Security Consulting Professional Titles
Standardized job titles, responsibilities, and expectations for security consulting professionals. This covers the Big 4 consulting career ladder (Deloitte, EY, KPMG, PwC), mid-tier and boutique consultancies, MSSPs, and the growing vCISO and Fractional CISO market.
How to use these tables: Levels are displayed as columns for easy vertical comparison. The attribute column stays fixed while you scroll horizontally.
Security Consultant
Security consulting professionals who deliver advisory, assessment, and implementation services across multiple clients and industries. This track follows the Big 4 consulting career ladder (Deloitte, EY, KPMG, PwC) and applies broadly to mid-tier consulting firms, MSSPs, and boutique security consultancies. Consultants are generalists by design — engagements may span offensive testing, GRC, architecture review, incident response, and program development depending on client needs.
| Attribute | Analyst / Associate | Senior Consultant / Senior Associate | Manager | Senior Manager | Director / Principal | Managing Director / Executive Director | Partner |
|---|---|---|---|---|---|---|---|
| General Description | Entry-level security consultant learning consulting methodologies, client engagement, and foundational security skills. Supports senior consultants on engagements, performs research and analysis, and develops deliverables under close supervision. Builds foundational knowledge across security domains rather than specializing early. | Experienced consultant who leads workstreams within engagements and works with moderate independence. Demonstrates proficiency across multiple security domains and can manage day-to-day client relationships for their assigned work. Beginning to develop a consulting specialization while maintaining broad advisory capability. | First management-level role responsible for end-to-end engagement delivery, team leadership, and client relationship management. Manages multiple concurrent engagements and a team of consultants. Balances delivery excellence with business development and people development. This is the level where consulting career divergence accelerates — some managers specialize deeply, others broaden. | Senior engagement leader responsible for large-scale security programs, multiple client relationships, and significant practice revenue. Manages managers and leads complex, multi-workstream engagements. Plays a significant role in business development, thought leadership, and practice strategy. Often the day-to-day senior point of contact for the firm's most important client relationships. | Practice leader responsible for a security consulting service line, major client portfolio, or regional practice. Drives strategy, revenue growth, and market positioning. Operates as a trusted advisor to CISOs and executive leadership. Heavy emphasis on business development, firm leadership, and industry influence. At some firms, this is the terminal level below Partner; at others, Director is a distinct track from the Partner path. | Senior practice executive responsible for major market segments, global service lines, or the overall security consulting practice at a firm. Drives firm-level strategy, major alliance relationships, and market-defining initiatives. Operates at the intersection of business leadership and technical authority. At Big 4 firms, this is typically the level immediately below Partner. | Equity partner and firm owner responsible for the security consulting practice at the highest level. Sets firm-wide strategy, owns the most significant client relationships, and drives the profession forward. Partners are the public face of the firm's security practice and carry ultimate responsibility for practice performance, reputation, and direction. Compensation includes profit-sharing and equity, making total compensation highly variable. |
| Primary Responsibilities |
|
|
|
|
|
|
|
| Required Skills |
|
|
|
|
|
|
|
| Preferred Skills |
|
|
|
|
|
|
|
| Mentorship Requirements | Receives direct mentorship from Managers and Senior Consultants. Participates in structured onboarding and training program. Expected to complete foundational certifications within first year. Shadows on 5-10 engagements before taking ownership of workstreams. | Receives mentorship from Managers on engagement management and client skills. Expected to actively mentor Analysts. Developing a reputation for subject matter expertise in 1-2 domains. May begin informal coaching relationships with peers. | Mentors Senior Consultants and Analysts on engagement delivery, client management, and career development. Expected to develop future consulting leaders. May participate in firm-wide mentorship programs. Sponsors team members for promotions and development opportunities. | Develops future managers and leaders. Sponsors high-potential consultants for key opportunities. May lead firm-wide development programs. Shapes career framework and promotion criteria for the practice. | Develops senior managers and future practice leaders. Sponsors firm-wide talent initiatives. May serve as executive sponsor for key accounts. Shapes firm culture and values within the practice. | Develops directors and future managing directors. Serves as executive sponsor for firm-wide talent and diversity initiatives. Shapes the profession through advisory board service and industry governance. | Serves as the ultimate career sponsor and advocate for future partners. Shapes firm culture, values, and professional standards. Contributes to industry mentorship through advisory boards, academic partnerships, and professional associations. |
| Impact Scope | Individual contributor on specific engagement workstreams. Impact limited to assigned deliverable components. Work is reviewed before client delivery. Contributes to overall engagement quality. | Owns quality and delivery of assigned workstreams. Findings and recommendations directly influence client security posture. Beginning to influence engagement approach and methodology. Reputation with specific clients developing. | Responsible for engagement quality and client satisfaction across multiple projects. Influences practice methodology and quality standards. Directly impacts team utilization, revenue, and client retention. Beginning to shape practice direction. | Practice revenue and growth. Client retention and expansion for major accounts. Team capability and organizational health. Market positioning and brand in specific security domains. | Practice revenue, profitability, and growth. Market positioning and competitive differentiation. Organizational capability and talent pipeline. Client outcomes across the portfolio. | Market-level security consulting strategy and positioning. Firm-wide revenue and growth in security. Industry direction and standards development. Next-generation leadership talent. | Firm-wide security practice performance and reputation. Industry direction and standards. Next-generation leadership development. Market-level competitive positioning and innovation. |
