The demand for highly skilled cybersecurity professionals has never been greater.
Organizations across industries are willing to pay top dollar to attract experts who can safeguard their digital environments.
Here are the 10 highest-paying cybersecurity jobs in the US, ranked by median annual salary:
Top 10 Highest Paying Cybersecurity Jobs in the US
| Job Title | Median Annual Pay |
| Chief Information Security Officer (CISO) | $212K |
| Lead Security Architect | $175K |
| Solutions Architect | $161K |
| Applications Security Engineer | $146K |
| Senior Security Consultant | $144K |
| Information Systems Security Engineer (ISSE) | $143K |
| Vulnerability Researcher | $136K |
| Site Reliability Engineer | $136K |
| DevSecOps Engineer | $129K |
| Network Security Analyst | $125K |
Note on methods: We used Glassdoor to collect all employment data above.
1. Chief Information Security Officer (CISO)
Median Base Pay: $212K
Base Pay Range: $172K–$262K
Bonus/Equity: $75K–$139K+
Job Growth: 15% annually (2023–2033)
Open Roles: 1,300+ US postings (2025 monthly average)
Top Companies Hiring: Google Cloud, JPMorgan Chase, Salesforce, Lockheed Martin
Key Industries: Finance, banking, defense & aerospace, healthcare, enterprise SaaS
As the highest-paid role in cybersecurity, the CISO leads the organization’s entire security strategy. This role is in high demand due to the increasing frequency of large-scale cyberattacks, the need for board-level decision-making on cybersecurity, and the years of experience required for the role.
With responsibility for teams, policies, and compliance, CISOs play a critical role in maintaining business continuity.
There is currently a talent gap of at least 4M cybersecurity professionals across the globe (the WSJ states that the US alone could use upwards of 450K more cybersecurity experts even today). And between 2025 and 2035, demand for Information Security Officers is expected to increase by 21%.
Due to the relatively low turnover rate (approximately 11% per year), CISO vacancies are limited. However, when roles do open, the transition often results in a 31% salary increase.
2. Lead Security Architect
Median Base Pay: ~$175K
Base Pay Range: ~$143K–$214K
Bonus/Additional: ~$52K–$98K
Job Growth: 32% (2018 to 2028)
Open Roles: 1,200+ (Glassdoor)
Top Companies Hiring: Atlassian, Charles Schwab, Boeing, National Grid, Honeywell
Key Industries: Aerospace, government contracting, financial services, cloud, SaaS, tech
Security Architects design, implement, and oversee an organization’s entire security framework. They ensure that every system, from network infrastructure to cloud deployments, is built with resilience and scalability in mind.
These professionals evaluate potential attack surfaces, develop encryption and access control protocols, and align company policies with frameworks such as NIST or ISO 27001.
Employers typically prefer candidates with CISSP, SABSA, or AWS Security Specialty certifications, as well as hands-on experience with network design and threat modeling tools like ThreatModeler or Lucidchart.
3. Solutions Architect (Cybersecurity)
Median Base Pay: ~$161K
Base Pay Range: $133K–$194K
Bonus/Additional: $41K–$76K
Job Growth: 3% (2018-2028)
Open Roles: 3,200+ US postings (2025 monthly average)
Top Companies Hiring: Amazon, Salesforce, Oracle, Snowflake, NVIDIA
Key Industries: Software/SaaS, cloud computing, defense contracting, consulting
Solutions Architects in cybersecurity define how security gets integrated into large systems, combining high-level strategy and hands-on implementation. As organizations adopt cloud and hybrid environments, these architects are essential in creating scalable, secure ecosystems.
There are currently more than 5,000 US Solutions Architect job postings on LinkedIn, including higher-paying senior roles.
Top earners in this role can expect to earn over $200,000, based on Glassdoor data.
4. Applications Security Engineer
Median Base Pay: ~$146K
Base Pay Range: $124K–$172K
Bonus/Additional: $26K–$49K
Job Growth: 41% (2025-2040)
Open Roles: 7,621 (2024 data)
Top Companies Hiring: Amazon, WhiteHat Security, Accenture, Confluent, OpenAI
Key Industries: Technology, enterprise SaaS, cloud platforms, fintech, media
Application Security Engineers (also referred to as AppSec Engineers) embed security into software throughout its development lifecycle. They perform various tasks, including threat modeling, static and dynamic code reviews (SAST / DAST), vulnerability scanning, and remediation guidance.
