The Best-Paying IT Security Jobs of 2015

Nerval's Lobster writes: It's no secret that tech pros with extensive IT security backgrounds are in high demand, especially in the wake of last year's high-profile hacks of major companies such as Sony and Home Depot. Which security-related job pays the most? According to a new analysis of Dice salary data, a lead software security engineer can expect to earn an average of $233,333 in 2015, followed by a director of security, who can expect to earn $200,000. Nor are those outliers: Chief information security officers, directors of information security, and IT security consultants can all expect to earn close to $200,000, if not more. While many subfields of IT security prove quite lucrative, there are also other jobs that earn below the average for tech pros. Security analysts will make an average of $59,880 this year, for instance, while security installation technicians—because somebody needs to install the cameras and sensors—can expect to earn $31,680. Compare that to the average tech-pro salary of $89,450 in 2014, which is only expected to rise this year. According to a 2014 report from Global Knowledge and Penton, those armed with certifications such as CRISC, CISM, and CISA can expect to earn a healthy six figures a year.

Comments

Umm, yeah?

[fuzzyfuzzyfungus]

I know that smearing 'security' all over things is popular; but isn't this almost comically similar to non-security job descriptions?

Suitably high level technical skill pays very well, 'Director of' and 'Chief Something Officer' pay well to very well, 'consultants' are either quite expensive or powerless peons who have been reclassified to avoid labor laws that apply to real employees; and installation technicians aren't quite below the poverty line.

Re:Umm, yeah?

[Anonymous Coward]

our company got conned into hiring one of these "security consultants". all they did is plug their laptop in, type in server IPs, click a button, and then print out the report. which was all the unfixed items that were ultra-low priority along with several false positives. upper management was impressed and even had sales bragging to customers about our focus on security.

Re:Umm, yeah?

[gatkinso]

Hell at least he found something, even if all he did was fire up Metasploit. Many times you don't even get that.

Re:Umm, yeah?

[bluefoxlucid]

It's industry fast-talk meant to muddle your minds. Look at this:

Compare that to the average tech-pro salary of $89,450 in 2014, which is only expected to rise this year.

In all stable markets, salaries rise. In the dot-com boom, IT people were getting $150k-$250k; they dropped to $60k, and have been on the rise since. Why did they drop? Because the bubble bust and because everyone went to school for IT; we have a STEM glut, especially in IT, so salaries are low. As long as we continue the narrative of climbing salaries for high-value IT professionals, people will go to college for IT, and will continue to contribute to the high candidate availability and relatively low salary. With such a stable market--constantly and continuously oversupplied with labor--salaries will climb at a slow pace, but they will always climb.

Showing high average salaries, especially un-adjusted for high-cost areas where many technicians live, puts out golden dollar signs for people to chase. People imagine themselves one day as a Director of IA, a VP of InfoSec, a CISO, a big-name boss doing as little work as possible for a maximized salary. They don't consider that such positions are on the order of one per company, matched to the company's size (small business's Director of Information Security is going to get small-business salary), and actually a whole hell of a lot of work--and not just tech work, but work of a different nature you may find greatly rewarding or horrifyingly torturous. It doesn't matter; they go to get those degrees in IT and IT Security, imagining themselves rolling in money.

Welcome to higher-education initiatives, where the Government facilitates college education. We've shifted social responsibility from businesses--who would normally experience pain from a lack of professionals and thus aggressively supply education and training to career entrants in order to maximize their profitable strategic market advantage--to individuals--who face higher risks and a greater chance of unemployment for the potential to garner lower salaries, but believe themselves advantaged by being able to independently acquire a certification of their skill in an area which they would have otherwise acquired by advancing their career and drawing income. The point of supplying free college education or government-backed loans is to transfer power and, ultimately, money away from the individual laborer and to the hands of large businesses in the most non-intuitive and unrecognizable way, so that people will cry out for more of this rather than recognizing how much harm it's doing to them.

Re:Umm, yeah?

[Opportunist]

Why didn't your CISO step in?

We had a company try to pull that one on us, too. They even had the chuzpah to just fire up Nessus, create a report and dump it on us. And that was certainly not what was agreed on in the contract. When asked to show what else they did, they came up with a list of things they actually could have done, of course with no findings because "our security is so good"... and they would even have gotten away with it if it wasn't for our internal team to find a security hole just that time, and one that is SO damn blatant that anyone not faking it would have had to find it.

We still paid. It's horribly difficult to prove something like that in court. But I have a hunch that they are having a hard time getting more contracts. You see, word travels...

Ummm.....

[Anonymous Coward]

Hello!

I am a security engineer at the biggest cloud platform company in the world... 8 years... I seem to need an adjustment =P

I seem to be missing out on a nice chunk =P

Re:Ummm.....

[grimmjeeper]

That's because they already have you. The only way to really keep your salary up to average or better is to jump companies every once in a while.

Woah, stop the presses

[Anonymous Coward]

"While many subfields of IT security prove quite lucrative, there are also other jobs that earn below the average for tech pros."

Wait, so some people earn ABOVE average and some earn BELOW? Stop the freaking presses people.

Re:Woah, stop the presses

[grimmjeeper]

A full half of the population is below average.

Re:Woah, stop the presses

[Anonymous Coward]

Not true - 99.999% of the population have above average number of fingers

Re:Woah, stop the presses

[ShanghaiBill]

A full half of the population is below average.

You are thinking of "median", but "average" generally refers to the mean. More than 90% of households earn less than the mean.

$31K?

[deadweight]

That is $15/hr. I hope no one thinks paying that for any kuind of critical security infrastructure is a good idea. They could be bribed with things like free movie tickets or a Big Mac.

The best paying IT security jobs in 2015

[ArhcAngel]

Heh, the best paying IT security jobs in 2015 are in a bunker in Russia writing viruses. Followed closely by phishing experts in Europe posing as African royalty.

Stagnant pay for IT

[msobkow]

I was making $85,000/yr in the '90s in IT. Bumping that by only $15,000 in 25 years seems kind of insulting.