| Autonomy & Decision Authority | Works under close supervision. Follows established methodologies and templates. Escalates all client questions and findings to engagement leads. Limited authority to make independent recommendations. | Works with moderate supervision. Can make tactical decisions within defined engagement scope. Escalates scope changes and significant client concerns. Independence on routine assessments and deliverables. | Full ownership of engagement delivery decisions. Authority over team assignments and resource allocation. Manages client expectations and scope independently. Escalates only significant financial or reputational risks. | Full authority over engagement portfolio and client strategy. Significant influence over practice direction and investment. Partners with firm leadership on strategic decisions. Authority over hiring and organizational changes within span. | Full authority over practice strategy and investment. Significant firm-level influence on security practice direction. Authority over hiring, structure, and market positioning. Partners with firm leadership on major decisions. | Firm-level strategic authority within security practice. Significant influence on firm-wide decisions. Full authority over practice portfolio, investment, and structure. Direct engagement with firm's executive committee. | Equity ownership with commensurate authority. Firm-level decision-making on security practice. Significant influence on firm-wide strategy. Fiduciary responsibility to the partnership. |
| Communication & Stakeholders | Primarily internal communication with engagement team. May participate in client meetings as observer or note-taker. Presents specific findings to technical audiences under supervision. | Regular client interaction at the working level. Presents findings and recommendations to technical and management audiences. Facilitates workshops independently. Participates in project status calls. | Direct relationship with client directors and VPs. Presents to senior leadership on engagement outcomes. Participates in firm leadership meetings. Represents the practice in cross-functional discussions. | Regular engagement with client VPs and CISOs. Presentations to boards and audit committees on behalf of clients. Firm leadership engagement on practice performance. Industry event speaking and thought leadership. | Direct relationships with CISOs and C-suite executives. Board and audit committee advisory. Firm leadership team engagement. Industry analyst and media relationships. | Board-level client relationships. Firm executive committee engagement. Regulatory and government senior relationships. Industry analyst and media leadership. | Client board relationships. Government and regulatory senior leadership. Firm partnership and governance. Industry analyst, media, and standards body leadership. |
| Degree / Experience | Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or related field, OR 1-2 years of IT/security experience. | Bachelor's degree with 2-4 years of consulting or security experience, OR Master's degree with 1-2 years. Demonstrated engagement delivery track record. | Bachelor's degree with 5-8 years of consulting experience, OR Master's/MBA with 4-6 years. Demonstrated track record of successful engagement delivery and team leadership. | Bachelor's degree with 8-12 years of consulting experience, OR Master's/MBA with 7-10 years. Track record of significant business development and large program delivery. Recognized industry expertise developing. | Bachelor's degree with 12-16 years of consulting experience, OR Master's/MBA with 10-14 years. Demonstrated practice leadership, significant revenue generation, and industry recognition. | Bachelor's degree with 16-20 years of consulting experience, OR Master's/MBA with 14-18 years. Recognized industry leader with demonstrated market impact and revenue generation. | Bachelor's degree with 18+ years of consulting experience, OR Master's/MBA with 16+ years. Recognized as a preeminent leader in security consulting with demonstrated market impact, significant revenue generation, and industry influence. |
| Certifications |
|
|
|
|
|
|
|
| Salary: US Gov't | $55,000 - $75,000 (GS-7 to GS-9) | $75,000 - $100,000 (GS-11 to GS-12) | $110,000 - $145,000 (GS-13 to GS-14) | $145,000 - $190,000 (GS-14 to GS-15) | $175,000 - $220,000 (GS-15 / SES) | $195,000 - $250,000 (SES) | N/A |
| Salary: US Startup | $65,000 - $85,000 | $85,000 - $120,000 | $130,000 - $175,000 | $175,000 - $240,000 | $230,000 - $320,000 + equity | $320,000 - $480,000 + significant equity | $500,000 - $1,000,000+ + founder equity |
| Salary: US Corporate | $70,000 - $95,000 | $90,000 - $130,000 | $130,000 - $175,000 | $170,000 - $230,000 | $220,000 - $300,000 | $300,000 - $450,000 + bonus | $500,000 - $1,000,000+ + bonus + profit sharing |
| Salary: Big Tech (Mag7) | $120,000 - $190,000 | $170,000 - $280,000 | $250,000 - $400,000 | $350,000 - $550,000 | $500,000 - $800,000 | $700,000 - $1,200,000 | $1,000,000 - $2,500,000+ |
Virtual CISO (vCISO)
A Virtual CISO is a security executive employed by a consulting firm, MSSP, or vCISO services company who provides part-time CISO-level advisory and program leadership to multiple client organizations simultaneously. vCISOs are typically assigned to 5-15 clients and deliver security strategy, risk management, compliance guidance, and program oversight through the firm's methodology and support structure. This is not an entry-level or mid-career role — firms typically require 10-15+ years of security experience including prior management or director-level responsibility. The vCISO title is a service delivery role, not a career level. Career progression happens within the consulting firm's ladder (Senior Consultant through Director), with vCISO being the engagement type assigned at the appropriate seniority.
