expanded framework adoption (NIST 800-53), building the evidence, controls, and audit-readiness required to achieve them.

Essential Functions

Strategy & Leadership

• Define and execute enterprise cybersecurity strategy aligned to business objectives and the oneICC agenda
• Establish and maintain security governance aligned to NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover)
• Lead cross-functional security initiatives and serve as a trusted security advisor to executive leadership
• Deliver a monthly security dashboard and quarterly board-level reporting through the CIO

Risk Management & Compliance

• Develop and mature ICC’s enterprise risk management program, including risk assessment, internal audit, and remediation backlog
• Ensure compliance across PCI-DSS v4, GDPR, CCPA/state privacy, and Section 508 accessibility requirements
• Lead security assessments, gap analyses, and audit activities; maintain policies, standards, and controls
• Certification & Framework Maturity (New Focus Area)
• Own ICC’s roadmap toward recognized security certifications, beginning with SOC 2 Type II readiness and extending to ISO 27001
• Lead gap assessments, control design, and evidence collection required to pass formal certification audits
• Evaluate and adopt expanded frameworks such as NIST 800-53 alongside continued NIST CSF 2.0 maturation
• Reduce reliance on ad hoc customer security questionnaires by replacing them with certification-backed attestations
• Report certification milestones, timelines, and investment needs to the CIO and executive leadership

Security Operations & Incident Response

• Oversee security operations including SOC, SIEM, log coverage, and 24/7 monitoring
• Lead vulnerability management with SLA-based patching and regular scanning cadence
• Own the incident response program, including tabletop exercises, IR firm retainer, and ransomware readiness
• SWK Managed Security Services Oversight (New Focus Area)
• Serve as the primary internal owner of ICC’s security relationship with SWK Technologies, ICC’s outsourced vCISO and managed security services provider
• Govern SWK-delivered services including 24x7 SOC/SIEM monitoring, MDR/endpoint protection, vulnerability scanning, and vCISO advisory support
• Define and monitor SLAs, KPIs, and performance metrics for SWK security services; hold SWK accountable in weekly/monthly partnership reviews
• Own privileged access governance for SWK, including break-glass account controls, admin account segmentation, and audit trail requirements
• Ensure clear delineation of responsibilities between SWK and internal ICC security/IT teams, closing gaps in escalation and incident ownership
• Evaluate SWK’s scope over time and recommend adjustments (in-source vs. outsource) as ICC’s internal cybersecurity capability matures

Content Protection & Data Privacy

• Establish content protection and IP security controls for Digital Codes (DRM, access control, unauthorized redistribution monitoring)
• Govern member PII across 58,000+ member records with appropriate classification, retention, and access controls
• Partner with General Counsel on content protection and litigation-support technical controls
• Identity, Architecture & Cloud Security
• Drive MFA enforcement, SSO coverage, privileged access management, and D365 role-based access control
• Embed security into system design, ERP (D365), AWS/Azure cloud platforms, and AI solutions
• Set standards for IAM and security controls in partnership with Architecture and Engineering

AI & Third-Party Risk Governance

• Establish AI governance controls for AI tool use, data handling, and vendor assessment in partnership with General Counsel
• Manage the third-party/vendor risk program, including assessments for exam delivery, LMS, payment processor, and D365 SI
• Assess third-party security posture and contractual/SLA compliance, including SWK and other managed service providers
• Team Leadership
• Build and lead a high-performing cybersecurity team; foster accountability and continuous improvement
• Drive enterprise security awareness, phishing simulation, and role-based training programs
• Partner with Infrastructure & Operations, Engineering, Architecture, AI Enablement, and TAMs to ensure cohesive, secure delivery

Secondary Functions

• Support executive reporting, scorecards, and IT strategy/roadmap planning
• Assist with security budgeting, vendor management, and cyber insurance alignment
• All other duties as assigned

Requirements

Essential Skills and Education/Experience

• Bachelor’s degree in a related field (Master’s preferred) or equivalent experience
• 10+ years of progressive cybersecurity experience
• 5+ years of leadership experience
• Experience leading or supporting SOC 2 and/or ISO 27001 certification efforts strongly preferred
• Experience managing outsourced/MSP or vCISO security relationships preferred
• Deep knowledge of NIST (CSF 2.0, 800-53), ISO 27001, and CIS frameworks
• Experience with SOC, SIEM, cloud security (AWS/Azure), and IAM
• Strong background in data protection, privacy compliance, and threat management
• Familiarity with third-party audit processes, control evidence collection, and compliance attestations
• Executive communication; ability to translate technical risk into business terms
• Ability to lead cross-functional teams and influence senior stakeholders
• Strong vendor management skills, with proven ability to hold managed service providers accountable to SLAs
• CISSP, CISM, CRISC, and/or cloud security certifications
• Experience with SOC 2/ISO 27001 auditor coordination (e.g., prior audit lead or liaison role) a plus

Physical Requirements

• Ability to sit for extended periods while working at a computer or desk
• Occasional standing, walking, and reaching to access files or office supplies
• Manual dexterity for typing, filing, and handling office equipment
• Ability to lift and carry up to 20 pounds occasionally (e.g., office supplies, documents)
• Visual acuity to read printed and digital materials
• Auditory ability to communicate effectively in person and over the phone
• May need to climb stairs in multi-level office building
• Ability to travel up to 10-20% annually

Environmental Conditions

• Indoor and Outdoor Environment
• Must be able to work in standard office environment with artificial lighting and climate control

Disclaimer

This description is not an exhaustive list of all responsibilities, duties, and skills required. The company reserves the right to change or add duties to this position as business needs require.

Benefits and EEO Statement

International Code Council offers a competitive starting salary and comprehensive benefits package that includes paid vacation and sick time, health/dental/vision insurance, 401k with generous company match immediately vested, company paid basic life insurance, short-term and long-term disability coverage. Additional voluntary benefit offerings are available, such as critical illness insurance, flexible spending accounts, and pet insurance.

International Code Council provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, citizen status, religion, ancestry, national origin, age, disability, sex, marital status, military status, pregnancy, sexual orientation or any other basis prohibited by applicable federal, state or local employment laws or regulations in every location in which the company has facilities.

Salary Description

$160,000.00 - $180,000.00