View
241
Download
1
Category
Preview:
Citation preview
Information Security Salary Index
2016Author
Ryan Farmer
Candidate Development Manager
Introduction
For those of you familiar with previous iterations of Acumin’s annual
Security Salary Index, you may notice things look a little di�erent. This time we have
decided to show only the data that relates directly to the most recent year. The reason
for this is twofold, firstly it’s the most relevant to you (you want to know what you should
be earning now), and secondly role titles and definitions, just like everything else in our
industry, change and develop. The descriptions for the roles we covered when we
began the index back in 2008 are not all valid today, and then of course over the last
18-24 months we have seen the emergence to prominence of several new disciplines
for which there is little or no historical data.
So then we have taken the opportunity to use this year as a fresh start
for a new format and more analytical approach, detailing the context of the changes
we’ve seen. We hope that it may be of some help to you not just in ascertaining what
you should be paid, but also guide you on what is required to attract the right people to
your organisation amidst a competitive market. With that in mind we have taken the
decision to align the release of this report with the new financial year for 2016/2017.
Salary Index 2016
01
Salary Index 2016
02
2015 – Looking Back
It seemed like no one was safe. They weren’t. Figures published for the
percentage of UK companies to su�er a security breach last year range disparately. A
government study conducted by PwC, found that 90% of enterprises recorded a breach
while only 74% of SMEs did likewise . Are smaller companies less attractive as a target,
or more likely organisations aren’t detecting or they’re not disclosing. Either way the
truth remains that cyber security incidents are mainstream news now. Anyone is
vulnerable to an attack at any time, and boardrooms across the country have finally
accepted they need to do something about it. As such we have experienced
unprecedented levels of demand for security professionals over the last 12 months.
Greenfield & SMEs
One of the main growth areas has been within SMEs. This is good news
for the industry, not just because these are typically immature or greenfield sites o�ering
up interesting improvement work, but rather because it’s an indicator of broader and
better awareness of an organisation’s need to manage security risks. It’s not always the
large, obvious targets that are the most lucrative. Cybercriminals much like your average
user will always gravitate towards the path of least resistance.
Development of the SME market is good news for the industry all-round,
growing its surface area and increasing its value. There is far greater market maturity to
be had in more organisations allocating security spend than driving up budgets within
established functions. As a consequence, we have seen substantial demand for security
professionals, particularly contractors, to either transform greenfield sites or move
previously outsourced services back in-house.
1
1HM Government: 2015 Information Security Breaches Survey. Available online at: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/432413/bis-15-303_information_security_breaches_survey_2015-executive-eummary.pdf
Salary Index 2016
03
Security Start Ups
Then there are the solutions themselves. Key technologies we’ve seen
capture the market’s attention last year include privileged access management, threat
intelligence, and security analytics. This only tells half the story though of 2015 in the
world of security vendors. There has been a real buzz around cyber security start-ups
with VC funds investing heavily, and even the emergence of funds that are only
concerned with technology in our industry. In fact, entire events have arisen which
showcase the latest cyber innovations and bleeding edge products.
There is an air of inevitability that the pace will slow around this investment,
but over the last 12 months it has served to fill the vacuum caused by the extensive
merger and acquisition action we saw in 2014, as the household names bought up the
missing pieces to provide end-to-end solutions and services. Again we see a
marketplace that is bristling with innovation, and a number of disruptive technologies
have emerged, particularly around security analytics, threat intelligence, and the move
away from traditional signature-based anti-malware. This has led to some very
interesting opportunities within high-growth and start-up organisations, but this has also
led to the development of new opportunities within consultancies (developing the
internal service around the solution) and end users (implementation, operational, and
improvement work).
Your Bottom Line
So what does this mean for your earning potential?
There have been no actual decreases at the top end of security salary
ranges. There has been some widening of the goalposts if anything, in that the bottom
ends have been decreased to represent relaxed requirements brought about by skills
shortages; companies are saying you don’t have to be the finished article, we’re willing
to invest in you. This can only be a good thing and if we are to tackle the issue of the
great cyber security skills gap, then more approaches like this are going to be needed.
There has always been a reluctance to overspend on training sta� for fear of loss of
investment, or there has been a general requirement for someone to ‘hit the ground
running’. This is not a sustainable model for a high growth industry, or such a close-knit
one, as organisations will simply cannibalise each other’s sta� until salaries and demand
are driven up to unsustainable levels; we saw this starting to occur across 2013-2014.
This is not a responsible way to solve our collective problems as an industry. Fingers
crossed we have now turned the corner.
De-regionalisation
On the subject of new approaches, we finally seem to be moving away
from “London” and “not-London” packages, with discrepancies between regions
closing; in fact many employers we work with are now operating a flat track that is
una�ected by location. This is particularly true with systems integrators where business
rates are not a�ected by regionalisation, and increasingly within end users where we are
seeing greater flexibility for home-working.
2016/2017 - Predictions
Investment
Being at the end of the 2015/2016 payroll year, allows us to make more
insightful observations and predictions about what we will see over the remainder of the
calendar year, as well as the upcoming 12 months for the fiscal year 2016/2017. The
growth of the industry will continue, somewhat unabated. We can certainly expect to
see something of a downturn in VC investment by this point, the major players have
gone through some fairly ambitious investment rounds in to start-up vendors over the
last 12 months or so, and there has to be a natural break point to this. Those who have
received funding will look to execute on strategy and while we expect to see some
further investment in to additional vendors, this year will probably be more about
consolidation of established vendors and market entry of those newer ones.
Security Start Ups
Then there are the solutions themselves. Key technologies we’ve seen
capture the market’s attention last year include privileged access management, threat
intelligence, and security analytics. This only tells half the story though of 2015 in the
world of security vendors. There has been a real buzz around cyber security start-ups
with VC funds investing heavily, and even the emergence of funds that are only
concerned with technology in our industry. In fact, entire events have arisen which
showcase the latest cyber innovations and bleeding edge products.
There is an air of inevitability that the pace will slow around this investment,
but over the last 12 months it has served to fill the vacuum caused by the extensive
merger and acquisition action we saw in 2014, as the household names bought up the
missing pieces to provide end-to-end solutions and services. Again we see a
marketplace that is bristling with innovation, and a number of disruptive technologies
have emerged, particularly around security analytics, threat intelligence, and the move
away from traditional signature-based anti-malware. This has led to some very
interesting opportunities within high-growth and start-up organisations, but this has also
led to the development of new opportunities within consultancies (developing the
internal service around the solution) and end users (implementation, operational, and
improvement work).
Your Bottom Line
So what does this mean for your earning potential?
There have been no actual decreases at the top end of security salary
ranges. There has been some widening of the goalposts if anything, in that the bottom
ends have been decreased to represent relaxed requirements brought about by skills
shortages; companies are saying you don’t have to be the finished article, we’re willing
to invest in you. This can only be a good thing and if we are to tackle the issue of the
great cyber security skills gap, then more approaches like this are going to be needed.