Successful AppSec Engineers typically understand both security and software development deeply. On a day-to-day basis, they work closely with product, QA, DevOps, and security teams.
The highest-paid AppSec Engineers typically hold certifications like CISSP, GIAC (e.g., GWEB, GAST), CISM, and vendor/cloud security certifications. Many roles also require experience with toolchains like Snyk, Veracode, and Checkmarx.
OpenAI is currently hiring a Security Engineer, Application Security, with an estimated salary range between $266,000 and $445,000 + Offers Equity.
5. Senior Security Consultant
Median Base Pay: ~$144K
Base Pay Range: $110K–$189K
Bonus/Additional: $37K–$68K
Job Growth: 15.78% CAGR (2026-2034)
Open Roles: 5,100+ (Cyberseek data)
Top Companies Hiring: Google, FTI Consulting, Deloitte, PwC, Accenture
Key Industries: Management, IT consulting, finance, banking, tech, SaaS
Senior Security Consultants are trusted advisors who help organizations identify risks, design security programs, and guide investments in controls, governance, and compliance.
This role leads engagements such as risk assessments, penetration testing oversight, audit readiness, threat modeling, architecture reviews, and remediation strategies.
In most cases, Senior Consultants collaborate with IT, legal, and operations teams to ensure that security remains a top priority for organizations. Common credentials include CISSP, CISM, CRISC, ISO 27001 Lead Auditor, and vendor/cloud security certs.
Experience in multiple domains (such as cloud, on-prem, identity, compliance) is often essential, as is hands-on involvement in red/blue team work, governance frameworks (e.g., NIST CSF, ISO), or high-stakes security projects.
6. Information Systems Security Engineer (ISSE)
Median Base Pay: ~$143K
Base Pay Range: $123K–$166K
Bonus/Additional: $18K–$33K
Job Growth: 11% year-over-year (2024 to 2025)
Open Roles: 2,615 (12-month data)
Top Companies Hiring: Accenture, Amgen, Deloitte, SAIC, Lockheed Martin
Key Industries: Defense & aerospace, federal contracting, cloud & IT services
Information Systems Security Engineers (ISSEs) specialize in securing enterprise systems and networks at a deep architectural level. This role’s primary focus is on system accreditation (like RMF and NIST 800-53), maintaining system security plans, designing secure configurations, performing continuous monitoring, and implementing technical controls to ensure system security.
In government, defense, or regulated industries, ISSEs often take architectural decisions from senior designers and make them safe and operational. To succeed, ISSEs need.
7. Vulnerability Researcher
Median Base Pay: ~$136K
Base Pay Range: $110K–$168K
Bonus/Additional: $19K–$35K
Job Growth: 10% (2022-2025)
Open Roles: 1,132 (12-month data)
Top Companies Hiring: AWS, Microsoft, Lucid Motors, Booz Allen Hamilton
Key Industries: Software & SaaS, cloud providers, defense & national security
Vulnerability Researchers (sometimes referred to as security researchers or exploit developers) identify and analyze software flaws before malicious actors can exploit them.
The primary objective of this role is to reverse-engineer binaries, analyze patch releases, create proof-of-concept exploits, and publish reports or vulnerability findings. This work is critical in protecting products, platforms, and infrastructure by getting ahead of attackers rather than reacting to them.
Top firms hiring for this niche position pay high-end salaries. For example, hackajob is hiring a Senior Vulnerability Researcher with a salary range between $99,000 and $206,000.
8. Site Reliability Engineer (SRE)
Median Base Pay: ~$136K
Base Pay Range: $111K–$166K
Bonus/Additional: $25K–$47K
Job Growth: 6% year-over-year (2024-2025)
Open Roles: 17,353 (12-month data)
Top Companies Hiring: Google, Cisco, Microsoft, Apple, Lumen Technologies
Key Industries: Cloud, SaaS, technology, fintech, enterprise infrastructure
Site Reliability Engineers (SREs) handle software engineering and operations tasks to build scalable, reliable, and secure services. SREs also help minimize risks by enforcing security controls (hardening, patching, monitoring) within infrastructure.
