Cyber Security Engineer Salary by Experience Level

The salary number you see in a job ad is rarely the number you’ll take home, and it tells you almost nothing about where you’ll be in five years.

TL;DR: A cyber security engineer’s U.S. base salary averages $130,521, per Indeed’s job-posting data, and runs from about $75K at entry level to over $200K at staff and principal level. At large tech companies, stock and bonus push total compensation far higher: Google’s security engineers range from $188K at entry level to $591K at staff level. Annual raises are small for most people, so the real salary progression comes from promotions, specialization, clearance, and changing employers.

This is a companion to our security engineer salary, jobs, and career path guide, which covers what the role involves and how people get into it. This piece goes one level deeper on pay alone: what each experience level earns, how bonus and equity change the math, and which factors move you up the ladder faster than time served.

Jump to a section:

• How much does a cyber security engineer make?
• Why do cyber security engineer salary numbers disagree?
• How does cyber security engineer salary change with experience?
• What does an entry-level cyber security engineer make?
• What is a senior cyber security engineer salary?
• How much of the pay is bonus and equity?
• Can you make $200,000 a year as a cyber security engineer?
• Does a security clearance raise cyber security engineer pay?
• Which industries and cities pay cyber security engineers the most?
• How fast do cyber security engineer salaries grow?
• How do you move up to the next pay band faster?

How much does a cyber security engineer make?

The average U.S. cyber security engineer salary is $130,521 per year in base pay, based on roughly 2,500 job postings Indeed tracked over the past 36 months, with a typical range of $84,164 to $202,412.

That figure comes from Indeed’s cybersecurity engineer salary data, last updated September 20, 2026. The federal benchmark lands in almost the same spot. The U.S. Bureau of Labor Statistics doesn’t track “cyber security engineer” as its own occupation, so the closest official proxy is Information Security Analysts, which the BLS Occupational Outlook Handbook reports at a $129,180 median annual wage as of May 2025.

Two independent sources, built on different methods, landing within about $1,300 of each other is a good sign that the low-$130Ks is the honest center of the market for base pay.

The BLS spread is the more useful number for career planning. The lowest-paid 10% in that occupation earn under $75,090, and the highest-paid 10% earn more than $199,850. Base pay nearly triples from the bottom of the distribution to the top, and the rest of this guide explains what separates the two ends.

Why do cyber security engineer salary numbers disagree?

Each salary source measures a different population. Indeed uses job postings, BLS surveys employers across a broader analyst-heavy occupation, and levels.fyi collects self-reported total compensation skewed toward large tech companies.

If you search this topic, you’ll see averages anywhere from about $100K to well over $250K. None of those numbers is wrong. They measure different things:

The job title matters too. On Indeed, the plain “security engineer” title averages $118,430, and adding “cyber” to the same title raises the average to $130,521. Our security engineer pillar guide explains why the two titles describe the same work. The pay gap reflects which employers use which title, not a difference in the job itself.

The practical rule: compare base to base and total to total. A $130K base offer and a $267K total-comp median aren’t in conflict. They’re two different measurements.

How does cyber security engineer salary change with experience?

Base pay climbs from roughly $75K to $85K at entry level to over $200K at staff level, per Indeed and BLS data. At Google, total compensation climbs from $188K to $591K across the same four levels.

Big-tech column: levels.fyi, Google Security Software Engineer, 84 self-reported submissions, updated September 26, 2026. Years of experience per level are typical ranges, not rules. Google levels are mapped to the closest general experience band.

These are two career tracks, not one ladder with a bonus attached. The market-base column describes most employers: banks, hospitals, government contractors, mid-size software companies, and managed security providers. The big-tech column describes a small number of employers that pay heavily in stock.

The step with the biggest percentage gain in the market column is entry to mid-level, where base pay jumps by 40% or more. That’s the point where you stop working tickets under supervision and start owning a security domain, such as identity, network defense, or detection engineering.

What does an entry-level cyber security engineer make?

Entry-level cyber security engineers usually earn $75,000 to $85,000 in base pay. BLS puts its bottom 10% under $75,090, and Indeed’s reported range for the title starts at $84,164.

A caution about the word “entry-level” in this role. Few people land a security engineer title as their first job. The more common path runs through help desk, systems administration, or a security analyst seat first, which our guide to getting into cybersecurity with no experience walks through step by step.

So an “entry-level” engineer is often someone entering the engineering track with two or three years of IT behind them. If you’re earlier than that, the salary to benchmark against is the IT or analyst role you’ll hold first, not this one.

The outlier is big tech. Google’s entry security engineer level (L3) reports $188K in total compensation: $142K base, $40.3K in stock per year, and $6.2K in bonus, per levels.fyi. Those roles exist, but they’re a small slice of the market and the hiring bar for them is closer to a software engineering interview than a security one.

What is a senior cyber security engineer salary?

A senior cyber security engineer earns about $150,000 in U.S. base pay. Indeed reports a $149,724 average for the senior cyber security engineer title and $156,813 for senior security engineer.

At senior level, scope starts to matter more than years. A senior engineer leads projects, reviews other engineers’ work, and makes architecture calls inside their domain. Promotions past senior are no longer automatic in most organizations. You have to show impact across teams, not deeper work inside your own.

Above senior, the ladder splits. Indeed’s security engineer data shows principal engineers averaging $178,974, lead engineers $179,589, and staff engineers $207,286, per the same Indeed dataset our pillar guide uses. Lead roles mix people management with technical ownership. Staff and principal roles stay individual-contributor but own technical direction across several teams.

How much of the pay is bonus and equity?