There has always been a reluctance to overspend on training sta� for fear of loss of
investment, or there has been a general requirement for someone to ‘hit the ground
Salary Index 2016
04
running’. This is not a sustainable model for a high growth industry, or such a close-knit
one, as organisations will simply cannibalise each other’s sta� until salaries and demand
are driven up to unsustainable levels; we saw this starting to occur across 2013-2014.
This is not a responsible way to solve our collective problems as an industry. Fingers
crossed we have now turned the corner.
De-regionalisation
On the subject of new approaches, we finally seem to be moving away
from “London” and “not-London” packages, with discrepancies between regions
closing; in fact many employers we work with are now operating a flat track that is
una�ected by location. This is particularly true with systems integrators where business
rates are not a�ected by regionalisation, and increasingly within end users where we are
seeing greater flexibility for home-working.
2016/2017 - Predictions
Investment
Being at the end of the 2015/2016 payroll year, allows us to make more
insightful observations and predictions about what we will see over the remainder of the
calendar year, as well as the upcoming 12 months for the fiscal year 2016/2017. The
growth of the industry will continue, somewhat unabated. We can certainly expect to
see something of a downturn in VC investment by this point, the major players have
gone through some fairly ambitious investment rounds in to start-up vendors over the
last 12 months or so, and there has to be a natural break point to this. Those who have
received funding will look to execute on strategy and while we expect to see some
further investment in to additional vendors, this year will probably be more about
consolidation of established vendors and market entry of those newer ones.
Salary Index 2016
Privacy Concerns
The issue of user and customer privacy will continue to dominate when
it comes to media coverage of our industry. This is due in part to the Snowden
revelations which opened the eyes of the public to the fact that much of what is done
and said online is recorded by someone somewhere… even if it’s only at a metadata
level. Then of course, in the majority of instances where a breach has occurred, those
impacted most are the customers whose data it is that is ultimately the target of many
malicious attacks. Post-incident many organisations o�er free access to credit
monitoring services, and while this is a decent gesture and a responsible move, the
delays around discovery and disclosure often leaves a window of opportunity for
cybercriminals.
Legislating Incident Disclosure
So then at an organisational level, three of the more impactful changes
we might expect to see are likely to be around legislating for post-incident disclosure (or
perhaps a standardised response process), the cyber insurance market will either go big
or crumble like castles made of sand (there’s still a lack of definition, air of mysticism,
and general immaturity of o�erings), and board-level buy-in and investment in security
will steadily continue to increase.
Law Enforcement & Cyber Crime
Law enforcement will finally start to catch up with the commercial sector,
hopefully. Cybercrimes need to be reported to specialists, not local constabularies or
Action Fraud. Due to the complexities and subtleties of such attacks, and the increased
movement of crime from the physical to digital world, the Police need to act to address
these knowledge and capability gaps. The police frequently report on falling crime
levels across the UK , yet in reality they simply haven’t been factoring cybercrime in to
these numbers; when they eventually did, crime levels “increased” 107% . Their call to
arms for volunteer cyber security specialists should and probably will go largely
05
2http://www.theguardian.com/uk-news/2015/apr/23/crime-rate-ons-lowest-level-england-wales-police http://www.telegraph.co.uk/news/uknews/crime/11932670/Cyber-crime-fuels-70-jump-in-crime-levels.html
3
2
3
unanswered. Professionals in our industry are already under strain with the day job,
maintaining certifications, attending industry events, and current voluntary gigs. There
are a limited number therefore for whom this would even be possible, let alone
desirable, to o�er their expertise for free.
Of course one of the greater challenges presented to the police around
cybercrime is that it is not a geographically fixed industry, perpetrators will often not be
in the same location as victims. If a British citizen is defrauded online by someone in
Asia, is it a matter for the UK’s law enforcement agencies? If so, how can they investigate
a crime that has occurred outside their jurisdiction? Is one nation more responsible for
handling the crime than the other or should we encourage collaboration. The latter
would seem the most logical yet presents an issue around case management will
quickly arise as there will inevitably be multiple and disparate active relationships to
enable lines of investigation. One further obstacle comes around di�erences in
international laws, (perhaps not relevant to most cases) whereby if a crime committed
in the victim’s location is not illegal in the perpetrators, or even vice versa. Do we
establish an international set of cyber laws and enforcement agency to execute on
them, or do we rely on ad hoc international collaborations?
Government Support
Government has set something of a mandate for the country when it
comes to security, despite misgivings around the Draft Investigatory Powers Bill and its
general disdain for encryption. There was of course the very public exercise of
former-PR man David Cameron taking some of the UK’s top cyber start-ups on
somewhat of a showcase. On top of this Chancellor George Osborne assigned a
significant amount of investment for cyber security, £1.9bn, which would include 1900
new hires across its various agencies. What will this mean at the coalface, assuming you
aren’t going to be directly working for central government that is?
There are a number of challenges to that industry (to be discussed in the
next section), which require government support and investment to overcome. The
measures implemented by Messrs Cameron and Osborne are a step in the right direct
(in the most part), but perhaps typically are diluted versions of the true doctrine change
that is required if we are to overcome skills shortages any time soon.
Privacy Concerns
The issue of user and customer privacy will continue to dominate when
it comes to media coverage of our industry. This is due in part to the Snowden
revelations which opened the eyes of the public to the fact that much of what is done
and said online is recorded by someone somewhere… even if it’s only at a metadata
level. Then of course, in the majority of instances where a breach has occurred, those
impacted most are the customers whose data it is that is ultimately the target of many
malicious attacks. Post-incident many organisations o�er free access to credit
monitoring services, and while this is a decent gesture and a responsible move, the
delays around discovery and disclosure often leaves a window of opportunity for
cybercriminals.
Legislating Incident Disclosure
So then at an organisational level, three of the more impactful changes
we might expect to see are likely to be around legislating for post-incident disclosure (or
perhaps a standardised response process), the cyber insurance market will either go big
or crumble like castles made of sand (there’s still a lack of definition, air of mysticism,
and general immaturity of o�erings), and board-level buy-in and investment in security
will steadily continue to increase.
Law Enforcement & Cyber Crime
Law enforcement will finally start to catch up with the commercial sector,
hopefully. Cybercrimes need to be reported to specialists, not local constabularies or
Action Fraud. Due to the complexities and subtleties of such attacks, and the increased
movement of crime from the physical to digital world, the Police need to act to address
these knowledge and capability gaps. The police frequently report on falling crime
levels across the UK , yet in reality they simply haven’t been factoring cybercrime in to
these numbers; when they eventually did, crime levels “increased” 107% . Their call to
arms for volunteer cyber security specialists should and probably will go largely
unanswered. Professionals in our industry are already under strain with the day job,
maintaining certifications, attending industry events, and current voluntary gigs. There
are a limited number therefore for whom this would even be possible, let alone
desirable, to o�er their expertise for free.
