Director of Cyber Security

INTERNATIONAL CODE COUNCIL INC•Country Club Hills, IL

1d•$160,000 - $180,000

About The Position

The Director of Cyber Security defines, executes, and continuously improves the International Code Council’s enterprise cybersecurity program to protect the confidentiality, integrity, and availability of its digital assets, intellectual property, member data, and operations. The role leads security strategy and governance aligned with the NIST Cybersecurity Framework 2.0, drives risk-based remediation, and incorporates security into ICC’s platforms, cloud environments, and AI initiatives while supporting business growth. The Director owns ICC’s security relationship with SWK Technologies, its managed security services and vCISO provider, and governs the provider’s services and performance. The role also leads ICC’s progress toward security certifications such as SOC 2 and ISO 27001, and adoption of frameworks such as NIST 800-53, including developing the controls, evidence, and audit readiness needed for certification. The position oversees enterprise risk management, regulatory compliance, security operations, incident response, content protection, privacy, identity and cloud security, AI and third-party risk governance, and cybersecurity team development. It reports security updates through the CIO to executive leadership and the board.

Requirements

Bachelor’s degree in a related field, a master’s degree preferred, or equivalent experience.
At least 10 years of progressive cybersecurity experience.
At least 5 years of leadership experience.
Deep knowledge of NIST CSF 2.0, NIST 800-53, ISO 27001, and CIS frameworks.
Experience with SOC, SIEM, cloud security using AWS and/or Azure, and IAM.
Strong background in data protection, privacy compliance, and threat management.
Familiarity with third-party audit processes, control evidence collection, and compliance attestations.
Executive communication skills and ability to translate technical risk into business terms.
Ability to lead cross-functional teams and influence senior stakeholders.
Strong vendor management skills and demonstrated ability to hold managed service providers accountable to SLAs.
Ability to sit for extended periods while working at a computer or desk.
Manual dexterity for typing, filing, and handling office equipment.
Visual acuity to read printed and digital materials, and auditory ability to communicate effectively in person and over the phone.
Ability to lift and carry up to 20 pounds occasionally.
May need to climb stairs in a multi-level office building.
Ability to travel up to 10–20% annually.

Nice To Haves

Experience leading or supporting SOC 2 and/or ISO 27001 certification efforts.
Experience managing outsourced, MSP, or vCISO security relationships.
CISSP, CISM, CRISC, and/or cloud security certifications.
Experience coordinating with SOC 2 or ISO 27001 auditors, such as serving as an audit lead or liaison.

Responsibilities

Define and execute enterprise cybersecurity strategy aligned with business objectives and the oneICC agenda.
Establish and maintain security governance aligned with the NIST CSF 2.0.
Lead cross-functional security initiatives and advise executive leadership on security matters.
Deliver monthly security dashboards and quarterly board-level reporting through the CIO.
Develop and mature the enterprise risk management program, including risk assessments, internal audits, and remediation tracking.
Ensure compliance with PCI-DSS v4, GDPR, CCPA and state privacy requirements, and Section 508 accessibility requirements.
Lead security assessments, gap analyses, and audits; maintain security policies, standards, and controls.
Lead the roadmap toward SOC 2 Type II readiness and ISO 27001 certification, including gap assessments, control design, evidence collection, and audit preparation.
Evaluate and adopt expanded frameworks such as NIST 800-53, and report certification milestones, timelines, and investment needs.
Oversee security operations, including SOC, SIEM, log coverage, and 24/7 monitoring.
Lead vulnerability management through SLA-based patching and regular scanning.
Own the incident response program, including tabletop exercises, an incident-response firm retainer, and ransomware readiness.
Serve as ICC’s primary internal owner for its security relationship with SWK Technologies.
Govern SWK-delivered SOC/SIEM monitoring, MDR and endpoint protection, vulnerability scanning, and vCISO advisory services.
Define and monitor SLAs, KPIs, and performance metrics for SWK services, and hold the provider accountable through regular reviews.
Govern SWK privileged access, including break-glass controls, administrator account segmentation, and audit trails.
Clarify SWK and internal team responsibilities and close gaps in escalation and incident ownership.
Evaluate SWK’s scope and recommend changes to outsourced or in-house services as ICC’s cybersecurity capabilities mature.
Establish content protection and intellectual property security controls for Digital Codes, including digital rights management, access controls, and unauthorized redistribution monitoring.
Govern classification, retention, and access controls for member personally identifiable information across more than 58,000 member records.
Partner with General Counsel on content protection and litigation-support technical controls.
Drive multifactor authentication, single sign-on coverage, privileged access management, and D365 role-based access control.
Embed security into system design, D365, AWS and Azure cloud platforms, and AI solutions.
Set identity and access management and security-control standards with Architecture and Engineering.
Establish AI governance controls for AI tool use, data handling, and vendor assessment with General Counsel.
Manage the third-party and vendor risk program, including assessments for exam delivery, LMS, payment processor, and D365 systems integrator vendors.
Assess third-party security posture and contractual and SLA compliance, including SWK and other managed service providers.
Build and lead a high-performing cybersecurity team, fostering accountability and continuous improvement.
Lead enterprise security awareness, phishing simulation, and role-based training programs.
Partner with Infrastructure & Operations, Engineering, Architecture, AI Enablement, and TAMs to support cohesive and secure delivery.
Support executive reporting, scorecards, and IT strategy and roadmap planning.
Assist with security budgeting, vendor management, and cyber insurance alignment.
Perform other duties as assigned.