[0] https://medium.com/netflix-techblog/message-security-layer-a...
That’s definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purposes, and tend to have less negotiating leverage than high level SDEs who build and ship products, except maybe some very rare exceptions. But most companies also don’t have their security engineers actually write shipping code.
I think this article, like every security related article from bloomberg, is pretty much BS.
Also, they use the example of CISO at a large company. CISOs aren’t actually security experts in the vast majority of companies. They’re usually business people or outright frauds, disappointingly. The people who hire and interview them have no way to validate them.
The article makes a case for why CISOs are worth a lot, justifying the cost of a breach. The problem is that CISOs have virtually no impact on whether or not you get breached, and they usually bear no responsibility for it. It doesn’t matter who you pay how much - it isn’t going to affect the outcome much. Alex Stamos is one of the few that actually has any background in security at all, and look what good that did Yahoo and Facebook. Not much. The other problem is CISOs rarely get any actual authority over product, and when they try to flex, they just get pushed out. The ones who survive are simply master politicians who manage their messaging and their image.
The real reason for this article, I suspect, which appears to be primarily sourced from a security recruiting firm, is that they take a cut of every position they fill. It’s very much in their best interest to pump up the value to justify their fees.
Most security money is very poorly spent. I think part of the problem is that hackers are usually bad managers, and tend to be less interested in playing corporate politics. So the manager jobs go to someone else, who has to make decisions they don’t understand. The higher up you go, the more this gets amplified. For every breach you hear about, that company likely has a few competent security folks saying, “see, I told you...”
The people telling you security talent commands a premium are not lying and they're not wrong.
There is a general instinct people have to push back on "look at these high salaries" data points because, not to put too fine a point on it, they're not good negotiators and get second-tier offers. That includes a lot of people with truly extraordinary talent; negotiating skill and delivery skill are, of course, orthogonal. But even that is changing; all you have to do is keep your ear to the ground to know that the standard SFBA SDE salary is not the market clearing rate for (e.g.) software security.
I have first hand experience at SFBA tech companies, and if you don’t think they are overwhelmingly classifying them the same as SDEs, you’re simply wrong. You haven’t worked inside of one, so that alone is likely going to limit your understanding quite a bit.
This has nothing to do with my own salary either (and I have received an offer from netflix, not that it means anything).
It's fine if we just agree to disagree; I just can't let the claim you made stand without rebuttal.
It’s about as difficult to answer that as it is to answer what the market rate is for SDEs. They vary wildly. Like hundreds of thousands in variation. And even the same role at the same level varies wildly depending on negotiated initial offer and performance bonuses/discretionary equity grants. Facebook in particular gave out $1M in DE to their top performing SDEs, even at lower pay grades.
Also, appsec tends to be distinct from IT security (who tend to be classified as IT/SRE/Ops or similar), and often outside of the CISO/CSO scope, but not always.
Might not be the case everywhere but was certainty the norm in the consulting world.
I work at an SF company and routinely field offers from other companies that I can view on levels.fyi, and my colleagues in eng are open with me about their salaries so I have lots of datapoints to compare to.
To your other comment:
> I seriously question whether you understand how mediocre the mean security engineer actually is, even at top tier companies
This seems equally true for eng.
"security" seems to be a very wide notion. Can you give some highlights of what that specific skillset is and what is your job actually consists of.
I can say that the trend at companies that pay well is that you will be able to pass an eng interview. More and more, it'll basically be "we expect you to be as good as an eng around your level, maybe one level less" and "we also expect you to be an expert at threat modeling", plus whatever is specific to your niche; for me it's detection and response, so I'm expected to understand operating system services, how attackers go about taking over a computer, the traces they leave behind, etc.
I was a CSO at a large technical company and we were successful in separating the role of Security Engineer from regular Engineer with HR.
With regard to corporate politics, you have hit on an interesting aspect of the problem. Why is it that politics should trump the actions taken to prevent breaches?
The CSO/CISOs that I know all have this stress of knowing what the risks are and the difficulty of moving the organization, incrementally, towards a safer posture. Successful ones know how to navigate whatever the culture is and somehow produce a solution.
The underlying causes of breaches really come down to 1. the corporate culture, 2. the technical competence of the organization, top to bottom, and 3. the strength of the security team. If the security team up through the CSO is very good and the culture is not so good (recent breaches will give you names), or the technical competence of the company is low (e.g., putting a breach response site on the internet disconnected from your root domain), then the effectiveness of the CSO is not very good.
There is a fundamental tension between spewing off features to win market share and producing quality, secure software.
A wise company will find a CSO who can help move the culture and influence the technical practices. Those folks are very rare, and as such will have very high pay.
We talked pretty openly about salary. Also, managers, or anyone involved in setting pay, had a spreadsheet of all the engineers salaries for level setting purposes.