Of course one of the greater challenges presented to the police around
cybercrime is that it is not a geographically fixed industry, perpetrators will often not be
in the same location as victims. If a British citizen is defrauded online by someone in
Asia, is it a matter for the UK’s law enforcement agencies? If so, how can they investigate
a crime that has occurred outside their jurisdiction? Is one nation more responsible for
handling the crime than the other or should we encourage collaboration. The latter
would seem the most logical yet presents an issue around case management will
quickly arise as there will inevitably be multiple and disparate active relationships to
enable lines of investigation. One further obstacle comes around di�erences in
international laws, (perhaps not relevant to most cases) whereby if a crime committed
in the victim’s location is not illegal in the perpetrators, or even vice versa. Do we
establish an international set of cyber laws and enforcement agency to execute on
them, or do we rely on ad hoc international collaborations?
Government Support
Government has set something of a mandate for the country when it
comes to security, despite misgivings around the Draft Investigatory Powers Bill and its
general disdain for encryption. There was of course the very public exercise of
former-PR man David Cameron taking some of the UK’s top cyber start-ups on
somewhat of a showcase. On top of this Chancellor George Osborne assigned a
significant amount of investment for cyber security, £1.9bn, which would include 1900
new hires across its various agencies. What will this mean at the coalface, assuming you
aren’t going to be directly working for central government that is?
There are a number of challenges to that industry (to be discussed in the
next section), which require government support and investment to overcome. The
measures implemented by Messrs Cameron and Osborne are a step in the right direct
(in the most part), but perhaps typically are diluted versions of the true doctrine change
that is required if we are to overcome skills shortages any time soon.
Salary Index 2016
06
General Industry Challenges
Skills Shortage
This won’t come as a surprise to those of you who read the trade press or
are connected to a recruiter on LinkedIn, there is a skills shortage in our industry. A
number of figures have been banded around in the press but (isc)2 in their Global
Information Security Workforce Study are forecasting global shortages of over one
million professionals in the very near future . It’s probably my job to reinforce this point,
for it is certainly valid, but let’s not concern ourselves with sensationalism.
Regardless of the exact number, the point is that there is a significant gap
between what is required to secure industry and where we are currently at. We must
simply acknowledge that it is there, it is considerable, and things will only get worse if
demand continues to out-strip uptake. In the short-term the limited candidate pool has
led to increased competition to attract new personnel to an organisation, driven up
salaries and day rates, and has meant delays to projects and programmes as appropriate
skills are sought. The e�ects aren’t just insular, almost half of security professionals
believed their organisation had been breached as a result of the skills shortage .
Quite simply, this can’t be allowed to become a long-term issue. It’s
understandable for ours is a market that is experiencing rapid growth whilst still being
relatively immature, but we have to draw on all the disparate backgrounds that security
professionals can come from to overcome the hurdle. Those who are already working
within security are growing wise to the lack of depth in their peer groups, and as such
we have seen a significant shift to contract working among mid and senior manager
levels. This has led to di�culties hiring certain roles, particularly around enterprise and
security solutions architecture, information security managers, and technical-risk
hybrids to provide assurance alongside multiple projects.
Salary Index 2016
07
4https://www.isc2cares.org/uploadedFiles/wwwisc2caresorg/Content/GISWS/FrostSullivan-%28ISC%29%C2%B2-Global-Information-Security-Workforce-Study-2015.pdf http://www.scmagazineuk.com/cyber-security-pros-blame-breaches-on-skills-gap/article/409393/ 5
4
5
Salary Index 2016
08
Salary Auctions
One initial consequence of the skills shortage was an increase not
necessarily in the packages available for roles, but in the o�ers made to candidates. This
was particularly true around application security where there is a further microclimate
of scarcity, resulting in unsustainable bidding wars. So determined was one client to
deter competition around a secure development specialist that they doubled the
candidate’s salary from £45k to £90k (N.B. We would not advise this approach;
incentivise professionals rather than hire mercenaries). It is this mentality that led to CSO
Online claiming software security architects are earning more than CISOs . In isolation
this may be true but broadly speaking most certainly is not; and so it brings us on to
something else we’ve been seeing for some time…
CISO or “CISO”?
What is a CISO? It must surely mean a ‘Head of’ security function who
sits at board level and is considered part of an organisation’s executive management
team. Someone with a clear mandate for security and who is positioned to e�ect the
change required to achieve this. It is practically implausible to operate e�ectively as a
CISO without such an arrangement. Yet there remains within the market some
elements of confusion about what constitutes a CISO. The worst o�ences of these
include “CISOs” within organisations of c.200 employees, who report in to IT,
specifically the CIO (who themselves sit on the board); or then there is the Network
Security Engineer who has spent the entirety of their 5 years in industry working for a
reseller and is now convinced they’re ready to lead a global enterprise security function.
Many of the conversations we have around career aspirations seem to come around to
the position of CISO as the ultimate end goal. This in itself is problematic for several
reasons. There simply do not exist enough CISO roles, or organisations with suitably
sized functions to require one, compared to the level of aspiration in the market. It is
admirable to aim for the top of the food chain, but this demonstrates some naivety
around understandings of what a CISO is – a politician, evangelist, and a PR guru first
and foremost Fundamentally CISOs are not security practitioners, through the very
nature and demands of their role, they are removed from the coal face.
http://www.csoonline.com/article/2953258/it-careers/cybersecurity-job-market-figures-2015-to-2019-indicate-severe-workforce-shortage.html
6
6
This isn’t to take away from the experience or skills required of and acquired by a CISO,
there is a reason some American firms are willing to pay packages of $0.5-1 million after
all . Merely it is a suggestion that if you wish to drive change and build secure functions
at ground level, you are better to specialise somewhat and lead a function within the
security department. A metaphor we can draw around the ‘CISO vs security leader’
career tracks is of Apple founders Steve Wozniak and Jobs. Both technical pioneers who
drove product innovation, yet one would go on to act as a strategist and spokesman,
whereas the other became an evangelist and continued to work on and develop new
products.
Location, Location, Location
One way to minimise the impact of the skills shortage is to ensure that
your business is located within geographies that have su�ciently sized talent pools.
When we think of these, areas such as London, the Thames Valley, Gloucester, the East
Midlands, and Manchester come to mind; these are areas with a good number of
businesses, are well represented through a variety of organisations (vendors, end users,
integrators, and consultancies), have active industry communities, and as such are
mature markets from which to hire information security professionals. Yes, some
organisations have seemed undeterred by the common challenges we see in the
market at present, and will select isolated locales to set up new o�ces or security
operations centres. One client we were engaged with asked us to help them source
some 20+ individuals for a new security operations centre, at first look an exciting
opportunity. However, after briefing by the hiring manager and recruitment team, we
quickly learned of the proposed new SOC’s location, an obstacle su�ciently large as to
render the mandate untenable. In the search for preferential business rates, this
US-based company had selected an area that found only one other SOC within a
100-mile radius, and so in the absence of a full team move from their nearest neighbour,
they had created for themselves insurmountable scarcity (or a small fortune in
relocation payments).