Because outage or data loss is often more expensive than preventative security measures, SREs are critical in mission-critical platforms. They’re responsible for reducing downtime, ensuring SLAs/SLOs are met, and enforcing durable, secure infrastructure architectures.
According to Lightcast, salaries for Site Reliability Engineers grew 5% over the past 12 months. This is mainly because SREs are increasingly being hired into hybrid “resilience and security” roles. It’s especially evident in finance, healthcare, and AI infrastructure.
- Strong systems engineering skills
- Familiarity with compliance and accreditation (DoD 8570 / 8140, FedRAMP, RMF)
- Deep knowledge of network, OS, and identity components.
Certifications such as CISSP, GIAC (e.g., GSLC, GSEC), and vendor- or DoD-authorized credentials (e.g., IAT/IAM levels) are often required. According to Lightcast labor data, the advertised salary for ISSE roles grew 13% over the past 12 months.
9. DevSecOps Engineer
Median Base Pay: ~$129K
Base Pay Range: $102K–$163K
Bonus/Additional: $40K–$74K
Job Growth: 37% (2020-2030)
Open Roles: 10,700 (12-month data)
Top Companies Hiring: Ford, Lockheed Martin, Amazon Web Services, IBM, Palo Alto Networks
Key Industries: SaaS, cloud platforms, fintech, defense & aerospace, cybersecurity vendors
DevSecOps Engineers embed security into every phase of software development and operations. This role is responsible for building and integrating security tooling, enforcing policy-as-code, automating scans (SAST/DAST), and monitoring for configuration drift or vulnerabilities in CI/CD pipelines.
Lightcast’s latest data shows that the demand for DevSecOps Engineers grew 22% year-over-year, with more than 10,700 active job postings across the US.
Many professionals require certifications such as WS Certified Security – Specialty, GIAC Cloud Security Automation (GCSA), and CompTIA Security+ to succeed in DevSecOps. Most roles also prefer hands-on experience with cloud-native security tools like Terraform, Jenkins, GitHub Actions, Aqua, or Snyk.
10. Network Security Analyst
Median Base Pay: ~$125K
Base Pay Range: $102K–$155K
Bonus/Additional: $16K–$30K
Job Growth: 28% (2025-2040)
Open Roles: 25,612 (CyberSeek)
Top Companies Hiring: Cisco, Fortinet, Booz Allen Hamilton, Verizon
Key Industries: Telecommunications, defense & government, financial services, healthcare, managed security providers
Network Security Analysts protect an organization’s digital infrastructure by monitoring, analyzing, and defending against cyber threats at the network level.
In this role, you’ll configure and maintain firewalls, intrusion detection and prevention systems (IDS/IPS), VPNs, and other network-based defenses. Daily responsibilities often include traffic analysis, investigating alerts, applying patches, and coordinating with SOC (Security Operations Center) teams during incidents.
Strong candidates are typically proficient with tools like Wireshark, Splunk, Fortinet, and Palo Alto Networks firewalls.
Key Factors Impacting Cybersecurity Salaries
Cybersecurity compensation varies widely based on experience, education, specialization, and geography. Understanding these factors can help professionals negotiate more effectively and identify areas to upskill.
Work Experience
Hands-on experience is the strongest salary driver, providing the most significant salary boost (even over certifications and education). For example, entry-level roles (0-2 years) start at $70,000–$100,00 for analysts or engineers.
As you gain experience in cybersecurity, your salary typically grows quickly.
Here’s an example of the average salary of a cybersecurity analyst by years of experience based on Glassdoor data:
- 0-1 year: $103,000/year
- 1-3 years: $113,000/year
- 4-6 years: $125,000/year
- 7-9 years: $133,000/year
- 10-14 years: $143,000/year
- 15+ years: $155,000/year
The average salary increase per experience tier is approximately $10,400. That equals a 7-10% annual increase as professionals progress from entry-level to senior roles.
You can accelerate career growth by looking for hands-on roles (SOC analyst, incident responder) or starting out with relevant internships to avoid extended years in entry-level roles.
