Salary · Cybersecurity
CISSP (ISC2) salary: what it pays (2026)
Indicative pay ranges for roles that commonly value CISSP - broken down by role and by market. These are orientation figures, not a salary survey, so use them to compare and plan, then verify for your own city and year.
Indicative ranges for orientation only - not surveyed data, and not financial or career advice.
What CISSP tends to pay
CISSP is one of the highest-paid security credentials. In the US, roles that list it commonly report roughly US$120k-190k, with architect/senior roles higher. Outside the US the absolute figures are lower, but holders consistently report a premium over non-certified peers.
Pay by role (indicative)
| Security Analyst / Engineer | ~$100k-140k |
|---|---|
| Information Security Manager | ~$120k-160k |
| Security Architect | ~$140k-190k |
| GRC / Risk Lead | ~$110k-150k |
| CISO (with experience) | ~$180k-250k+ |
Bands are indicative US figures unless stated. Actual pay depends on experience, employer, city and year.
Other markets (indicative)
| United Kingdom | ~£55k-90k |
|---|---|
| Canada | ~CA$100k-150k |
| Australia | ~AU$120k-170k |
Jobs that often ask for it
- Information Security Manager
- Security Architect
- Security Consultant
- GRC / Risk Analyst
- CISO (with experience)
Weigh the pay against the cost
Salary is only half the picture. Before you commit, check what CISSP actually costs to sit and maintain, and where it can take you over a career.
- See the full fee breakdown in the CISSP cost and overview (exam fee, retake, materials and renewal).
- Estimate your total spend, including a possible retake, with our exam cost calculator.
Where CISSP leads (with a pay ladder)
These career paths show how pay typically climbs stage by stage, and where CISSP fits on the way up:
- How to become a penetration tester with certifications
- How to become a CISO with certifications
- How to become a SOC analyst with certifications
- How to become a cybersecurity analyst with certifications
- How to become a security engineer: build defences, not just watch them