Contractors
One candidate pool that has seen some substantial growth over the last 12 months has
been contractors.
Salary Index 2016
09 http://blogs.wsj.com/cio/2015/01/23/as-cyber-threats-soar-so-do-ciso-salaries/ 7
7
Upon reaching a certain point in one’s security career, the opportunity to exponentially
increase earning potential through contracting becomes apparent. There is a mentality
that many of the services provided by consultancies can be performed by an individual
for a significant cost reduction, and as such we see contractors undercutting
consultancies by 50% or even more. Not only does this present an attractive
commercial proposition through cost saving, but also the consultant delivering the
work is earning substantially more for themselves than if they were on a permanent
payroll.
Contracting is not for everyone, you have to operate and market yourself
as a business, but the benefits can be very appealing; typically o�ering a better work-life
balance, increased earning, greater flexibility, and the opportunity to work on interesting
projects of work.
Bleeding Edge Deployments
For a business, contractors represent an excellent flexible resource,
particularly around implementations or improvement projects. While hiring a contractor
will be substantially more expensive than a permanent full-time employee on a pro rata
basis, it o�ers speed-of-execution and enables the security function to align its sta� to
its current workload. Often end users opt to go-to-market to hire contractors to deliver
their implementation rather than pay for what can be expensive professional services.
This is perfectly logical in most instances, but there have been a number of occasions
recently where an over-reliance on this model has created delays to projects. Some
clients have approached us to provide them with implementation leads and architects
with experience of particular products, so far all reasonable, but the issue comes when
these requests are for bleeding edge products. The chances of hiring a contractor to
deploy a solution when that technology is currently in situ in only a handful of UK-based
organisations is a significant challenge, especially when you consider these would most
likely have been delivered by the vendor or through their partner network. Alongside this
we often find that more than one end user requires such expertise simultaneously. Pilot
projects and proof of concepts will be detailed during the due diligence process
involved in purchasing a solution, consider not only the success and technical validity of
these but also what challenges there may be in terms of finding a professional to deliver
a similar deployment.
Salary Index 2016
10
Market Specific Challenges
Within the vendor space the drive of new solutions was of course
accompanied by increased demand for senior sales leaders and enterprise sales
professionals to bring the technology to market. Acumin have been helping vendors
enter European markets for a number of years now but the space is more competitive
than ever. And it’s not just the West coast of the US that’s driving the innovation, we’re
seeing the emergence of some very exciting UK technology firms. Indeed, Prime
Minister David Cameron took a dozen of the UK’s emerging security vendors to the US
with him as part of the UKTI Cyber Security Trade Mission; historically we would have
considered this to be the other way round.
Acumin’s vendor specialist, Matthew Smith has met and engaged with
some very disruptive security vendors over the last couple of years. Despite this he
believes the UK security technology scene is blooming and o�ers some great long term
incentives to sales leaders;
Typically the UK start-up scene isn’t able to pay the same cash component as
their US counterparts, but therefore o�er greater wealth creation and equity
opportunities instead.
Undoubtedly this opens the door to some very exciting roles within
high growth and well-funded firms, not just for sales professionals but also technical
personnel. Increasingly we are seeing end user security professionals making the jump
on to the other side of the fence, bringing their expertise to bear on solving the
solutions that troubled them most. Bringing a new solution to market is about building
credibility, traditionally through those hard-to-come-by early PoCs; we’re seeing a shift
from FUD and ‘Feel, Felt, Found’ to a model built on the concept of empathy and a
sense of addressing the issues they had themselves once sought to overcome. While
the adage of trying to sell silver bullet solutions can be levelled at some, we must also
remember equally to pour scorn on those who seek to buy them.
Salary Index 2016
11
4
V
“ “
It’s not just the challenge of jumping the first sales hurdle, vendors entering
the market must hire tech-savvy presales and implementation sta�, often a challenge in
bleeding edge technology markets. Of course no one can go it alone and perhaps the
most important aspect of getting a market entry right is about selecting and growing the
right partner network to help position and deliver solutions, and add value with services.
For those looking to live and work at the security technology frontier,
significant due diligence is required before joining a start-up, no matter how compelling
it may be on paper; Matt Smith suggests speaking with technical peers about the
solution, researching comparable products and their USPs, and understanding what the
organisation wants to achieve and where it is in that cycle;
Whilst its fantastic when vendors receive funding, as this is normally used for
expansion, significant/further rounds of funding often mean that the stock is diluted
which will reduce the opportunity for wealth creation.
One of the dominant factors at play in the end user market in 2015 has
been the rise of security as a priority in SMEs. This is not only generally good news but
also represents some very interesting pieces of work. We have seen some great
opportunities for Information/IT Security Managers, particularly with overview of
technical controls alongside security management, to join an organisation and a�ect
real cultural change. Not only have these roles provided increased control and
executive buy-in (generally reporting in to C level with a dotted line to IT), but they also
have elevated packages to represent the increased responsibility and value of the role.
Perhaps conversely to what has gone before then, we find Security Managers within
SMEs now earning more than their enterprise counterparts.
Due to the increased awareness of cyber security risks and cybercrime in the broader
market, we have seen an increase in demand from SMEs either looking to develop
their cyber security capabilities from scratch, or to significantly enhance their existing
capabilities. These opportunities are particularly attractive due to their broad nature
and level of autonomy they a�ord to candidates leading these functions as
compared to roles within larger organisations, which can be narrower in their scope.
Matthew Smith, Principal Consultant
Vendor
Market Specific Challenges
Within the vendor space the drive of new solutions was of course
accompanied by increased demand for senior sales leaders and enterprise sales
professionals to bring the technology to market. Acumin have been helping vendors
enter European markets for a number of years now but the space is more competitive
than ever. And it’s not just the West coast of the US that’s driving the innovation, we’re
seeing the emergence of some very exciting UK technology firms. Indeed, Prime
Minister David Cameron took a dozen of the UK’s emerging security vendors to the US
with him as part of the UKTI Cyber Security Trade Mission; historically we would have
considered this to be the other way round.
Acumin’s vendor specialist, Matthew Smith has met and engaged with
some very disruptive security vendors over the last couple of years. Despite this he
believes the UK security technology scene is blooming and o�ers some great long term
incentives to sales leaders;
Typically the UK start-up scene isn’t able to pay the same cash component as
their US counterparts, but therefore o�er greater wealth creation and equity
opportunities instead.
Undoubtedly this opens the door to some very exciting roles within
high growth and well-funded firms, not just for sales professionals but also technical
personnel. Increasingly we are seeing end user security professionals making the jump
on to the other side of the fence, bringing their expertise to bear on solving the
solutions that troubled them most. Bringing a new solution to market is about building
credibility, traditionally through those hard-to-come-by early PoCs; we’re seeing a shift
from FUD and ‘Feel, Felt, Found’ to a model built on the concept of empathy and a
sense of addressing the issues they had themselves once sought to overcome. While
the adage of trying to sell silver bullet solutions can be levelled at some, we must also
remember equally to pour scorn on those who seek to buy them.
