Raising the Bar

Median compensation for security professionals in the United States was $95,000 in 2008—up seven percent from 2007. For the 22 percent reporting directly to the CEO, the median was $105,000 in 2008, up from $100,000 in 2007. These numbers, based on responses to the 2008 ASIS International U.S. Security Salary Survey, are surprising given that the economic downturn has led to stagnating wages in other professions.

As in prior years, performance bonuses were a key element of this year’s compensation growth. Fifty-six percent of all respondents received performance bonuses in 2008, with the median bonus totaling $10,000, up from $8,000 in 2007. Those ranking within the 90th percentile of respondents reported a median performance bonus of $40,000, representing a full 22 percent of their total 2008 compensation.

While more respondents got bonuses, fewer benefited from profit sharing. Just 13 percent of respondents reported receiving profit sharing as part of their overall compensation package, down from 15 percent last year. Of these profits, there was little more to share in 2008 than there was in 2007, with the median rising less than 1 percent from $10,500 to $11,000.

About the same percentage had stock options this year as last, but based on value, they became a more substantial portion of compensation packages this year, ranking just below performance bonuses as part of the total compensation in 2008. For those 16 percent of respondents who received stock options in both 2007 and 2008, the median value of those options rose from $8,000 to $10,000, and the average from $15,000 to $17,000.

Among the factors affecting or correlating to compensation levels are whether you work for government (the public sector) or the private sector, what industry sector your employer is in, the size of the company, your personal qualifications, and the responsibilities of your position.

Public or Private Sector

Among private-sector respondents to the 2008 survey, more than half were employed at privately owned companies, while 25 percent were in publicly held companies. Just 14 percent of this year’s respondents were employed in government or law enforcement agencies, with 7 percent in a federal agency, 3 percent in state government or law enforcement, and 4 percent in municipal or other local government or law enforcement.

The private-sector employees, including publicly held stock companies and privately owned companies, had median compensation of $92,000 in 2008, up from $86,000 in 2007. Average compensation for this sector rose from $95,000 to $106,000.

In 2008, median compensation rose 5 percent for security professionals in the federal government sector to $106,000 in 2008. Those in state government lag far behind in compensation, reporting a median rise of just 4 percent to $83,000 and those in local government reported a median compensation of $86,000, an increase of just 2 percent over 2007. By contrast, median compensation for security professionals employed by publicly owned companies was $104,000 and average compensation was $121,000.

Median v. average. It is instructive to look at the difference between the median compensation—the number that falls at the midpoint between the highest and lowest reported incomes, regardless of how many people fall at one point or another—and the average, which is the sum of all reported compensation divided by the number of participants.

In all of the government sectors—federal, state, and local—the average compensation was relatively close to the median: it came to about $113,000 for federal employees, $90,000 for state, and $80,000 for local in 2008. Essentially, this convergence of the median and the average shows a greater parity between those with the most experience and qualifications and those with the least.

The compensation parity in the government sector is not necessarily bad for security professionals just starting out, as those in the lowest 10th percentile of state government employees earn greater compensation than those in the bottom 10th percentile of their colleagues working in private industry.

In the private sector, the situation is quite different. The gap between the average and the median is appreciable, exceeding $18,000. This shows that with a freer hand to compete for top talent, private industry is paying its most qualified employees substantially more than state governments can offer.

Specifically, the 90th percentile in publicly owned companies pulls down an average compensation of $200,000. The 90th percentile of security directors employed in federal agencies earns $160,000. In state government, that 90th percentile demarcation is at just $112,000.

Industry Sectors

The 13 major industry sectors established by the U.S. Bureau of Labor Statistics were well represented in this year’s survey. Compensation for security professionals continues to vary widely depending on the sector served. The best compensated are in Natural Resources and Mining: though reporting a median rise this year of only 4 percent, they earned a median $120,000 and an average compensation of $136,000.

Both the Transportation and Utilities sector and the Health Services sector reported the highest percentage rise in median compensation of 11 percent. But the increase has to be seen in context. In Health Services, for example, the median income—even with the hefty percentage boost—was the second lowest in this year’s sample at just $85,000. By contrast, the Transportation and Utilities sector, which reported a median compensation just below $97,000, was the fifth most highly compensated sector in the 2008 survey.

The Wholesale and Retail Trade sector was the second most highly compensated, reporting a median rise of 3 percent to $107,000 and a remarkably close average compensation of $108,000. Indeed, this sector featured the flattest compensation curve in the entire survey, but this may be due more to the fact that it had the highest percentage of respondents with the fewest years of experience than to any unique compensation curve for the sector.

