Your Source 4 NFO

What will it cost to hire a CISO? You have decided your organization has progressed far enough in its lifecycle to need a CISO, or you are in a regulated industry and know that you must have a CISO to meet the regulations. So, with all things, the question of what you will need to pay your new CISO in today's market comes to the forefront. I have taken the guesswork out of the CISO pay question for you and will present what other people are offering so you can put together a competitive salary based on today's hiring market. This article uses what organizations were offering CISOs on LinkedIn in the months of June and July 2024? Further, all of the jobs could be filled remotely from anywhere in the US so that the numbers used are suitable for the US in general. Some companies post different ranges depending on the metro area but when hiring for a job with scarce qualified applicants, you will pay top dollar no matter where the applicant lives.

There are some issues with the numbers I have compiled, and the biggest issue is that every CISO job did not publicly post their pay ranges. If we had data on every CISO job from the two months I collected data; we could dial in our numbers even more. However, based on the data and my experience speaking with current CISOs at large to medium companies, the numbers are reasonable proxies for the larger market. There is also the question of organization size. Many smaller companies do not have the resources to pay market rates for a CISO. I believe this is also considered as I included only large and medium-sized companies in the numbers. Very small companies and startups are special cases that I chose not to cover in this article.

Before you read on, I recommend checking out my article, 'Hiring a CISO - What to consider.' This article will help you identify all of the skills and experience you will need your new CISO to have, which will be crucial in understanding and applying the CISO pay data presented here.

CISO Pay:
Based on US remote possible CISO jobs posted on LinkedIn from the months of June and July 2024, the lowest offered pay was $120,000, and the highest was $540,000. That gives us a range of $420,000 from the lowest to the highest pay range. I am a fan of removing the very lowest and highest when considering ranges because you will always have outliers in your data, so when we do that, our low to high range becomes $167,000 to $390,000, which seems considerably more reasonable based on personal experience in the market and hiring area based CISOs.

Considering the averages for the low and high numbers, we can start to see what you will need to offer your candidate to get a qualified CISO. The low average minus the outliers is $232,000, and the high average, once again minus the outliers, is $315,000. The averages track pretty well since the largest number of jobs posted ranges very close to or exactly $250,000 on the low end and $300,000 on the high end.

Senior Security resource pay:
Not all people filling CISO roles are called CISOs. So, if you look at the larger pool of CISO-like jobs on LinkedIn, it gives us another view of recent senior security role pay. Once again, we start off with a super low ball, and we have our low end set at $125,000 and our high end at $420,000. It is worth mentioning that the lowest pay range offered had its high range posted at $125,000 more than the low range number. If we discard these two outliers like we did above, our range for high-level security resources starts at $126,000 and ends at $390,000, giving us a total range of $264,000.

Considering the averages for the low and high numbers, we can start to see about what you will need to offer your candidate when looking for a qualified CISO in disguise. The low average minus the outliers is $215,000, and the high average, once again minus the outliers, is $308,000.

What is not considered:
Base pay is all that was analyzed in this article, so stock options, RSUs, or bonuses are not included in these pay numbers as per the postings. Also, things like weeks of vacation (you will need to offer three or more at this level to be competitive) or all of the other things companies use to promote their total compensation packages.

© 2024 Carl Almond