It’s not just the challenge of jumping the first sales hurdle, vendors entering
the market must hire tech-savvy presales and implementation sta�, often a challenge in
bleeding edge technology markets. Of course no one can go it alone and perhaps the
most important aspect of getting a market entry right is about selecting and growing the
right partner network to help position and deliver solutions, and add value with services.
For those looking to live and work at the security technology frontier,
significant due diligence is required before joining a start-up, no matter how compelling
it may be on paper; Matt Smith suggests speaking with technical peers about the
solution, researching comparable products and their USPs, and understanding what the
organisation wants to achieve and where it is in that cycle;
Whilst its fantastic when vendors receive funding, as this is normally used for
expansion, significant/further rounds of funding often mean that the stock is diluted
which will reduce the opportunity for wealth creation.
One of the dominant factors at play in the end user market in 2015 has
been the rise of security as a priority in SMEs. This is not only generally good news but
also represents some very interesting pieces of work. We have seen some great
opportunities for Information/IT Security Managers, particularly with overview of
technical controls alongside security management, to join an organisation and a�ect
real cultural change. Not only have these roles provided increased control and
executive buy-in (generally reporting in to C level with a dotted line to IT), but they also
have elevated packages to represent the increased responsibility and value of the role.
Perhaps conversely to what has gone before then, we find Security Managers within
SMEs now earning more than their enterprise counterparts.
Due to the increased awareness of cyber security risks and cybercrime in the broader
market, we have seen an increase in demand from SMEs either looking to develop
their cyber security capabilities from scratch, or to significantly enhance their existing
capabilities. These opportunities are particularly attractive due to their broad nature
and level of autonomy they a�ord to candidates leading these functions as
compared to roles within larger organisations, which can be narrower in their scope.
Salary Index 2016
12
“ “EU
Matthew Smith, Principal Consultant
“
“
Scott West, Managing Consultant
End User
Salary Index 2016
13
This is reflective of what we have seen broadly across the business landscape;
investment in security, driving real transformation to mature existing functions or
significantly develop greenfield sites. Of course greater awareness is a factor in this, but
so is a desire to move from reactive to more proactive security models, to achieve some
sense of ownership of information risk. There has been a real interest in utilising security
analytics and threat intelligence more e�ectively, creating some really interesting
‘security scientist’ roles around research and analysis. This rapid rise has been met
predictably with a shortage for what is a very niche skillset and traditionally more likely
seen within central government and MoD. Financial services were there first, around a
year or two ago, pillaging the public sector for some of its brightest analysts and
tempting them away with the comparable riches they can o�er.
Intelligence-led cyber security is definitely a hot topic right now, this has led to a
rethinking from organisations as to how they develop their cyber security capabilities
and in turn the backgrounds of people they may not have traditionally looked at in
the past to fulfil these roles.
This pattern of niche roles with limited talent pools is not something that’s going
to go away any time soon; our industry is too immature and the pace of change too
fast. There is a general shortage of security professionals, but within this we find silos of
even greater obscurity that compound the problems experienced by our industry at
large. Likewise, security operations has been an area of significant focus across industry,
We have seen various organisations continue to develop their in-house SOC and
cyber security functions.
One of the primary challenges we have seen end user organisations experience
in recent times, and still fairly broadly in the last 12 months has come round pushing
appropriate salaries through the business to attract applicants. There has been a
long-fought battle in educating recruitment/HR about the nuanced di�erences
between specialist security roles and more generalist technical positions. In some
organisations this has unfortunately not happened and so hiring managers in security
functions are not being enabled to achieve success. Such unnecessary obstacles often
coincide with di�cult locales or specific role requirements, that leave the positions
unfilled for long periods and frustrate all involved. Much of the reason we produce the
salary index is to empower those in such situations to be able to challenge the
restrictions placed upon them through organisational ignorance, it is a tool through
which to a�ect tangible cultural change.
“
“Scott West, Managing Consultant
Scott West, Managing Consultant
“ “
SI&C
Systems Integrators & Consultancies
One e�ect of increased awareness and buy-in at board level is the
increased maturity within the industry. Companies have finally started to accept their
responsibilities for information risk and customer data, have taken ownership of their
function, and invested heavily to develop their capability. While this will have pushed
some new customers towards managed security services, particularly around security
operations, analytics, and threat intelligence; there has also been a move away from this
model by more mature organisations, who have been insourcing such elements of their
security.
Services around security analytics (behavioural and monitoring) and
intelligence have emerged as highly sought o�erings and have really added value to end
user organisations. These aspects of security can be quite resource heavy to operate
and must be performed by deep specialists in what is a fairly limited talent pool. As such
there has been some real material increases in the number of these roles as well as the
packages available for them.
So then there comes a point of maturity where an end user will want
to take ownership of an outsourced service, but conversely they have reached that
juncture through the development that their MSSP has provided.
There has finally been a reassignment of security consultancy practices
to represent greater regional focus. We have moved away from a model of
pan-European teams in to much more geographically focused o�ces and client bases.
This has overcome the main challenges consultancies and systems integrators
experience in attracting the best professionals, o�ering a far better work-life balance
and reducing the travel aspects of roles. There is of course also the added bonus that
keeping people within their local areas as much as possible also reduces consultancy
overheads around travel and accommodation costs.
We are seeing increasing competition for cyber security professionals, particularly
among small- and medium-sized consultancies, largely due to the shortfall of
professionally accredited practitioners and sustained inflation in both contract rates
and permanent salaries. As a result, some companies are starting to de-regionalise
their operations by investing in strategic locations like the South East, North West and
the Midlands rather than UK or Europe as a whole.
Salary Index 2016
14Daniel Beresford, Senior Consultant
“
“
Salary Index 2016
15
A particular issue that has arisen over the last few years when reaching o�er
stage with consultancy recruitment processes, has been the flat structure of salary
bandings. This is of course understandable, it’s di�cult to justify to larger teams and
workforces than your security consultancy arm, that their work is not worth as much as
their colleagues’ at some level. Ultimately though there has been a shift, brought about
in part by the significant commercial opportunity around security, as well as the
di�culty in attracting top level professionals with proven track records of delivering
appropriate programmes of work.
Consultancies have made invaluable contributions to the industry at large as
they are often the most willing to take on inexperienced or entry level consultants, and
bring them through internal and third party training and education. Although there is
some impact in terms of initial utilisation, there is much to be said for saving costs
through hiring at lower level salaries and then investing in the person to develop them
in to a more capable security practitioner. If these organisations can couple this
approach with good levels of sta� retention they are not only able to save costs, but
scale up the size of their security workforce more e�ciently.
Security Recruitment Market
Due diligence
There has been much written on social media in recent months about the
conduct of those in the recruitment industry, particularly those supplying information
security personnel. Much of what’s been said, though negative in nature, is sadly true.