The Financial Activities sector, by contrast, had the greatest disparity between median and average compensations despite having the second fastest growing median income, rising seven percent in 2008 to $96,000. The average compensation reported in the Financial Activities sector was $124,000, approximately a third higher than the median.

A notable distinction of the Financial Services sector is a far greater use of performance bonuses as part of overall compensation, with nearly 80 percent of respondents receiving a performance bonus. Though most in this sector report bonus values comparable to their colleagues in other industries, 13 percent reported substantially higher average bonuses.

Twenty-four percent of this year’s respondents were in the Professional Services industries, which includes security services of all types. Median income for that group was $95,000 for 2008, up from $90,000 in 2007. The average compensation of $108,000 indicates that opportunity exists to earn far more than the median.

This sector is dominated by privately held businesses, accounting for fully 74 percent of respondents. Such companies typically have fewer employees, lower gross revenues, and smaller security budgets than corporations. But there are large companies in this sector, and typically these are where the higher compensation rates tend to cluster. 

Twenty-six percent of the companies in this sector had security budgets in excess of  $1 million compared to 39 percent overall. Of the 9 percent in this group who reported security budgets higher than $10 million, they reported security director compensation of more than $130,000 on average in 2008.

A substantial percentage of the smaller firms in this category are security consultancies. While their businesses may be small, this is a well-compensated group.

The median compensation for security consultants in the Professional Services category was $119,000 for 2008, rising 10 percent from the year prior. The 90th percentile earned a median $200,000. As this category does not seem to afford many opportunities for entry-level employment, it also has relatively high compensation rates even at the low end of the spectrum, with the 10th percentile earning an average of $65,000.

Forty-five percent of all respondents in the Professional Services sector report directly to the CEO of their company. This is more than twice as high as the 22 percent rate among  respondents as a whole.

Generally, security directors who report directly to the CEO were among the most highly paid in the survey. In the Professional Services sector, those reporting to the CEO earned a median compensation of $114,000 in 2008.

The Manufacturing sector reported a median 2008 compensation of $92,000, slightly below the overall median and rising slightly slower at just 5 percent over the year prior.

The security professionals in this sector were most often security managers, rather than directors of security or vice presidents, although titles don’t correlate to duties (more on this later). In addition, their departments were more likely to report to the human resources (HR) department—28 percent compared to 8 percent overall. In addition, even when compared to security managers in other sectors who reported directly to HR, those in manufacturing were not paid as well.

In Manufacturing, the median compensation for those reporting to the HR department was $94,000, compared to $106,000 among those from all sectors organized under HR.

Conversely, fewer in Manufacturing reported directly to the CEO—10 percent, compared to 22 percent in all sectors. Yet they were much more highly compensated than those reporting to CEOs in all industries, with a median of $129,000 compared to $105,000.

Company Size

Company size is among the factors that impact compensation. Size may be measured in terms of revenue or employees.

Those at companies with fewer than 100 employees reported a median compensation of $94,000, just below the figure for the entire population of the survey. Respondents from large companies employing more than 5,000 staff reported a median compensation of $99,000. Nearly half of all respondents in this year’s survey worked for companies in this category.

But in the middle category of medium-sized firms—those with 100 to 5,000 employees—median compensation was $86,000. That’s less than the median at the smallest companies.

A similar dip occurs when the medians are looked at based on revenue, rather than the number of employees. Companies with less than $5 million in gross annual revenue report a median wage of $89,000. With revenues between $5 million and $1 billion, however, the median security compensation is $86,000. The median for those working at companies earning more than $1 billion was $105,000.

This dip has been noted in earlier surveys for both number of employees and revenues. One explanation for this oddity is that the low end is inflated because among small revenue firms are many security consultants who are well compensated; they earned a median $104,000 in 2008, compared to those in security management, who reported a median $95,000.

If consultants are set aside, the compensation from smallest to largest firms no longer dips; there is, instead, a more steady correlation between company size and individual compensation.

Individual Qualifications

Respondents were also asked to indicate their years in the security field and in security management, professional certifications, highest level of education and age. 

Of the total, 83 percent had 10 or more years of experience in the security field, with 55 percent reporting more than 10 years in a security management role. There is a clear progression in salaries directly related to experience in the security field, though the incremental increases taper off and salaries plateau at the upper end of the experience range.