Location
Geographic demand, cost-of-living adjustments, and talent shortages create significant salary disparities in cybersecurity. If you secure roles in tech hubs, you’ll likely earn 20-50% more than the national average. But that comes with increased living costs as well.
The national median salary for cybersecurity professionals in 2026 is approximately $135,969, but top-paying cities such as San Jose and San Francisco can push total compensation as high as $175,000 with bonuses and equity.
States such as Washington, D.C., and New York consistently rank among the best for both median pay and open positions. Lower-cost states like North Carolina or Indiana offer higher real-value earnings after cost-of-living adjustments for cybersecurity professionals.
Here’s a look at the top 10 highest-paying cybersecurity states based on ZipRecruiter data.
| Rank | State | Average Annual Salary |
| 1 | Washington | $150,592 |
| 2 | District of Columbia | $150,251 |
| 3 | New York | $145,465 |
| 4 | Massachusetts | $145,211 |
| 5 | Alaska | $143,193 |
| 6 | Vermont | $141,372 |
| 7 | North Dakota | $140,685 |
| 8 | Oregon | $140,579 |
| 9 | Colorado | $139,812 |
| 10 | Hawaii | $138,142 |
| — | National Median (US) | $132,962 |
Regional Insights & Takeaways
- Pacific Northwest (WA, OR, AK):
- Cloud-focused economies centered around Microsoft and Amazon create consistent demand. Washington leads the nation with an average salary of $150,592, the highest in the US.
- East Coast Hubs (NY, MA, D.C.):
- Financial institutions and federal agencies offer strong compensation. Analysts and engineers with active security clearances in D.C. can earn 10–20% premiums.
- Mountain West (CO, UT):
- Colorado and Utah are growing tech hubs with a moderate cost of living, yielding strong real value earnings for professionals in the cybersecurity industry.
- South & Southeast (NC, TX, GA):
- Fast-growing cybersecurity cities like Raleigh, Austin, and Atlanta are narrowing the pay gap in the region. Despite slightly lower base salaries, housing costs are 40–60% cheaper.
If relocating to a high-cost region, you may consider requesting a 15–25% cost-of-living adjustment or hybrid/remote flexibility. There’s still a strong demand for remote opportunities, as FlexJobs reports 29% of new US job postings are for hybrid positions and 12% were fully remote.
Industry
Regulated and high-risk industries consistently pay the highest premiums for cybersecurity professionals. Finance and technology remain the top-paying sectors for data-centric roles, while defense and government offer additional premiums for security clearances.
Emerging AI and machine learning sectors are also quickly increasing salary expectations. For example, analysts skilled in ML threat modeling and AI system hardening can earn up to 35% more than those with a non-AI-based skillset.
| Industry | Avg. Salary (2025 est.) | YoY Growth (Wage) | Job Openings (Annual) | Key Details |
| Information / Tech | $140,482 | 10–12% | ~15,000 | Highest-paying sector. Emphasis on cloud, SaaS, and AI vulnerabilities. Silicon Valley premiums often exceed $150K+ for DevSecOps roles. |
| Finance & Insurance | $130,779 | 8–10% | ~12,000 | Compliance-driven (e.g., PCI-DSS, SOX). Fraud prevention and risk modeling roles earn $10K–$15K in bonuses. |
| Defense / Government | $121,112 | 9–11% | ~10,000 | Security clearances (TS/SCI) add 20%+. Cyber defense analysts average $117,500, rising to $130K+ for DoD contractors. |
| AI / Emerging Tech | $124,406 | 12–15% | ~8,000 | Specialized roles (e.g., AI Security Engineer) reach $152K. Strong demand for ML model risk and data ethics expertise. |
| Healthcare | $113,412 | 7–9% | ~8,000 | Regulated under HIPAA, rising ransomware exposure drives new budgets. Incident response roles average $110K–$120K. |
| Consulting / Management Services | $123,652 | ~8% | ~9,000 | Project-based work. Big Four firms like Deloitte pay $120K–$140K for risk and audit-focused analysts. |
Sources: BLS, Glassdoor, Coursera
Across all sectors, total compensation (base salary + bonus) for mid-level cybersecurity analysts ranges from $113,000 to $140,000, with the top 10% in finance and technology exceeding $160,000 annually.