The barriers to entry in recruitment are typically low, requiring at most a
degree of some form, and conversely the pressures on individuals to succeed is high.
The majority of agencies expect completed deals in the first 3 months, for someone
who knows their trade and market this is reasonable, but not so for someone new to the
job. Inevitably then corners are cut by many in not only the training provided to new
starters but also in the processes they are encouraged to follow.
Salary Index 2016
16
One of the biggest o�ences those in recruitment can commit is submitting
an application to a client without first seeking the candidate’s permission, i.e. being
provided the right to represent. This is not just against data privacy laws, it is in direct
violation of the REC’s code of conduct, and it damages the brand of the candidate who
has been potentially submitted against roles or organisations to which they are not
suited, have no interest, or have previously dealt with.
We would hope only to see this behaviour conducted by a few ‘bad apples’,
but from the one-person information security team within a larger generalist agency, to
specialists, it is a far more common occurrence that it should be. Whether you are the
candidate or the client, the recruitment agency is your supplier and as such should be
help up to the same levels of due diligence that any other service provider would be.
Not only do you want to ensure your team and company is represented properly in the
market, but ultimately whoever you decide to hire will be working on your security
systems.
If you aren’t sure who should be engaged as a trusted advisor, canvas your
network, question your peers, and seek recommendations from those who have had
good experiences.
The LinkedIn Sting
Without delving in to unnecessary detail, we saw a concerted social engineering
campaign on LinkedIn in the summer, as phishers posing as security recruiters
(“____Talent Scout”) connected indiscriminately to as many in the industry as possible.
There was clearly something not right about these profiles who mostly all appeared
under the same unknown employer. The photos were borrowed from legitimate
sources and flipped so as to try and avoid reverse image searches, and all of them had
come from jobs with fast food chains or retailers, to suddenly becoming specialist
security recruiters or indeed self-starting recruitment entrepreneurs. This occurred not
too long after a series of social engineering attacks launched via job site Career Builder.
In general, there is much to be said for using LinkedIn to reinforce and validate
genuine real-world connections. Ultimately it comes down to a question of purpose; do
you wish to use the site as a network of trusted peers, or a loosely connected list of
those who probably (or at least claim to) work in your industry?
Salary Index 2016
17
So why target security professionals? Access. If you’re going to try and storm
the gate, you want to know as much as possible not just about those guarding it, but
what tools they might have at their disposal.
This is something we will see far more of over the coming year. Typically, CVs
can hold a lot of semi-sensitive information, this coupled with some carefully selected
social engineering e�orts, allows cybercriminals to start developing a fuller picture.
Consider some of the details the average CV holds and then there is the practice of
over-sharing, we soon start to acquire addresses (including second home), email
addresses, phone numbers, dates of birth, spouse and children’s names (and often
ages), hobbies, schools, National Insurance numbers, and employer’s technology
toolsets. Just like you would in your day job, consider what data needs to be shared;
perhaps even have a minimalistic CV for first contact or job boards, and a more detailed
one for trusted partners and direct applications.
Who Should Screen?
Having a member of the internal recruitment team conduct first stage screening
seems perfectly logical. It is also entirely unnecessary if you’re working with a proper
recruitment consultancy, i.e. one that considers it their job to screen unsuitable
applicants on your behalf. Of course this may be easier said than done, particularly if
having to work through various tiers of PSL suppliers. The problem here though is that
niche applicants being screened by a layperson e�ectively amounts to keyword
matching; for an industry that can’t even agree its own name, semantics are very
important. As such, specialists are able to read beyond the words on the page,
understand the context or comparable terms which may be present. If you have a
strong relationship with your recruiter and have briefed them e�ectively, you should be
able to trust them to present to you pre-screened candidates that is representative of a
short- rather than long-list.
Retaining Sta�
There’s a skills shortage in the market and although you may be concerned
about your team being headhunted in to new roles through some promise of greener
pastures, you must invest in them. The only way to maintain a fully stocked and highly
skilled team is to incentivise and develop those within it. The worst o�ence a security
department can make is to not provide opportunities for ongoing training of its
personnel; it’s not just essential for keeping them abreast of the latest developments in
the industry, but also for ensuring loyalty and retaining their services. Turnover of sta� is
inevitable in the current climate, but the ability to limit that attrition rate is well within the
control of every team leader and department head.
O�ering opportunities to progress internally is of course always desirable,
but not always possible in smaller or limited functions. In such instances it is about
ensuring the individual can see a clear path of personal professional development, and
working closely with them as a mentor to put together a training plan with a clear set of
end goals.
Paint the ‘Big Picture’
The attraction of new sta� to a security team can’t just come down to being
all about the package on o�er. With so many companies hiring across a multitude of
roles at present, it is about ensuring the attractiveness of the overall proposition. One of
the key elements in any decision-making process for candidates around job o�ers is
how well defined the role is. There are some clients who either have such restricted
resources they are unable, or simply feel they don’t need, to put together a job
specification. While there is little merit in generic specifications filled with the same
copied-pasted corporate spiel, if a jobseeker finds themselves in a competitive situation
between propositions, then a clearly outlined mandate can be the most compelling
motivator; it helps the applicant to visualise the daily ins and outs of the role and thus
themselves within it. Too often information security job specs are used as a wishlist for
departmental capability and so depending on which aspects of this the applicant
matches, the role itself is subject to change. While there is merit in defining a role
around an individual and really putting them at the focus of the process, an ill-defined
opening suggests a bit-part role or an immature function.
Company culture is important but also remember how niche and close-knit
our industry can be. As such the security department should be sold to the candidate as
its own brand under the umbrella of the organisation at large. Other useful information
to provide will come around levels of management buy-in and investment in the
function, as well as outlining the broad roadmap for the next few years. Ideally a
candidate should not just have a feel for what week one in the role might look like, but
also some sense of what day 101 might be.
So why target security professionals? Access. If you’re going to try and storm
the gate, you want to know as much as possible not just about those guarding it, but
what tools they might have at their disposal.
This is something we will see far more of over the coming year. Typically, CVs
can hold a lot of semi-sensitive information, this coupled with some carefully selected
social engineering e�orts, allows cybercriminals to start developing a fuller picture.
Consider some of the details the average CV holds and then there is the practice of
over-sharing, we soon start to acquire addresses (including second home), email
addresses, phone numbers, dates of birth, spouse and children’s names (and often
ages), hobbies, schools, National Insurance numbers, and employer’s technology
toolsets. Just like you would in your day job, consider what data needs to be shared;
perhaps even have a minimalistic CV for first contact or job boards, and a more detailed
one for trusted partners and direct applications.
Who Should Screen?
