Fazlur Rahman
Quick Answer
CISO salary 2026 by company size: Small (<500 emp) base $150K-$220K, total comp $170K-$280K. Mid-market (500-5,000 emp) base $220K-$320K, total comp $260K-$420K. Enterprise (5,000-50K emp) base $300K-$420K, total comp $400K-$650K. Fortune 500 (50K+ emp) base $400K-$600K+, total comp $600K-$1.5M+. Median Glassdoor $321K; Salary.com $385K. Top 5% earn $3M+ in total comp.
Top-paying cities: San Francisco $400K base / $600K total comp; New York $375K / $575K; Seattle $360K / $580K. Tech and services are highest-paying industries (driven by equity compensation). Average CISO tenure 39 months. CISO pay grew 6.7% in 2025 (IANS Research). Total comp = base + bonus + equity (30-50%) + LTI retention grants. CISOs report to CEO/CIO/Board in 60% of large enterprises.
Last verified: September 17, 2026. Compensation data verified at KORE1, Hitch Partners 2025 CISO Survey, Glassdoor, Salary.com, Cybersecurity Ventures 2026 CISO Report (KORE1, June 2026; Hitch Partners, 2025; IANS/Artico 2025).
- Small (<500 emp): $150K-$220K base.
- Mid-market (500-5K): $220K-$320K base.
- Enterprise (5K-50K): $300K-$420K base.
- Fortune 500: $400K-$600K+ base.
- Median Glassdoor: $321K base.
- Median Salary.com: $385K base.
- Top 5% total comp: $1.5M-$3M+.
- Avg tenure: 39 months.
CISO salary by company size 2026 detailed
CISO salary 2026 by company size in detail:
| Company size | Base salary | Total comp (incl equity) | Equity share |
|---|---|---|---|
| Seed / Series A startup (10-50 emp) | $180K-$240K | $200K-$300K + upside | Real ownership, illiquid |
| Series B-C growth (50-500 emp) | $230K-$300K | $300K-$450K | $50K-$150K equity |
| Mid-market private (500-5K emp) | $250K-$350K | ~$415K (IANS 2025 average) | Varies widely |
| Enterprise (5K-50K emp) | $300K-$420K | $400K-$650K | $100K-$230K equity |
| Fortune 500 / public co (50K+ emp) | $400K-$600K+ | $600K-$1.5M+ | $200K-$500K RSU/LTI |
| Top 1% (FAANG+ unicorn) | $500K-$700K+ | $1.5M-$5M+ | $500K-$2M+ RSU/LTI |
Average CISO tenure is 39 months per the Hitch Partners 2025 CISO Survey of 566 CISOs across the US and Canada. The top 5% earn seven-figure annual compensation packages, with a few even hauling in $5M/year at FAANG-equivalents. CISOs in publicly traded companies typically receive better compensation-related benefits, such as equity, insurance, and signing bonuses (KORE1, June 2026; Hitch Partners, 2025).
CISO salary by city 2026
CISO salary 2026 by metropolitan area:
| City | Base salary | Total comp (median) | Top 10% total comp |
|---|---|---|---|
| San Francisco | $400,000 | $600,000+ | $1.2M+ |
| New York | $375,000 | $575,000 | $1.1M |
| Seattle | $360,000 | $580,000 | $1.0M |
| Washington DC | $350,000 | $525,000 | $950K |
| Boston | $340,000 | $510,000 | $900K |
| Chicago | $310,000 | $475,000 | $850K |
| Atlanta | $300,000 | $445,000 | $750K |
| Austin | $300,000 | $450,000 | $800K |
| Los Angeles | $290,000 | $435,000 | $700K |
| Denver | $270,000 | $385,000 | $650K |
| Atlanta/Raleigh/Durham | $260,000 | $370,000 | $600K |
| Chicago/Minneapolis/Phoenix | $245,000 | $345,000 | $550K |
| Mid-tier metros (Salt Lake, Indianapolis, Nashville) | $220,000 | $310,000 | $475K |
Geographic premiums for CISO positions reflect (1) tech sector concentration; (2) financial services hub; (3) federal contractor presence; (4) cost-of-living adjustments. San Francisco, NYC, Seattle, and Washington DC are home to large tech companies, highly regulated industries, and are frequent targets for cyberattacks—all of which demand seasoned CISOs with premium pay (Cybersecurity Ventures 2026 Report; CBT Nuggets, 2026).
CISO salary by industry 2026
CISO salary 2026 by industry sector:
| Industry | Median total comp | Premium drivers |
|---|---|---|
| Tech and Software | $400K-$1.2M | Equity, velocity, brand risk |
| Financial Services | $350K-$800K | Regulatory pressure, breach risk |
| Healthcare and Pharma | $300K-$700K | HIPAA, ransomware, EHR risk |
| Retail and E-commerce | $300K-$500K | Customer PII breach risk |
| Defense and Government Contractors | $250K-$500K | CMMC, NIST 800-171, FedRAMP |
| SaaS and Cloud (mid-market) | $250K-$500K | Velocity, scale |
| Manufacturing and OT | $200K-$400K | IT/OT convergence |
| Energy and Utilities | $200K-$450K | Critical infrastructure risk |
| Education (university) | $180K-$320K | FERPA, state/federal compliance |
| Non-profit | $150K-$280K | Limited budget, mission-driven |
CISOs in the technology and services sector earn the highest total compensation on average, largely driven by equity and long-term incentives, according to the Heidrick & Struggles CISO Compensation Survey. The technology sector has the deepest equity pool and the strongest equity appreciation for CISOs (Hitch Partners 2025 Survey).
