IANS Research and Artico Search conducted a survey to shed light on compensation trends in the cybersecurity industry and found that the top 10% of senior directors averaged close to $800k in total compensation, while experience and education, company size, and gender were potentially influential factors.

The Cybersecurity Staff Compensation Benchmark Report 2023–2024 analyzed 563 cybersecurity professionals across a range of industries and company types in the U.S. and Canada.

It showed that for U.S.-based cybersecurity professionals, the annual cash compensation for the director role averages $258,000, with total compensation reaching $330,000. Senior directors see even higher figures, averaging $325,000 in cash compensation and $402,000 in total compensation. Notably, about 20% of directors' total compensation is attributable to annual equity.

The average total compensation for managers and senior managers is $183,000 and $268,000 respectively.

For the technical roles, security architects' average cash compensation varies from $184,000 to $229,000 for senior positions, plus equity values approximating 40% of the base salary. Engineers and analysts have lower total pay ranges than other roles, averaging $174,000 to $193,000 and $118,000 to $145,000, respectively.

In addition, the report also highlights the compensation for the top 25% in each role. For instance, the top quartile total compensation for senior cybersecurity directors begins at $498,000, with the top 10% averaging a staggering $790,000; these two figures for the cybersecurity analyst role are $156,000 and $250,000.

The report argues that Chief Information Security Officer (CISO) should be mindful of these pay ranges.

“CISOs who are concerned about attrition or are planning to begin a search for this talent should understand the market in order to target and source candidates who are in the compensation range and recruitable,” Steve Martano, partner of cybersecurity practice at Artico Search, wrote in the report. “If a CISO considers someone a top performer and in the top quartile for their peer group, they can then assess the compensation compared to that individual’s peer group.”

The report analyzes various factors and criteria impacting the compensation, including personal experience, education levels, gender, location and employer size.

The researchers set the baseline for the overall average cash compensation and total compensation for all U.S.-based staff within the sample at $185,000 and $210,000, respectively.

They found that experience and level of education contribute favorably to compensation levels as expected. Cybersecurity professionals with at least 12 years of relevant experience can have an annual cash compensation as much as 22% above the baseline. On the flip side, those with fewer than three years of relevant experience earn packages of up to 40% below the baseline. Meanwhile, the impact of advanced degrees on cash compensation is a positive 12%.

Companies with annual revenues exceeding $10 billion tend to pay above market rates, while small and midsize businesses with revenues below $1 billion typically pay below the baseline.

Moreover, data from the report suggest a gender pay gap of about 7%, although it varies by experience level and role. Among cybersecurity professionals with 12-plus years of experience, there is a double-digit pay gap between males and females.