At most employers, bonus adds a modest percentage on top of base pay. At large tech companies, stock grants often equal or exceed base salary by the senior and staff levels, which is why total-comp figures run far higher.

The Google breakdown from levels.fyi shows how the mix shifts as you climb:

At the staff level, stock passes base salary. Two things about that stock matter when you compare offers:

• It vests over time. Google stock grants vest over four years, per levels.fyi. Leave early and you walk away from the unvested part.
• It moves with the share price. A “per year” stock number is an estimate at the grant price. The real value you receive rises or falls with the company’s stock.

Across all companies on levels.fyi, the median security software engineer reports $267,280 in total compensation, with the 25th percentile at $190,000 and the 90th at $495,000. Keep the sample in mind: levels.fyi users skew heavily toward large tech employers, so treat those figures as the top of the market, not the middle.

When you negotiate, ask for the full breakdown in writing: base, target bonus percentage, equity amount, vesting schedule, and any sign-on bonus. Comparing two offers on base alone hides most of the difference.

Can you make $200,000 a year as a cyber security engineer? {#200k}

Yes. The top 10% in the closest BLS category earn over $199,850 in base pay, Indeed’s staff-level average is $207,286, and big-tech total compensation passes $200K by the second level.

There are four common routes to that number, and most people who reach it combine two or more:

1. Seniority. Staff and principal base pay crosses $200K at well-paying employers without any equity.
2. Employer type. Large tech companies reach $200K in total compensation at the L4 level, roughly two to five years in.
3. Specialization. Cloud and application security skills overlap heavily with software engineering, and levels.fyi ranks security software engineer as the sixth highest-paid software engineering specialization it tracks.
4. Clearance plus contracting. Cleared engineers at federal contractors command a premium, covered in the next section.

What doesn’t get you there on its own: collecting certifications without the hands-on work to match. Certifications help you get interviews, and our look at why certifications work as senior-level insurance covers where they pay off. The raise itself tracks the scope of what you own.

Does a security clearance raise cyber security engineer pay?

Generally, yes. ClearanceJobs’ 2026 report found cleared compensation climbed an average of 6% year over year, and top-paying cities for the title cluster in Virginia’s federal contracting corridor.

The clearance effect shows up in Indeed’s own location data for the title. Two of the five highest-paying cities, Richmond ($158,432) and McLean ($153,140), are in Virginia, where federal agencies and their contractors concentrate cleared work. Both beat the $130,521 national average by more than $20,000. Several of Indeed’s top-paying employers for the title, including Koniag Government Services at $260,000, are federal contractors.

Per ClearanceJobs’ 2026 Security Clearance Compensation Report, cleared pay rose 6% on average. Compare that with the modest raises most of the broader cybersecurity workforce reported (see raises below).

The catch is access. You generally don’t get to apply for a clearance on your own. An employer sponsors it for a role that requires it, and investigations take months. If the cleared path appeals to you, target contractors that sponsor clearances for engineers and expect a longer hiring timeline.

Which industries and cities pay cyber security engineers the most?

The information sector pays the highest median in BLS data at $138,650. On Indeed, Richmond, New York, and McLean lead the cities for the title, each averaging above $150,000.

Sources: BLS Occupational Outlook Handbook, Information Security Analysts (May 2025) and Indeed, cybersecurity engineer salaries (September 2026).

The industry spread is narrower than most people expect. Only about $13,000 separates the top and fifth industries. The city spread is wider, and the gap between employers is the widest of all. Setting aside one university listing at $450,001 that looks like an outlier, Indeed’s top-paying employers for the title pay $260,000 to $280,800, roughly double the national average.

The takeaway matches what our pillar guide found for the broader security engineer title. Who you work for moves your pay more than where you live or which industry you pick.

How fast do cyber security engineer salaries grow?

Slowly, if you stay put. The 2025 ISC2 Workforce Study found 57% of cybersecurity professionals got a 1% to 9% raise last year, 20% got none, and only 20% got more than 10%.

Those figures come from the 2025 ISC2 Cybersecurity Workforce Study, published December 2025. The same study found 31% of respondents named insufficient pay as a factor hurting their job satisfaction.

Put that next to the experience table above. Base pay rises 60% to 75% between mid-level and staff. At a steady 5% a year, raises alone would take 10 to 12 years to cover that gap. The table shows it happening in roughly six years, which means promotions and job changes do most of the work.

That doesn’t mean you should job-hop every year. It means you should know your market rate, ask for a level review when your scope grows, and be willing to interview elsewhere when your employer’s ladder stalls.

How do you move up to the next pay band faster?

Take on scope before the title, specialize in a high-demand area like cloud security, benchmark your pay against current market data every year, and negotiate total compensation instead of base alone.

A practical sequence:

1. Own a domain early. The entry-to-mid jump happens when you’re the person responsible for something, such as the SIEM pipeline, identity platform, or cloud security posture. Volunteer for it before the promotion.
2. Pick a specialization with pull. Cloud and application security sit closest to software engineering pay. Our upcoming companion guide on network, cloud, and application security engineering will break down each path.
3. Benchmark once a year. Pull the current Indeed and BLS numbers for your title and metro before your review, not after.
4. Negotiate the whole package. Base, bonus, equity, vesting, and sign-on all move independently. An employer that won’t move on base will often move on one of the others.
5. Build a network before you need it. The best-paid roles often fill through referrals, which our piece on why networking beats cold applications covers in detail.

If you’re still deciding whether this career is the right fit before worrying about pay bands, start with our cybersecurity career guide, then come back here once you’ve picked a direction.