Cybersecurity remains one of the best-paid fields in technology, and the gap between entry-level and leadership pay is wide. This guide brings together the most reliable public data on security salaries in the United States and adds what we see in the market as cybersecurity recruiters.
Cybersecurity pay in 2026: the key numbers
The Bureau of Labor Statistics counted about 192,900 information security analyst jobs in 2025. That category covers much of the hands-on security workforce, though many security engineers, architects and managers are classified under other occupations.
How security pay is distributed
The BLS percentile data shows how far pay stretches within a single occupation.
| Pay level | Annual pay (May 2025) |
|---|---|
| Lowest 10% | Less than $75,090 |
| Median | $129,180 |
| Highest 10% | More than $199,850 |
Leadership roles sit well above that top band. Total compensation for CISOs and security VPs usually includes bonus and equity on top of base salary, which is why their packages are reported separately below.
Where common security roles usually fall
Public data rarely breaks pay out by specific security job title, but the pattern across roles is consistent. The table below shows where each role typically sits relative to the BLS distribution. Actual offers depend heavily on company, industry and location.
| Role | Typical experience | Usual pay position |
|---|---|---|
| SOC Analyst (Tier 1 to 2) | 0 to 3 years | Lower band, around the 10th to 25th percentile |
| Security Analyst | 2 to 5 years | Around the median |
| Security Engineer | 3 to 8 years | Above the median |
| Penetration Tester | 3 to 8 years | Above the median |
| Cloud Security Engineer | 4 to 8 years | Upper band, toward the 90th percentile |
| Security Architect | 8+ years | Top band and above |
| Security Manager or Director | 8 to 15 years | Above the top band, with bonus |
| CISO | 15+ years | Executive package with bonus and equity |
Industries that pay the most
According to BLS, median pay for information security analysts by industry in May 2025 was:
| Industry | Median annual pay |
|---|---|
| Information | $138,650 |
| Computer systems design and related services | $132,410 |
| Finance and insurance | $130,630 |
| Management of companies and enterprises | $128,950 |
| Management, scientific and technical consulting | $125,420 |
What CISOs earn
The 2025 CISO Compensation Benchmark Report from IANS Research and Artico Search, based on 566 CISOs in the U.S. and Canada, found that CISO compensation rose 6.7% on average in 2025, with equity growing faster than cash pay. The highest average total compensation was in technology, at about $844,000, followed by financial services at about $744,000.
The report also shows a very wide spread. The top 1% of CISOs earn more than $3.2 million in total compensation, roughly ten times the median. Company size, industry, public or private status and board exposure explain most of that gap.
What pushes cybersecurity pay higher
- Scarce skills. In the ISC2 2025 study, the most cited skills needs were AI (41%), cloud security (36%), risk assessment (29%) and application security (28%). Professionals with proven experience in these areas have the strongest negotiating position.
- Certifications. Advanced credentials such as CISSP, CISM, CCSP and OSCP are often required for senior roles and support higher offers.
- Security clearance. Cleared professionals working on government and defense programs are consistently in short supply.
- Industry. Technology and financial services tend to pay most, especially for leadership.
- Leadership scope. Owning a budget, a team and board reporting moves pay into a different bracket.
Location and remote work
Major markets such as New York, Washington DC, the San Francisco Bay Area and Seattle pay above national averages, reflecting both cost of living and concentrated demand from financial, technology and government employers. Remote roles have widened the candidate pool for employers, and many now set pay by location tiers or a single national band. For senior hires, competition for remote talent means companies outside major markets often need to pay near big-city rates to attract the strongest candidates.
What this means for employers
For companies hiring security talent, the data points to three practical lessons:
- Benchmark before you post. A range set from general IT salary data is likely to be too low for experienced security professionals.
- Move quickly. Strong security candidates often have several processes running at once, and slow interview loops lose them.
- Look beyond base salary. Bonus, equity, training budgets, certification funding and remote flexibility all matter in a close decision.
Key takeaway
The typical information security analyst earned about $129,000 in 2025, the top 10% earned more than $200,000, and security leaders earn far more through bonus and equity. Pay is highest in technology and financial services and for people with cloud, AI, application security and risk skills. For employers, accurate benchmarking and a fast process matter as much as the number on the offer.
Frequently asked questions
What is the average cybersecurity salary in the US?
The U.S. Bureau of Labor Statistics reports a median annual wage of $129,180 for information security analysts as of May 2025. The top 10% earned more than $199,850.
Which cybersecurity jobs pay the most?
Leadership roles such as CISO and VP of Security pay the most, followed by security architects, cloud security specialists and senior engineers.
How much do CISOs make?
It varies widely. The IANS and Artico Search 2025 report found average total compensation of about $844,000 in technology and $744,000 in financial services, with the top 1% above $3.2 million.