Get started Bring yourself up to speed with our introductory content.

Information security salary: Determining the value of security skills

Understanding the leverage you may have in your information security job is critical to getting the maximum compensation for your skills. In this month's Security Career Advisor tip, Lee Kushner and Mike Murray describe how to ascertain the value of your security skills.

In order to align compensation expectations appropriately with their skills and their worth to a current employer, information security professionals must understand their market value. And, while there are not absolute metrics that will enable an individual to determine fair compensation with absolute certainty, this month's career tip outlines three key factors to help security pros determine their market value and, in turn, increase their salary negotiating power.

1. The importance of security to the organization
Functions closely aligned with a company's line of business that are essential to its success will be compensated at a higher rate than those that are further removed. So, in order to calculate their professional worth and understand the leverage that they may have in negotiating an information security salary, all infosec pros should understand why their employers have made investments in information security and the value of the assets that they are protecting.

More from Lee and Mike

Want more advice on how to get the infosec job you're looking for?

Read all of Lee Kushner and Mike Murray's Information Security Career Advisor tips at

For example, if you work in a technology company and your job is to make sure software is written securely, you can be confident that the company places value on the skills you bring to the table. If this is the case, you should be able to command something of a premium for your talent.

Conversely, if you work in an environment where information security only exists because of a regulation or an audit requirement, chances are your organization is not concerned with quality or performance, but rather with having a warm body who can serve to demonstrate compliance. In such a situation, you most likely would not have a great deal of leverage and would have to accept whatever the company is willing to pay you with little recourse.

2. The sharpness of your security skills
The information security profession is unique in the wide variety of specialized skills that it demands. In addition, because security and risk management are key elements in the introduction of all new technologies and business regulations, there is great value to professionals who keep their security skills sharp and remain current with new developments in the field, such as emerging attack techniques and new defensive technologies. Information security professionals who let their security skills lapse, however, will find themselves at a competitive disadvantage and will offer less value to their employers.

When figuring out your market value, try to determine which skills make you unique as compared to others, both within in your team and within your field. As you undergo this exercise, ask yourself questions such as:

  1. Which of my skills does my company rely on me (and only me) for?
  2. What new skills have I learned in the last 12 months?
  3. Do I have a good understanding of security/risk trends that correlate with my company's business?
  4. If I had to find a new job tomorrow, which of my skills would have value in the open market?

The more complete your answers are to these questions, the better you will be able to articulate your market value to both current and future employers.

About the authors

The columnists, Lee Kushner and Mike Murray, bring with them different perspectives on career related topics. Together Lee and Mike have advised many information security professionals in various stages of their career development and are regular speakers at industry conferences on information security career-related topics.

Their blog can be found at

Lee Kushner is the President of LJ Kushner and Associates, an executive search firm that has been dedicated to the information security profession since 1999.

Mike Murray is an information security professional and career coach. Mike has held leadership positions in environments that include professional services, security product vendors, and corporate environments.

3. Talent: Supply and demand
Individuals often have more influence over their compensation than they realize, but one factor they cannot control is the external market's need for skills and the competition for talent. In many cases, compensation is determined by the simple laws of supply and demand.

The more options that an information security professional has for similar employment, the better chance that he or she will receive higher compensation. Likewise, if your skills are unique to a specific market, and there are not many options for similar employment, your employer may be able to drive down compensation.

A prime example of this would be the Washington, DC market's need for information security professionals that hold security clearances . For a good portion of the information security work in the DC area, security clearances are required both to provide security services and to sell products to the government. There are many government contractors who compete for this business and can only win if they have the information security professionals on staff to deliver. Thus, information security professionals who hold these clearances can leverage their skills to command higher compensation.

Conversely, if the same infosec pros found themselves in an area where there was not a need for cleared information security professionals, they may have to consider a pay cut to perform a similar job.

Please treat these as guidelines to follow, not absolute gospel. There are many other items that go into determining compensation, and these vary from organization to organization: They can include your current compensation, corporate culture, work/life balance, cost of living, industry, organizational size and too many others to list. The best piece of advice: Continue to build your skills, build your brand and create value. If your current employer does not recognize your worth, chances are a future one will.

This was last published in May 2010

Dig Deeper on Information security certifications, training and jobs

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.