Having a member of the internal recruitment team conduct first stage screening
seems perfectly logical. It is also entirely unnecessary if you’re working with a proper
recruitment consultancy, i.e. one that considers it their job to screen unsuitable
applicants on your behalf. Of course this may be easier said than done, particularly if
having to work through various tiers of PSL suppliers. The problem here though is that
niche applicants being screened by a layperson e�ectively amounts to keyword
matching; for an industry that can’t even agree its own name, semantics are very
important. As such, specialists are able to read beyond the words on the page,
understand the context or comparable terms which may be present. If you have a
strong relationship with your recruiter and have briefed them e�ectively, you should be
able to trust them to present to you pre-screened candidates that is representative of a
short- rather than long-list.
Retaining Sta�
There’s a skills shortage in the market and although you may be concerned
about your team being headhunted in to new roles through some promise of greener
pastures, you must invest in them. The only way to maintain a fully stocked and highly
skilled team is to incentivise and develop those within it. The worst o�ence a security
department can make is to not provide opportunities for ongoing training of its
Salary Index 2016
18
personnel; it’s not just essential for keeping them abreast of the latest developments in
the industry, but also for ensuring loyalty and retaining their services. Turnover of sta� is
inevitable in the current climate, but the ability to limit that attrition rate is well within the
control of every team leader and department head.
O�ering opportunities to progress internally is of course always desirable,
but not always possible in smaller or limited functions. In such instances it is about
ensuring the individual can see a clear path of personal professional development, and
working closely with them as a mentor to put together a training plan with a clear set of
end goals.
Paint the ‘Big Picture’
The attraction of new sta� to a security team can’t just come down to being
all about the package on o�er. With so many companies hiring across a multitude of
roles at present, it is about ensuring the attractiveness of the overall proposition. One of
the key elements in any decision-making process for candidates around job o�ers is
how well defined the role is. There are some clients who either have such restricted
resources they are unable, or simply feel they don’t need, to put together a job
specification. While there is little merit in generic specifications filled with the same
copied-pasted corporate spiel, if a jobseeker finds themselves in a competitive situation
between propositions, then a clearly outlined mandate can be the most compelling
motivator; it helps the applicant to visualise the daily ins and outs of the role and thus
themselves within it. Too often information security job specs are used as a wishlist for
departmental capability and so depending on which aspects of this the applicant
matches, the role itself is subject to change. While there is merit in defining a role
around an individual and really putting them at the focus of the process, an ill-defined
opening suggests a bit-part role or an immature function.
Company culture is important but also remember how niche and close-knit
our industry can be. As such the security department should be sold to the candidate as
its own brand under the umbrella of the organisation at large. Other useful information
to provide will come around levels of management buy-in and investment in the
function, as well as outlining the broad roadmap for the next few years. Ideally a
candidate should not just have a feel for what week one in the role might look like, but
also some sense of what day 101 might be.
Salary Index 2016
19
Conclusions
In a market driven by scarcity, a proactive and measured approach should
be taken to recruitment. This extends to all facets of the process as ultimately it should
be seen as a sales cycle. From the moment of inception and definition of the role and
job specification, it is important to understand how this will be viewed by potential
applicants and what can be done to ensure the best and most suitable talent is engaged
by the opportunity.
Ultimately, you want to be able to decide from the most suitable candidate
pool and so any obstacles which may deter those applicants from reaching the final
stages of the process should be removed. The challenge of hiring information security
professionals in the current market is already substantial enough, without organisations
creating additional obstacles for themselves which may put them at a competitive
disadvantage.
Once an employee has joined the team, the process of engagement and
career development should never stop. The industry moves at too fast a pace for
education not to be an ongoing process. Failing to incentivise, engage with, and invest
in your security team will see them attracted to organisations which will.
For those working in the industry, it’s certainly a positive time from a financial
perspective, as we have seen incremental increases across all areas, and some more
substantial ones around particularly niche skills. That’s not all though, given the pace of
change there are some great opportunities for professionals to deepen their skills and
knowledge, and really be at the fore in driving their own career forwards. Understand
what your career end game might look like, and then work with peers and mentors to
define the steps that will take you on that path. This should always be incremental,
looking at stages in your development and ascertaining where you would like to be one,
five, and ten years’ time. Understand you own strengths, where the market might be
going, and remember not everyone can or should aspire to be a CISO.
Salary Index 2016
Risk Managment
Regulatory
Intelligence
Technical Security
Detection/Investigation
Sales Engineering
Sales & Marketing
Executive Management
21
22
23
24
25
26
27
28
salary/£1k
SI
EUcontractday rate
Vvendor
end user
systems integrator
£46-£62k
Contributes towards and implements information security and risk management systems, including standards, policies, procedures, and controls guidelines.
Information Security O�cer
£70-£90k
Coordinates project teams, manages budget, and allocates resources across all security initiatives and any projects throughout the business where security is a concern.
Security Project Management
£55-£85k
A broad, business-facing role with internal stakeholder engagement. Conducts assessments around security and risk to identify gaps and makes recommendations for remediation.
£42-£66k
Focused around the operational use of information and/or technical security controls that support the execution of the ISMS.
Security Analyst
£65-£85k
Within a small organisation often the leader for security, setting strategy and implementing it. As part of an enterprise team, owns the ISMS and often security risk register.
Information Security & Risk Manager
SI
EU
SI
EU
EU
EU
SI
EU
Ris
k M
anag
men
t
£325-£400/day
£500-£650/day
£500-£625/day
£350-£500/day
£500-£700/day
£50-£65k
Separated as a role in organisations with large user bases only. Responsible for designing and rolling out a security education/user awareness programme and materials.
Awareness Manager
EU£325-£550/day
21
Security & Risk Consultant
£46-£63k
Typically focused around conducting audits and gap analysis to ensure the as-is state aligns with frameworks, standards, policies, and procedures.
Accreditor/Auditor
£60-£78k
Responsible for ensuring the ongoing compliance and e�ectiveness of the business in regards to information security and risk management.
Governance & Compliance Manager
£60-£82k
Provides consultancy to internal projects and stakeholders across the business to identity, mitigate, and accept information security risks, and embed security controls as appropriate.
Security & Policy Assurance
£55-£78k
Accredited by the Payments Security Council to assess and advise an organisation on the e�ectiveness of their handling of credit card data against 12 key control requirements.
PCI-QSA
SI
EU
EU
EU
Reg
ula
tory £450-
£510/day
£500-£625/day
£450-£625/day
SI
£60-£72k
Conducts audits of an ISMS against the requirements for compliance or certification towards ISO 27001. Coverage will include risk assessments, business continuity, and e�ectiveness of continuous improvement plans.
ISO27001 Lead Auditor
SI
EU£420-£575/day
£55-£70
Ensures compliance to data protection and data privacy regulations.
Data Protection Manager
EU£420-£520/day
22
£60-£90k
SC or DV cleared individual who assesses public sector bodies against the requirements of government accreditations. Work can range from RMADS to ISMS to high level security architecture.
CLAS Advisor/CESG Certified Professional
SI
EU£400-£650/day
£35-£80k
Conducts ethical hacking against an organisation in order to identify weaknesses in network security infrastructure and will often put forward recommendations for improvement.
