That’s definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purposes, and tend to have less negotiating leverage than high level SDEs who build and ship products, except maybe some very rare exceptions. But most companies also don’t have their security engineers actually write shipping code.
I think this article, like every security related article from bloomberg, is pretty much BS.
Also, they use the example of CISO at a large company. CISOs aren’t actually security experts in the vast majority of companies. They’re usually business people or outright frauds, disappointingly. The people who hire and interview them have no way to validate them.
The article makes a case for why CISOs are worth a lot, justifying the cost of a breach. The problem is that CISOs have virtually no impact on whether or not you get breached, and they usually bear no responsibility for it. It doesn’t matter who you pay how much - it isn’t going to affect the outcome much. Alex Stamos is one of the few that actually has any background in security at all, and look what good that did Yahoo and Facebook. Not much. The other problem is CISOs rarely get any actual authority over product, and when they try to flex, they just get pushed out. The ones who survive are simply master politicians who manage their messaging and their image.
The real reason for this article, I suspect, which appears to be primarily sourced from a security recruiting firm, is that they take a cut of every position they fill. It’s very much in their best interest to pump up the value to justify their fees.
Most security money is very poorly spent. I think part of the problem is that hackers are usually bad managers, and tend to be less interested in playing corporate politics. So the manager jobs go to someone else, who has to make decisions they don’t understand. The higher up you go, the more this gets amplified. For every breach you hear about, that company likely has a few competent security folks saying, “see, I told you...”