Company size is among the factors that impact compensation. Size may be measured in terms of revenue or employees.
Those at companies with fewer than 100 employees reported a median compensation of $94,000, just below the figure for the entire population of the survey. Respondents from large companies employing more than 5,000 staff reported a median compensation of $99,000. Nearly half of all respondents in this year’s survey worked for companies in this category.
But in the middle category of medium-sized firms—those with 100 to 5,000 employees—median compensation was $86,000. That’s less than the median at the smallest companies.
A similar dip occurs when the medians are looked at based on revenue, rather than the number of employees. Companies with less than $5 million in gross annual revenue report a median wage of $89,000. With revenues between $5 million and $1 billion, however, the median security compensation is $86,000. The median for those working at companies earning more than $1 billion was $105,000.
This dip has been noted in earlier surveys for both number of employees and revenues. One explanation for this oddity is that the low end is inflated because among small revenue firms are many security consultants who are well compensated; they earned a median $104,000 in 2008, compared to those in security management, who reported a median $95,000.
If consultants are set aside, the compensation from smallest to largest firms no longer dips; there is, instead, a more steady correlation between company size and individual compensation.
Respondents were also asked to indicate their years in the security field and in security management, professional certifications, highest level of education and age.
Of the total, 83 percent had 10 or more years of experience in the security field, with 55 percent reporting more than 10 years in a security management role. There is a clear progression in salaries directly related to experience in the security field, though the incremental increases taper off and salaries plateau at the upper end of the experience range.
Respondents with fewer than 10 years of experience had a median compensation of $81,000. Those with between 10 and 19 years reported a median of $89,000, and those with between 20 and 29 years reported a median $102,000. But for those with 20 years of experience or more than 20 years, the salary stagnates, remaining about the same for respondents with more than 30 years in the security field.
The survey asks separately about years in a security management role. Those reporting fewer than 10 years of experience had a median compensation of $89,000. Those with 10 to 19 years in security management reported a median of $95,000 and the 22 percent of respondents with more than 20 years of experience reported a median $110,000.
Education. Education is closely related to compensation rates in the security profession as elsewhere. Two-thirds of respondents hold an undergraduate degree and nearly half of these also hold a master’s.
The 12 percent of respondents holding associate degrees and degrees from technical schools reported a median compensation of $80,000. Those with some four year college experience reported a median of $88,000. Those with an undergraduate degree were very close to the overall median compensation at $94,000. Security professionals holding a master’s degree reported a substantial jump to a median of $106,000.
Certifications. In addition to educational credentials, security professionals can boost compensation by earning respected certifications. More than half the respondents reported holding a certification, the most common by far being the Certified Protection Professional® (CPP) held by 35 percent of respondents.
The median salary for both CPPs and Professional Certified Investigators® (PCI) was $104,000. Those holding no certification reported a median compensation of $86,000. The median compensation for those holding a Physical Security Professional® (CSP) designation was $100,000.
The 5 percent of respondents with a Certified Fraud Examiner (CFE) designation reported both the highest and fastest-rising compensations, with a median of $123,000 in 2008—12 percent more than in 2007. Certified Information Systems Security Professional (CISSP) is the second highest in terms of compensation, with a $105,000 median in 2008. These certifications had average compensation of $139,000 for CFEs and $122,000 for CISSPs.
Age. Although age is not considered in compensation negotiations, there are clear correlations again this year.
Median compensations have risen fastest among the youngest. While fewer than 5 percent of our sample was between the ages of 20-29, the median salary at this age rose an impressive 22 percent between 2007 and 2008. In comparison, the average rise for those 30 and above was just 6 percent.