A survey of nearly 700 CISOs in the US and Canada has found that salaries have risen over the last year to an average of $565,000 and a median of $403,000, with the top 10 percent of execs pulling in over $1 million.

(That's about £426,000, £304,000, and £754,000, respectively.)

[1]The data showed that by far the most effective way to boost your pay was to switch jobs, or at least threaten to, and get a counter offer from your original employer. Both moves bring an average compensation increase of 31 percent. By contrast, just doing your job and getting an annual pay rise would increase the average salary by just 6.3 percent, according to data from IANS Research and recruitment firm Artico.

[2]

However, at the moment fewer CISOs are considering this route. This fifth annual survey found that staff turnover has nearly halved since the heady days of the 2022s, when 21 percent of those surveyed had moved jobs in the previous 12 months.

[3]

[4]

"We believe it's largely a macroeconomic situation," Nick Kakolowski, senior research director at IANS Research, told The Register .

"It's a combination of businesses being conservative and waiting for a little bit more stability, and CISOs being conservative and waiting for a little bit more stability. We're seeing more movement starting in the market, and we expect that to continue. We don't have a great sense of when it's going to get back to – or if it's going to get back to – the tons of movement days of the early 2020s, and post-pandemic, but we expect a much more active year next year."

[5]70% of CISOs worry their org is at risk of a material cyber attack

[6]US senator claims UnitedHealth's CEO, board appointed 'unqualified' CISO

[7]CISOs' salary growth slows – with pay gap widening

[8]AWS CISO tells The Reg: In the AI gold rush, folks are forgetting application security

If you're looking for the most lucrative CISO job, the tech industry is the place to go. While average base pay of $407,000 isn't the highest (financial services bags that prize at $495,000), once you factor in bonuses and equity then tech is the clear winner at $721,000.

"In today's environment of cash preservation, we're seeing companies utilize equity more often than cash as a negotiation and retention tool," explained Steve Martano, cyber recruiter at Artico Search. "Public companies are using equity to entice new security leaders and to retain them, privately held companies similarly leverage equity-rich packages to preserve EBITDA."

[9]

At the other end of the scale is education, where average base pay is $243,000, while hospitals and clinics come in at $334,000. For the first time this category had to be split from the rest of the healthcare industry, because the disparities are so wide – $465,000 was the average for pharma and medical insurers.

Another trick to boost compensation is to go back to the office – at least part-time. The survey found that hybrid or office workers got more than a 6 percent increase in their pay last year. One in five remote workers saw their pay packet stay the same last year, and 45 percent got a less than 5 percent increase.

The rich are also getting richer while the poor are getting poorer. Among the top 10 percent of best-paid CISOs, 23 percent saw their salaries rise by over 20 percent. Among the 25 percent of the lowest-paid CISOs, two thirds said their salaries hadn't changed, or had risen less than 5 percent.

[10]

And as with most jobs in the US, it also matters where you work, Kakolowski opined. California tops the salary scales, unsurprisingly, and CISOs are more than twice as likely to get some form of equity – reflecting the startup culture on the West Coast.

The North East is the second most lucrative place to work, but outside of these two the South East was the most rewarding. Kakolowski cited the financial services groupings around North Carolina, the thriving biotech scene, and Texas's burgeoning tech sector. Canadian CISOs reported the lowest earnings, but at least they have cheap healthcare to make up for it. ®

Get our [11]Tech Resources



[1] https://www.iansresearch.com/resources/infosec-content-downloads/detail/2024-ciso-compensation-benchmark-summary-report

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zv6_ogrroCZoV3csRxdN6wAAAIw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zv6_ogrroCZoV3csRxdN6wAAAIw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zv6_ogrroCZoV3csRxdN6wAAAIw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2024/05/23/cisco_survey_2024/

[6] https://www.theregister.com/2024/05/31/ron_wyden_letter_unitedhealth/

[7] https://www.theregister.com/2023/10/11/cisos_salary_growth_slows/

[8] https://www.theregister.com/2024/05/13/aws_ciso_ai_security/

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zv6_ogrroCZoV3csRxdN6wAAAIw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zv6_ogrroCZoV3csRxdN6wAAAIw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[11] https://whitepapers.theregister.com/