Not too long ago, there was a one-size-fits-all assumption about cybersecurity jobs. The security professional was hired to manage security systems and read logs — maybe handle audits and ensure industry compliance.

Now, the job landscape for cybersecurity professionals is becoming more specialized, and even those specialized areas break down into even more specific responsibilities. Careers in cybersecurity require particular sets of skills, and they are in high demand. How do cybersecurity salaries match demand and experience?

Entry-Level Expectations

Entry-level cybersecurity jobs are, unsurprisingly, at the low end of the cybersecurity salary scale. According to PayScale, the median salary for an entry-level information security analyst with cybersecurity skills is just shy of $60,000.

These jobs tend to fall into Cybersecurity-101-type positions, where the new security analyst is asked to cover a broad range of cybersecurity-related tasks, including the implementation of security best practices, monitoring logs and mitigating data breaches. But they must also have strong IT skills and be adept with the newest technologies.

Reaching the Top — The CISO Salary

The CISO has a complicated role.

“CISOs have to balance cyber risks versus business risks,” said Nate Jennings, senior director of product management, enterprise endpoint with McAfee, in a conversation at MPower 2019. It is the CISO who is tasked with ensuring that everyone in the organization understands the risks in their environment, and those risks will vary depending on the industry vertical of the organization and departmental roles.

As a CISO works to keep their organization safe from cyber threats and remain on top of the organization’s particular technologies, they also have to ensure that cybersecurity isn’t disrupting business flow. The career path requires extensive technical and management experience, and that’s why people in this position can command more than $200,000 a year.

Your Job Title Can Be Important

In a small company, you may have a single cybersecurity analyst who handles all of the security tasks, but in a larger tech or government organization, there tends to be more job specialization. For example, job titles that are becoming more common include security systems administrator, security software developer, compliance analyst and cloud security architect. Among the highest paying, non-CISO jobs are application security engineer, network security analyst and information systems security engineer — all with cybersecurity salaries that start in six figures.

When it comes to getting paid, however, the actual specialization may be less important than the job title. Nate Swanner did some research on cybersecurity salaries for Dice, isolating three job titles (cybersecurity, cybersecurity engineer and cybersecurity analyst) from otherwise equalizing qualifications (all based in San Francisco, all for professionals with five years of experience). While all these jobs are respectable, he wrote, “[i]f you want a decent cybersecurity salary, presenting yourself as an ‘engineer’ is your best bet: It’s a title that tends to pay on the higher end of the tech pro salary spectrum.”

Cyber Skills that Command Higher Salaries

Steve Povolny, head of Advanced Threat Research at McAfee, regularly hires cybersecurity professionals for his team. When he is looking to bring in someone new, he looks for three specific skill sets:

• Practical software development
• IT networking skills
• The ability to take code for exploit development

“These are the types of skills that command a good salary,” he said. There is also a fourth qualification he likes to see, data scientist, but he thinks we’re still several years away from that being included as a critical qualification for cybersecurity pros.

Povolny agreed that the shift toward more specialization will allow professionals to command higher cybersecurity salaries, but he cautions against creating conditions where duties become too specialized. Having too narrow of a focus with your skills could actually hurt a professional who is looking to move into new opportunities or receive a promotion. Instead, Povolny recommended that cybersecurity professionals take a broad approach that allows for growth in specific areas.

“You want smart people who can adapt to change,” he said.

A lot of employers put value on certifications, but Povolny isn’t one of them. If everything is equal between candidates, yes, having a certification might tip the scales, but on the whole, certifications may not factor into salary or hiring.

Common Pain Points in Cybersecurity Careers

The jobs are there for those who want a career in cybersecurity. ISACA’s “State of Cybersecurity 2019” found that 58 percent of organizations struggle to fill their cybersecurity vacancies, and other studies predict that more than 3 million jobs will be left unfilled in two years. Colleges are adding cybersecurity majors with more specific areas of study, and organizations are more willing than ever to think outside the box when it comes to training internal candidates.

So why are these jobs going unfilled? In part, it’s because technology is moving so fast that it’s difficult to keep up with the threat landscape. As Chris Young, CEO of McAfee, noted in MPower’s keynote address, we’re in a never-ending race to secure an attack surface that is growing at an unprecedented rate. At the same time, adversaries are stepping up the pace of their cyberattacks. By the time solutions are available to address a technology’s security problems, the technology may have progressed to a new iteration.

Then there is staff burnout. Cybersecurity professionals are under tremendous pressure to stay a step ahead of the bad guys, and this puts them on call 24/7. Often, there is literally no one else who can mitigate the problem, and it must be solved as quickly as possible. Many cybersecurity professionals are filling the jobs of two, three or four other people. If there is a serious data breach, it is the CISO who loses their job, and often the rest of the security team takes the brunt of the blame.

The stress and mental fatigue, lack of support due to the skills shortage, need to monitor third parties connected to the network or shadow IT, increase in endpoints to protect, and non-stop advancements in technology are pushing cybersecurity professionals to the point where even the best salaries may not be enough to keep them in the job.

Fortunately, one advantage of this developing field is that there are so many different paths to take, and emerging technologies like artificial intelligence (AI) and machine learning will offer even more opportunities. Even the newest cyber professional can make a good income if they have a strong tech background.

Will high cybersecurity salaries follow careers as employers move to address their security concerns, or will more value be given to those with high levels of security experience — people who can add, for example, security to the front end of application design?

It’s not easy to know exactly which cybersecurity skills will be most prized as the threat landscape continues to shift, but cybersecurity will likely remain a lucrative career for those willing to pursue it.