CISO total compensation structure in 2026
CISO total compensation structure 2026:
| Component | Small co | Mid-market | Enterprise | Fortune 500 |
|---|---|---|---|---|
| Base salary | 60-70% | 55-65% | 45-55% | 35-45% |
| Annual bonus (cash) | 10-15% | 15-20% | 20-25% | 25-30% |
| Long-term incentives (RSU/LTI) | 15-25% | 20-30% | 25-35% | 30-40% |
| Signing bonus | $0-$50K | $50K-$100K | $100K-$250K | $200K-$500K |
| Retention bonus (annual) | $0 | $0-$100K | $100K-$300K | $200K-$500K |
| Total comp multiples vs base | 1.1-1.3x | 1.3-1.5x | 1.5-2.0x | 2.0-3.5x |
At Fortune 500 companies, base salary ($400K) represents 35-45% of total comp ($1M), with the remainder split between bonus ($100K-$250K), equity/RST ($300K-$800K), and retention bonuses ($200K-$500K). Total compensation multiples of 2.0-3.5x base are typical for top tech, financial services, and healthcare CISOs (Hitch Partners 2025; Cybersecurity Ventures 2026).
CISO career path 2026
CISO career path 2026: 6-stage progression typically takes 15-20 years from entry-level security analyst to C-suite security executive:
- Security Analyst (Years 0-3): $74,000-$110,000 base. SOC analyst, junior security analyst, GRC analyst.
- Mid-level Security Engineer (Years 3-5): $115,000-$155,000 base. Security engineer, incident response, vulnerability management.
- Senior Security Engineer / Architect (Years 6-10): $155,000-$212,000 base. Senior engineer, security architect, manager.
- Director of Security (Years 10-15): $175,000-$250,000 base + equity. Director-level role overseeing security teams.
- First-time CISO / VP Security (Years 15+): $220,000-$420,000 base. Reports to CIO or CEO.
- Enterprise CISO at major companies: $400,000-$600,000+ base, $600K-$1.5M+ total comp. Reports to CEO/Board (Cybersecurity Ventures 2026 Report; SentinelOne 2026).
Average progression: $74K analyst at age 25 to $400K+ CISO at age 45-50. The role has the steepest compensation curve in security due to scarcity of qualified executives (SentinelOne 2026 Cybersecurity Salary Statistics).
CISO certifications and qualifications in 2026
CISO certifications and qualifications that maximize compensation in 2026:
- CISSP (Certified Information Systems Security Professional): +$15K-$25K/year salary premium; mandatory for many enterprise CISO roles.
- CISM (Certified Information Security Manager): +$10K-$15K/year; management-track equivalent.
- MBA (top-20): +$50K-$100K/year at enterprise CISO level.
- CEH (Certified Ethical Hacker): +$5K-$10K/year; technical credibility signal.
- CISA / CISM (audit focus): +$5K-$15K/year for governance-track roles.
- CRISC (Certified in Risk and Information Systems Control): +$5K-$10K/year for risk-focused roles.
CISOs with CISSP + CISM + MBA from top-20 business school command 25-40% higher total comp than CISOs with technical-only certifications (Cybersecurity Ventures 2026).
CISO demand outlook 2026
CISO demand in 2026-2030:
- Available CISOs: ~8,000 senior CISOs employed by US companies today; demand for 50,000+ by 2030.
- Job growth: BLS does not specifically project CISO job growth (information security manager generic is 16% by 2032).
- Replacement demand: High attrition (39-month average tenure) creates constant replacement demand.
- New role categories: CISO-as-a-Service (fractional CISO), Virtual CISO (vCISO), Board Cyber Lead (BCSL).
- Regulatory drivers: SEC cyber disclosure rule (2023) requiring CEO/CFO certification of cyber controls; NIST 2.0; CMMC 2.0 for defense contractors; EU NIS2/DORA compliance expanding; SEC RIA cybersecurity disclosure rules.
What enterprise buyers should do next
- For public companies with cyber risk, fund a fractional CISO retainer at $20K-$50K/month vs $400K+ for full-time CISO. This is the fastest path to senior security oversight without full-time hiring.
- For PE-backed companies, fund a CISSP + CISM certification sponsorship ($1,000-$3,000 cost) for high-potential internal security candidates. The promotion to CISO typically unlocks $100K-$200K in total comp savings vs external hire.
- For healthcare and financial services, fund HIPAA/HITRUST and PCI DSS certifications + vCISO partnerships at $50K-$100K/year to address regulatory complexity without full-time CISO.
What to watch next
- CISO pay growth is projected at 6-10% annually through 2027, driven by persistent security talent shortage and SEC cyber disclosure rule enforcement.
- The SEC cyber disclosure rule effective 2024 has expanded CISO personal liability for material cyber events. Expect CISO salaries for public companies to rise 15-25% by 2027 to reflect this risk.
- AI-driven cybersecurity tools (LLM codegen for SOC, automated vulnerability remediation) are reducing the CISO team headcount requirement by 20-40%. Expect CISO total comp to plateau at Fortune 500 as headcount savings offset pay increases.
