Today, cyber crime is a major concern for every type of business or government organization. A series of high-profile breaches has highlighted the apparent ease with which hackers can steal sensitive information — so it’s little surprise that demand for cyber security professionals is rising. In fact, according to a recent analysis of Bureau of Labor Statistics figures from Stanford University, demand is expected to grow by 53% through 2018.
But it’s not easy to fill those roles. A recent survey from computer security conference Black Hat USA found that “nearly 75% of security professionals say they do not have enough staff to defend their organizations against current threats.” Meanwhile, hundreds of thousands of cybersecurity jobs remain unfilled.
The combination of high demand plus low supply usually translates into high salaries for high skill workers — and as the many “best paid” lists online make clear, cyber security can be a lucrative career. However, unless you adjust those salaries for cost of living, those lists can be misleading. How does this affect cyber security professionals? Let’s take a look at the data.
Which is best for salaries — Washington DC or Salt Lake City?
Cyber security is a highly specialized field with dozens of job titles. For the purposes of this analysis, let’s pick one: “Information security specialist.” This is a role with many responsibilities, including the design, implementation, monitoring and testing of different types of cyber defense.
At first glance, information security specialists in Washington DC seem to be doing pretty well: On average, they make around $114,951 a year. By contrast, their peers in Salt Lake City make $105,889 a year. Therefore, an information security specialist who moves to DC from Salt Lake City is in line for an almost $10,000 pay bump — correct?
Well, not exactly. The price of rent, tax, food, transportation and education all have a big impact on take-home pay, and after factoring in Washington DC’s higher costs of living, the picture gets a little complex.
Consider, for instance, just one of those measures: Rent. In June, the median rent on an apartment in Washington DC was $2,595 a month, eating up 27% of an information security specialist’s monthly salary. In Salt Lake City, however, it was only $1,445 per month, which only takes up 16%.
So where does the security dollar stretch furthest?
US cities ranked for information security specialist salaries
The table below ranks the 15 cities in Indeed’s list of popular tech job search destinations by the “real” value of an information security specialist’s salary. The results are surprising, to say the least. In fact, once the numbers are adjusted for cost-of-living using data from the Bureau of Economic Analysis (BEA), it turns out that the city with the best paid information security specialists is not a glamorous, west coast tech-hub but rather the midwestern city of Minneapolis.
In fact, with an adjusted average salary of $127,757, an information security specialist in Minneapolis makes 7% more in real terms than in closest competitor Seattle. Meanwhile, San Francisco, which places first when the numbers are left unadjusted, drops to third position.
On closer inspection this result may not be so strange, however. After all, Minneapolis is home to the headquarters of retail giant Target, which in 2013 suffered one of the most publicized security breach in recent years. Following this, the firm publicized its hiring of a highly regarded cyber security leader from GM. Perhaps Target’s other post-breach efforts at incentivizing top security talent to work at its headquarters are reflected in this result as other firms in the area will have had to compete.
Strikingly, New York only places ninth — despite its giant finance sector which is highly attractive to cyber criminals, employers there are doing less to incentivize talent than in Salt Lake City, which is home to far fewer banks. Meanwhile, San Jose, the unofficial capital of Silicon Valley performs even less well, coming in tenth.
However, the lowest-paying city on our list is Arlington, VA — home of the Pentagon. Here, an information security specialist’s salary once adjusted is 72% lower than in Minneapolis. Arlington’s low ranking, coupled with Washington DC’s 12th place, makes it clear that government IT security jobs are considerably less lucrative than those in the private sector.
What this means for employers — and job seekers
With demand for cyber security skills outstripping supply, wages are likely to remain high in this discipline for a long time. For job seekers with tech skills, this makes it an attractive career, although they should be aware that it’s not a career you can just walk into. Despite the talent shortage, many employers are looking not only for skills and experience, but also certifications.
As for employers, this analysis demonstrates that finding the right incentives to attract top talent is no simple matter. With ever more salary data available online, cyber security professionals know their worth. Meanwhile, highly mobile tech talent, or tech talent interested in flexible working arrangements, will be looking not only at how much a person with their skills makes in their immediate vicinity but across different metro areas. Thus, performing a cost of living analysis can help you make your jobs more competitive.
To learn more about how location affects the tech job market, download the Indeed Hiring Lab report Beyond the Talent Shortage.