Respondents with fewer than 10 years of experience had a median compensation of $81,000. Those with between 10 and 19 years reported a median of $89,000, and those with between 20 and 29 years reported a median $102,000.  But for those with 20 years of experience or more than 20 years, the salary stagnates, remaining about the same for respondents with more than 30 years in the security field.

The survey asks separately about years in a security management role. Those reporting fewer than 10 years of experience had a median compensation of $89,000. Those with 10 to 19 years in security management reported a median of $95,000 and the 22 percent of respondents with more than 20 years of experience reported a median $110,000.

Education. Education is closely related to compensation rates in the security profession as elsewhere. Two-thirds of respondents hold an undergraduate degree and nearly half of these also hold a master’s.

The 12 percent of respondents holding associate degrees and degrees from technical schools reported a median compensation of $80,000. Those with some  four year college experience reported a median of $88,000. Those with an undergraduate degree were very close to the overall median compensation at $94,000.  Security professionals holding a master’s degree reported a substantial jump to a median of $106,000.

Certifications. In addition to educational credentials, security professionals can boost compensation by earning respected certifications. More than half the respondents reported holding a certification, the most common by far being the Certified Protection Professional® (CPP) held by 35 percent of respondents.

The median salary for both CPPs and Professional Certified Investigators® (PCI) was $104,000. Those holding no certification reported a median compensation of $86,000. The median compensation for those holding a Physical Security Professional® (CSP) designation was $100,000.

The 5 percent of respondents with a Certified Fraud Examiner (CFE) designation reported both the highest and fastest-rising compensations, with a median of $123,000 in 2008—12 percent more than in 2007. Certified Information Systems Security Professional (CISSP) is the second highest in terms of compensation, with a $105,000 median in 2008. These certifications had average compensation of $139,000 for CFEs and $122,000 for CISSPs.

Age. Although age is not considered in compensation negotiations, there are clear correlations again this year.

Median compensations have risen fastest among the youngest. While fewer than 5 percent of our sample was between the ages of 20-29, the median salary at this age rose an impressive 22 percent between 2007 and 2008. In comparison, the average rise for those 30 and above was just 6 percent.

Responsibilities

The most reliable predictor of compensation level among security professionals is the job itself. If its responsibilities are high, the compensation will likely be as well. Your rank within the department and the company is one indicator of the level of responsibility you bear. Among the other factors are the size of the budget that the position is responsible for and the number of locations overseen.

Rank. The bucks climb higher where the security buck stops. The 40 percent of respondents who were the top-level security person at their company reported a median income of $103,000, while those who were not in charge reported a median of $90,000. The average salaries by that distinction were $124,000 and $98,000 respectively.

Budget. Budgetary responsibility is one of two primary indicators. Those with no budgetary responsibility earn a median of $89,000; those whose duties include budgetary recommendations earn $94,000 median; those who plan and submit budgets earn $97,000 median; and those who approve budgets—16 percent of the respondents—earn a median of $110,000.

Facilities. The other historically reliable predictor of compensation is the number and geographic dispersion of facilities for which the position is responsible. Responsibility for a single facility equated to a median of $77,000 in 2008, while those with responsibility for multiple locations within a single state reported a median of $85,000.

Compensation jumped for those with responsibility for facilities in more than one state to $97,000 and even more dramatically for those with international responsibilities—up to a median of $124,000.

Issues. The types of issues falling under security’s purview also affected compensation levels. Security professionals were asked to indicate which of four general fields of responsibility best described their jobs—physical security, IT/logical security, life safety, and VIP security offsite; they could check off more than one. The duties most highly compensated were IT security (about 16 percent of respondents) and executive protection (about 33 percent) with medians of $105,000 and $107,000, respectively.

Two-thirds of respondents included physical security among their responsibilities and about half included life safety issues. Those whose duties did not also include IT and executive protection reported a median compensation of $94,000 and $95,000, respectively.

Poor Indicators

Poor predictors of compensation include factors such as how many employees are in security, how many people report directly to a position, and how many years a person has served in an organization. Having military or law enforcement experience does not affect compensation.

What’s in a name? Titles don’t matter much when it comes to compensation, perhaps because companies follow no standards for what they call a person with any specific job.

Overall, the key to earning more appears to be to pursue continuing education through certifications while seeking positions of maximum responsibility in fields where security’s worth is recognized within the corporate structure.

Mike Moran is special projects editor for the Publishing Department at ASIS International. He conducts and analyzes results of the ASIS salary survey each year.