I compared CISO salaries across France, Germany, the UK and the US, expecting the story to be about America…
Lara B. — Building Cyberr
I compared CISO salaries across France, Germany, the UK and the US, expecting the story to be about America. It's about France.
A CISO in Paris and a CISO in Munich are carrying the same regulation. Same NIS2, same DORA, same breach exposure...one of them is paid roughly half of what the other one is paid.
A group CISO at a regulated UK financial institution can clear €410k, while a French RSSI sitting in the same DORA scope with the same personal exposure tops out closer to €220k. Germany and the UK reach broadly the same median by completely different routes, Germany through high gross salaries and the UK through lower gross with heavier variable.
The American figure needs one piece of context that gets lost every time it's quoted. It's total compensation, and around 70% of US CISOs now hold equity, so a meaningful chunk of that number is stock that may or may not be worth anything in four years.
So why does the market with the heaviest regulatory load in Europe pay its security leaders the least?
Part of the answer is that French employers aren't spending as much less as it looks. Social charges run at around 43% and barely drop at senior levels, so an €87k French RSSI costs a company roughly €124k while a €166k German CISO costs around €186k.
The rest is about where the role sits. In Germany the CISO reports to the board. In France the RSSI has historically answered to the DSI, and a role that reports to the CIO gets priced as a senior manager while a role that reports to the board gets priced as an executive. The regulation moved faster than the org chart, and the salary is still following the org chart.
7 reactions · 2 comments
Comments
Ulf F.: one of the main differences between US and EU might also be the personal liability. Furthermore, looking at the German numbers, I would guess 120-170k, depending on the industry are possible, to get to the level of 180-200k you really need to look for to find that. It would be really interesting to see some kind of a curve depending on industry, company size, etc. .. and in comparison to that the
Coen B.: The differences in wages is typical between France and Germany regardless of roles in cyber.