Going clear?  Compensation transparency in cybersecurity

‍

The Debate

The topic of compensation transparency is hotly debated.

On the pro side, the argument is that people currently at the company, who may not be making the prevailing market wage, can see what somebody new coming in would make, and then negotiate salary from there. I’m sure we’ve all seen many instances where people who haven’t moved jobs as much can end up earning less than their full potential because those ‘leap moments’ from a compensation perspective haven’t happened, and their employers are perfectly fine underpaying relative to market if they feel flight risk is low.

On the ‘con’ side of the debate, many employers will argue that they will be much more cautious with setting new wage rates because a change in that number now potentially means a retroactive change across the workforce. They may also be less willing to pay up for extraordinary talent. So this can have an effect of depressing wages overall.

There have now been a number of academic studies on this topic, and most are finding that this does meaningfully contribute to reducing the gender gap, but that it also comes with the cost of fewer job opportunities (companies avoid posting to avoid for that area to avoid having to be transparent), and at a cost in wage growth overall (~2% impact on average).

Regardless of your stance on the topic, you should understand what this can mean for you.

While I haven’t seen any studies that specifically look at the impact of these laws on cybersecurity jobs, we have done some research and can share a few insights that are representative of what we expect to see as this practice becomes more prevalent.

What's actually happening

We dug specifically into mid-level cybersecurity jobs posted for NYC, and here’s what we found:

• 37% of jobs listed no compensation range (in violation of the law)
• The average salary was $151K
• The average posted salary range was +/- 20%
• Only 40% of companies posted a comp range that was +/- 15%, which we view as a sign of good faith.  You can imagine that one way of getting out of accountability here is posting a large range, and most companies appear to be doing exactly that. The most egregious example was a range between $136K-$350K, posted by a large bank.

Here’s a chart of salaries by years of experience- the bounds of the plots represent the ranges, and the box the 25-75% percentile. This should be a relatively good representation of salaries overall, less a ~10-15% cost of living premium for NYC.

Resources and negotiation tactics

So if you don’t live in New York or Colorado, but you want resources to negotiate your salary, here are a few places you can turn:

• This report from Cynet gives detailed breakdowns and distributions by job type and region (be sure to look at North America only, the general results are skewed downward by including APAC)
• Indeed and Linkedin predict compensation rates.  So find some jobs similar to yours and record what you see.  This is unlikely to be your strongest tool from a negotiation standpoint, but can give you a sense if you are far out of range.
• Even if you aren’t necessarily wanting to move companies, take a handful of recruiter calls and see what the compensation range looks like.  Recruiters will typically reveal this when asked, upfront.
• CyberSN has typical pay ranges for 45 common roles
  

Quick tips for re-negotiating your salary:

• The most leverage you will have is if you have another job offer.  But be careful, going to your current employer with another offer is a high risk tactic.  You really have to be willing to take the other job.  Relatively few employers will have budget to make large wage hikes on the spot, so set your sights appropriately.
• The best time to negotiate a comp increase is in the fall, as budgets for the next year are getting set.
• Do your work and bring data to the conversation.  Finding comparable roles with posted salary ranges for a very similar job is a good tactic.
• Make it clear to your boss that this is important to you.  If you are otherwise happy with the job, frame it up as a means to prevent you from taking recruiter calls and exploring what else is out there.
• Know your leverage.  The more specialized your skills are and the better your reviews are, the more leverage you have.
• Have a specific ask. t will get you further than leaving it up to them (as uncomfortable as that may be).
• If you are anxious about the conversation, practice with a friend.

Overall, we strongly encourage employers to move toward a more transparent disposition.  Cybersecurity is a hot market, and it's a better investment over the long term to consistently pay the prevailing market rate, build a good culture, and a team that enjoys what they do and will want to stick around. If you do this, there is no risk, only upside, to being open about compensation.