To maximize your earnings, target high-risk, high-budget sectors like AI, defense, or fintech. You can also earn industry-specific certifications or upskill with specialized training to boost your salary.
Education Level
Education remains one of the strongest salary predictors in the cybersecurity field. While practical skills and certifications often outweigh degrees at mid-to-senior levels, formal education can still provide a clear advantage early on.
It’s certainly possible to enter the field without a degree as a SOC Analyst or IT Support Specialist, earning around $70,000 to $80,000 annually.
However, formal education can boost starting pay by 10–20% and open doors to mid-level roles, such as Security Engineer or Information Security Analyst, where the average starting salary exceeds $100,000 per year.
According to recent data, 56% of cybersecurity professionals hold at least a bachelor’s degree. Below, we’ve broken down cybersecurity salaries by education level, highlighting salary boosts by degree type.
| Education Level | Avg. Salary (2025 Est.) | Salary Boost vs. No Degree | Key Roles Impacted |
| High School / No Degree | $70,000–$80,000 | Baseline | SOC Analyst, IT Support |
| Associate’s Degree | $85,000–$95,000 | +15–20% (~$12K–$15K) | Cyber Analyst, Junior Engineer |
| Bachelor’s Degree (CS / IT / Cyber) | $100,000–$120,000 | +25–35% (~$25K–$30K) | Analyst, AppSec Engineer, Consultant |
| Master’s Degree (Cyber / MBA) | $130,000–$150,000 | +40–50% (~$50K–$60K) | Security Architect, CISO, Manager |
| Ph.D. (Cybersecurity / InfoSec) | $150,000–$180,000 | +60–80% (~$70K–$80K) | Researcher, Policy Advisor, CISO |
Sources: BLS, CyberSeek, EC-Council, ISC², CompTIA
On average, each education tier adds $15,000–$25,000 in annual salary.
- Bachelor’s holders earn 25–35% more than non-degreed peers.
- A master’s degree adds an additional 20–30% for senior roles.
- Doctoral-level professionals, although rare, can earn $180,000 or more in government or research settings.
While degrees boost credibility and long-term mobility, certifications and portfolio-based skills remain the most direct way to break into the field quickly.
Certifications
Certifications are one of the fastest ways to increase your cybersecurity salary and earning potential. They validate specialized skills, strengthen resumes, and open doors to higher-paying roles.
CyberSeek data indicates roughly 57% of cybersecurity job postings list at least one required certification. But it’s becoming more of a necessity each year as a Fortinet survey revealed 91% of respondents say they prefer to hire candidates with certifications.
Below, we’ve covered the most in-demand certifications and their impact on salaries and earning potential.
| Certification | Primary Focus | Avg. Salary Boost (2025 Est.) | Cost / Validity | Best For Roles |
| CISSP (Certified Information Systems Security Professional) | Management, Governance, Risk | +$25K–$30K (avg. $159K total) | $749 / 3 years | CISO, Senior Consultant, Security Manager |
| CCSP (Certified Cloud Security Professional) | Cloud Architecture & Security | +$20K (avg. $140K+) | $749 / 3 years | Security Architect, DevSecOps Engineer |
| CEH (Certified Ethical Hacker) | Penetration Testing, Exploit Development | +$18K (avg. $134K) | $1,199 / 3 years | Vulnerability Researcher, Network Analyst |
| CISM (Certified Information Security Manager) | Governance, Risk, and Compliance | +$22K (avg. $152K) | $760 / 3 years | Security Director, ISSE, Program Manager |
| CompTIA Security+ | Entry-Level Foundations | +$10K–$15K (avg. $90K–$100K) | $404 / 3 years | SOC Analyst, Junior Engineer |
Sources: Global Knowledge, ISC², Glassdoor
The average salary increase per certification is approximately $18,000, with top earners combining multiple credentials to exceed $150K+ within 3–5 years.
Conclusion
In the cybersecurity space, roles that blend deep technical expertise with leadership or specialized skills, such as architecture, forensics, or secure development, are seeing the highest pay.
As digital threats rise in scale and complexity, so too will the demand and the salaries for those who can counter them. If you want to learn more about the cybersecurity industry, feel free to read our collection of regularly updated AI cyberattack statistics.