It's great to be a chief security officer in 2004.
Chief information security officers saw the highest average pay raise of any job title at 6%, according to Computerworld's 18th Annual Salary Survey. They're followed by information security managers and data warehousing managers (who had 5% increases), Web developers, security specialists and quality assurance staff (4%).
"Security [salary increases] have beat average IT salaries for 13 straight quarters," says David Foote, president of Foote Partners LLC. It's a simple case of supply and demand, he explains. CISO positions are relatively new, and the pool of candidates with five years of IT security experience and a combination of hard and soft skills required for the job is small.
"It's hard to find good security people from the outside, and when you do they cost a lot of money," says an IT security strategist at a financial services company. He adds that salaries and bonuses are generally higher for the new IT security employees than for existing ones.
At Booz Allen Hamilton Inc., the IT security team doubled from four people to eight in one year. Stan Kiyota, senior information security manager, expects to add four more employees by December, if the right candidate comes along.
In the Washington area, where IT unemployment is near zero, "people are happy with their jobs right now, and they aren't leaving," Kiyota says. "It's hard to find good staff." He recently interviewed three candidates for the security positions and passed on all three. "We're willing to wait" for the right candidate, he adds.
"IT security is not considered a sexy place to be, and it suffers from an identity problem," Foote says. "There's no history of great managers coming from security."
But that may change soon. The number of universities and secondary schools creating IT security degrees and curriculums has tripled in the past five years, according to Foote. "They're seeing a need [for these positions] stimulated by new government regulations like HIPAA and the Graham-Leach-Bliley [Act]," Foote says.
For IT professionals with the lowest pay raises # directors of e-commerce, Internet architects, database managers, database administrators and technical trainers (1% average increases in 2004) # security may suddenly look attractive.
Collett is a freelance writer in Chicago. Contact her at [email protected].