Application Security

9/1/2017
11:00 AM
50%
50%

CISOs' Salaries Expected to Edge Above $240,000 in 2018

Other IT security professionals may garner six-figure salaries as well, new report shows.

Rockstar CISOs are expected to land salary offers of $241,000 in 2018, putting them in the 95th percentile for CISO salary ranges, according to Robert Half Technology's 2018 Salary Guide released this week.

Meanwhile, CISOs in the 75th percentile salary range will likely see $204,000 in 2018, while the midpoint range will be $170,000 and the 25th percentile, $143,250, according to the report, which surveyed 740 human resource officials.

"Whether establishing a salary for a team member or trying to see where you stack up against your peers in the field, there are many factors that come into play" in salary offers, says John Reed, senior executive director of Robert Half Technology.

He noted a candidate's skills, experience, and the complexity of the role will all need to be taken into consideration when assessing which salary percentile is appropriate.

"The midpoint salary is a good indicator of someone who meets the requirements of an open role," Reed says.

The midpoint range for CISOs and information systems security managers have improved over the past couple of years. For example, the Dark Reading 2016 Security Salary Survey found the median annual salary of IT security management was $127,000.

But fast forward to 2018: the Robert Half Technology survey expects information systems security managers to earn as much as $194,250 if in the 95th percentile salary range, followed by $164,250 for the 75th percentile, $137,000 at the midpoint, and $115,250 at the 25th percentile, according to the report.

 

 

Source: Robert Half Technology

 

The salary increases expected next year are part of a trend that has been underway for the past few years, Reed says.

"We’ve seen security salaries growing relatively steadily in the past few years, especially as it has become increasingly difficult to find the talent to fill highly specialized roles," says Reed.

Twenty-two percent of CIOs say maintaining security of IT systems and safeguarding company information was their top concern, and this increased focus is driving the demand for talent, and in turn, salaries, he notes.

"Growing security initiatives have created an imbalance of supply and demand, especially for data and network security professionals who are seeing the compensation to match the complexity of safeguarding their organizations," Reed says.

Security professionals are likely to increase their marketability to prospective employers by completing these certification programs, Reed says.

Certified Information Systems Security Professional (CISSP), Check Point Firewall administration, Cisco network administration, and LINUX/UNIX administration are some of the most frequently required or preferred certifications for security professionals, he says.

"These reputable certifications are good indicators of technically proficient talent. Certifications, especially in the ever-changing and evolving area of security, demonstrate a dedication to the field and the thirst for being on the cutting edge of a profession that requires you to constantly be one step ahead of potential threats," Reed says.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
<<   <   Page 2 / 2
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
9/22/2017 | 11:31:20 PM
Re: Acronym truth
@cybersavior: Clever! And apt. CISOs are often hired to be scapegoats more than anything else -- as an insurance policy in the form of a sacrificial lamb with which to appease the regulators.
<<   <   Page 2 / 2
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVE-2018-16752
PUBLISHED: 2018-09-20
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.