CISO Paychecks: Worth the Growing Security Headaches?
CISOs cash compensation tops $400,000 now, but the high pay comes with struggles, rapidly changing responsibilities, and tight budgets.
Cybersecurity professionals serving as chief information security officers (CISOs) continue to see respectable increases in pay, but not at the same rate as two years ago, and not in a way the keeps up with the changes to their responsibilities.
The average CISO now earns $403,000 in annual compensation — including salary, bonuses for reaching specific goals, and equity, such as stock options — representing a 6.4% increase over the past 12 months, according to IANS Researchs 2024 CISO
Compensation
Report published on Oct. 2. However, changes to the threat landscape frequently put business operations under attack, the responsibility for which falls on the shoulders of the CISO, especially following rules issued by the Securities and Exchange Commission (SEC) that requires CISOs to determine whether
a breach is material within four days of discovery
.
CISOs often do not have enough resources at heir disposal to do so, putting them in legal jeopardy, or, conversely, are successfully mitigating threats only to endure budget pressures because of that success, says Fred Kwong, vice president and CISO at DeVry University.
Theres this dichotomy between, Hey, Freds doing a good job, keeping on top of the threats, mitigating the issues, [yet] at the same time [hes] asking for more resources, more money, even when theyre seeing that the threat is not actualized, he explains. Were kind of getting questioned, Well, do we really need another person? Do we need really need another technology or control, because it seems like you have these things handled.
Kwong manages a team of five other cybersecurity professionals, but continues to fight to hire a sixth — even though the organization is unlikely to approve another full-time employee.
Source: 2024 CISO Compensation Report, IANS and Artico
In 2021 and 2022, following increased remote work due to the pandemic, companies found themselves needing to secure their operations infrastructure, driving demand for CISOs — especially as cybercriminals started
compromising firms and infecting their systems with ransomware
. While CISOs made significant gains in compensation during the tail end of the pandemic — 44% either switched jobs or took a retention bonus in 2022 — the demand now shows signs of settling down, with only 11% doing the same in 2024, says Nick Kakolowski, senior research director at IANS Research.
We are seeing generally a lack of movement, mostly because of macroeconomic conditions — businesses are just being conservative about hiring more, he says. Businesses are kind of saying, Well get by with what we have for a while. Well hold off on hiring. Well keep on our current path, and more CISOs are staying put, rather than taking the risk of taking on something new right now.
CISOs that move jobs — or are paid an incentive to stay in their current position — see the biggest increases in compensation, and
CISOs for state governments
are among the most likely to move. Nearly half of states hired a new CISOs in the past year, leading the average tenure of a CISO to drop
from 30 months in 2022 to 23 months this year
, according to the biennial Deloitte-NASCIO Cybersecurity Study.
Stress will only continue to build for CISOs in state government positions: Finding and retaining cybersecurity-skilled professionals is difficult, more
sophisticated attacks
— such as ransomware — have become common, and budgets continue to be tight and often hard-to-predict, says Srini Subramanian, principal with the risk and financial advisory group at consulting firm Deloitte.
Government cybersecurity professionals, which make between $125,000 to $225,000, typically do not include compensation in their Top 3 reasons for job satisfaction. Yet, increasing attacks and greater consequences for their networks, along with increased scrutiny for any outage or incident, puts them squarely in the in the eyes of the public and government officials, he says.
The state-level systems are also dealing with ... a lot more challenges compared to a private sector systems, Subramanian says. They have budget constraints, they have talent constraints, and now we are expanding the scope of the systems even more.
Daniel Schwalbe used to work as a security pro under the CISO at the University of Washington, a large public university, which meant that his role bridged both government and education sectors. He loved the work, and he certainly wasnt there for high pay, he says. Education CISOs are the lowest-paid of all the industries tracked by the IANS survey, with a median annual total compensation of $243,000 (the government sector was not listed).
Yet, the security work was neverending, he says.
We had half a million devices on a network that we were supposed to protect, and I can tell you that on any given day, we pretty much figured there are 1,000 compromised devices on that network out of half a million, he says. Thats just the reality.
When he left, it wasnt about scoring a better salary, but about combatting the lack of a career path. The only position left for him to graduate to in the security career track at UW was CISO, but the current holder of that position did not intend to retire for at least three years. So, he accepted the job of deputy CISO with Farsight Security, and assumed the role of CISO at DomainTools when that company bought Farsight.
His responsibilities have changed somewhat. Compliance is more of an issue at a private firm, whereas the government and education sector have to deal with bureaucracy. Yet, making technology work better for security is a common factor, and he hopes that automation will reduce stress across the board.
Investing a little bit upfront and tuning the alerts — so the stuff that actually comes out of your security tools is much more useful — can help, he says. It costs money, and its not a silver bullet, but in my opinion, it does help and can help with issues like threat analyst burnout.
The research firms analyses also found that
hot potato of AI risk
is putting a lot of pressure on CISOs as individuals, escalating the stress. IANS Researchs Kakolowski says that, typically, no one security pro in the business is really well positioned to own AI. The right person needs a blend of technical, governance, privacy, and data-science backgrounds to really help organizations fully manage the risk, he says.
Usually, CISOs do not check all those boxes, which could expose them to liability.
CISOs are becoming the go-to person to inform
AI risk decisions
, and theres this pushback where CISOs say, Well, we cant own all of this risk, because this risk isnt owned by the business unit, he says. Using the tooling, we can help inform you about this risk, and we can help you understand this risk, but you have to ultimately be the ones making that decision and taking that ownership.
Tags:
CISO Paychecks: Worth the Growing Security Headaches?