Infrastructure Penetration Tester
£40-£85k
Performs ethical hacks against applications and associated architecture (e.g. web app servers) to identify gaps in security measures. Also concerned with secure coding practices.
Application Penetration Tester
SI
EU
EU
Inte
llig
ence £400-
£650/day
£450-£700/day
V
SI
£50-£65k
Security-cleared and certified hands-on penetration and vulnerability tester within a CHECK Scheme organisation.
CHECK Team Member
£65-£82k
Senior-level penetration tester who will act as a manager and mentor of CHECK Team Members. Employment of a CTM is essential to maintain CHECK Scheme Green Light status.
CHECK Team Leader
SI
SI
£47-£80k
Sits within a SOC focusing on monitoring systems for intrusion detection and prevention; will often act as the first line of incident response/escalation.
Security Operations Analyst
SI
EU£325-£800/day
23
£50-£75k
Expert incident handler who will manage the technical response to a security breach. Some input in to intrusion response procedures.
Incident Response Analyst
£75-£110k
Oversight of a technical intrusion monitoring and response team. Technical background with some risk/assurance oversight and will input in to strategy and solutions, as well as mentoring colleagues within security operations.
SOC / Security Operations Manager
SI
EU
EU
Tech
nic
al
Sec
uri
ty
£425-£550/day
SI
£65-£95k
Technical and analytical management role responsible for overseeing the company’s threat research and intelligence, inputting in to service design, and ensuring timely vulnerability detection and mitigation.
Threat & Vulnerability Manager
SI
EU£450-£625/day
£65-£90k
Close analysis of data generated by analytics technology such as SIEM and IDS solutions. Will apply multiple principles such as packet capture, behavioural analysis, and threat research to identify trends and technical risks.
Security Analytics / Data Scientist
£30-£45k
Broad role o�ering operational support to the security function performing duties like user access management, change requests, and patching.
Security Administrator
SI
EU
EU£230-£350/day
SI
£55-£82k
Some involvement in developing technical standards and solution, with the focus of the role being to implement the technical controls required to enforce the ISMS.
Security Engineer
SI
EU£400-£550/day
V
24
£75-£115k
Technical role with something of a management overview, will focus predominantly on High Level Design looking at the workflow and broad controls. Will translate security policy into technical specifications.
Security Architect
£75-£110k
Senior yet hands-on role which encompasses developing technical solutions, identifying security controls, and creating design documentation. Will help embed security in to projects throughout the business.
Security Solutions Architect
SI
EU
EU
Det
ecti
on
/In
vest
igat
ion
£500-£750/day
SI
£85-£125k
Proven track record of developing security architectures and acting as technical design authority across enterprise-scale infrastructures. Ability to understand deep technical topics from a top-down and management perspective.
Enterprise Security Architect
SI
EU£550-£800/day
£65-£125k
Responsible for architecting security controls around all aspects of the application environment, from secure development, server stacks, and web app firewalls.
Application Security Specialist
£60-£75k
Some overlap with forensics professionals but more likely to take ownership of the investigation and evidence collection. Concerned with the extent and cost of the breach as opposed to the who and how.
Security Investigator
SI
EU
EU£500-£650/day
SI
£500-£725/day
V
£450-£625/day
V
£38-£65k
Technical role focused on identifying exactly what has occurred during a breach. This will include identifying the point of entry, any vulnerabilities, and the potential identity of the attacker.
Digital Forensics
SI
EU£350-£625/day
25
£75-£105k
Supports the sales function through the delivery of technical presentations, responses to bid/tenders, and developing proof of concept installations. Works closely between the client, and product management and support teams. OTE shown (typically 80:20 split).
Pre-Sales Consultant / Sales Engineer
£105-£140k
Supports the sales function through the delivery of technical presentations, responses to bid/tenders, and developing proof of concept installations. Works closely between the client, and product management and support teams. OTE shown (typically 80:20 split).
Senior Pre-Sales Consultant/Sales Engineer
SI
Sal
es E
ng
inee
rin
g
SI
£65-£95k
Review of technologies to input in to their ongoing development as a stand-alone products and as part of broader solutions. Works closely with sales and marketing, responsible for channel communications, and acts as an escalation on large-scale deployments.
Product Manager
SI
£95-£120k
Responsible for architecting security controls around all aspects of the application environment, from secure development, server stacks, and web app firewalls.
Product Director
£75-£150k
A champion for all things security, driving cultural improvement. The face of an organisation’s security posture, focused on best practice above all else.
Security Evangelist
SI
SI
V
V
V
V
V
26
£110-£150
Responsible for winning new clients within the SME market. OTE shown.
New Business Sales – SME
SI
£140-£200k
Direct sales role focused around mid-corporate and enterprise level organisations. OTE shown.
New Business Sales – Enterprise
£120-£170k
Generate leads and prospects, support the production of collateral and marketing literature, and input into product/service development. OTE shown.
Business Development Manager
SISal
es &
Mar
ket
ing
SI
£150-£200k
Responsible for working closely with several large existing high-value customers to deliver a consultative and focused client experience. OTE shown.
Major Account Manager
SI
£120-£190k
Selecting, recruiting, managing, and supporting a partner network consisting of VARs, systems integrators, and MSSPs. OTE shown.
Channel & Alliance Sales
£35-£55k
Responsible for the operational execution of the market strategy through the use of digital and print media, events, and enabling the sales function.
Marketing Executive
SI
SI
V
V
V
V
V
V
27
£55-£80
Will work closely with senior sales colleagues to set regional direct and channel marketing strategies, and lead implementation activities.
Marketing Manager
SI
£125-£200k
Responsible for overseeing process, compliance, corporate governance, international operations, and support divisions for the entirety of the business.
Operations Director / General Manager
£100-£175k
A broad-reaching senior role which has operational management oversight as well as overall commercial P & L responsibility. Base only shown.
Regional Lead
SI
Exe
cuti
ve M
anag
emen
t
SI
£220-£275k
Commercial business leader with management responsibility across sales, marketing, and operations. Base salary shown. OTE shown.
Sales Director / EVP
SI
£250-£350k
Regional business lead with responsibility for strategy and execution of sales, marketing, and operations. Will have some input in to product / service development. OTE shown.
VP EMEA
£120-£160k
Develops international marketing strategies whilst overseeing the marketing activities across the organisation.
Marketing Director / CMO
SI
SI
V
V
V
V
V
V
28
£130-£210k
Board-level technical role concerned with the ongoing development of soft- and hardware based products, services, and solutions. Will be familiar with aspects of IP law.
Chief Technology O�cer
SI
£80-£125k
Overarching responsibility for all information security and risk concerns in a mid-level corporate.
Security Director / Head of Information Security
£125-£400k
Global leader for information security and risk. Board-level role.
CISO
SI
SI
V
EU
EU
EU£800-£1000/day
Information Security Salary Index 2016
Contactacumin.co.uk
T +44 (0)203 119 3333 E info@acumin.co.uk
Octavia House50 Banner Street
LondonEC1Y 8ST
Recommended