| Attribute | vCISO |
|---|---|
| General Description | Serves as the designated CISO for multiple client organizations through an MSSP or consulting firm. Provides strategic security leadership, risk oversight, compliance management, and program development. Balances breadth across many clients with sufficient depth to drive meaningful security improvement at each. Leverages the firm's methodology, templates, and support team to scale across engagements. Typically manages 5-10 client relationships concurrently. |
| Primary Responsibilities |
|
| Required Skills |
|
| Preferred Skills |
|
| Mentorship Requirements | Mentors junior consultants and analysts at the firm. Develops client-side security team members. Shares engagement patterns and lessons learned across the vCISO practice. May contribute to firm methodology and training programs. |
| Impact Scope | Security posture and program maturity across 5-10+ client organizations. Client regulatory compliance and audit outcomes. Client security team capability development. Firm revenue through client retention and expansion. |
| Autonomy & Decision Authority | High autonomy in client advisory and recommendations. Strategic decision-making for each client's security program within their budget. Coordinates with firm leadership on engagement scope and staffing. Client-facing authority as the designated security executive. |
| Communication & Stakeholders | Client C-suite and board engagement as the security executive. Firm leadership reporting on engagement status and client health. Client IT leadership for operational coordination. Regulatory and auditor communication on behalf of clients. |
| Degree / Experience | Bachelor's degree with 10-15 years of security experience including management/director-level roles, OR Master's with 8-12 years. Prior experience as a full-time CISO, Security Director, or equivalent strongly preferred. |
| Certifications |
|
| Salary: US Gov't | $130,000 - $180,000 (GS-14 to GS-15) |
| Salary: US Startup | $150,000 - $220,000 |
| Salary: US Corporate | $150,000 - $220,000 |
| Salary: Big Tech (Mag7) | N/A (role does not typically exist at Big Tech) |
Fractional CISO
A Fractional CISO is an independent security executive who works part-time for 2-5 organizations simultaneously, providing strategic security leadership as a contracted executive rather than a full-time employee. Unlike a vCISO employed by a firm, a Fractional CISO operates independently (or through a small boutique), contracts directly with clients, and typically provides deeper engagement with fewer organizations. This model mirrors the Fractional CFO and Fractional COO patterns common in the SMB market. Most Fractional CISOs are former full-time CISOs or senior security directors with 15-25+ years of experience who prefer portfolio-based work over a single employer. Like the vCISO, this is not a leveled career track — it is a practice model. Career progression is measured by client portfolio quality, industry reputation, and practice growth rather than title advancement.
| Attribute | Fractional CISO |
|---|---|
| General Description | Independent security executive providing part-time CISO services directly to 2-5 organizations. Operates as a true C-suite member at each client — attending leadership meetings, sitting on risk committees, and presenting to boards — but on a fractional time basis (typically 10-40 hours per month per client). Provides deeper strategic engagement than a firm-based vCISO, often building long-term multi-year relationships with clients. Handles own business development, client acquisition, and practice management in addition to delivery. |
| Primary Responsibilities |
|
| Required Skills |
|
| Preferred Skills |
|
| Mentorship Requirements | Mentors client security team leaders and emerging CISOs. May participate in industry mentorship programs (ISSA, ISACA chapters). Contributes to the profession through knowledge sharing, speaking, and advisory roles. Often serves as an informal advisor to peers transitioning to fractional work. |
| Impact Scope | Enterprise-wide security posture for 2-5 organizations. Client board-level risk management and governance. Client security team development and organizational maturity. Industry contribution through thought leadership and community engagement. |
| Autonomy & Decision Authority | Full executive authority within each client's security domain (within their organizational constraints). Independent practice management with no firm overhead or methodology constraints. Strategic decision-making as a C-suite executive. Full ownership of client relationships and engagement terms. |
| Communication & Stakeholders | Client boards of directors and C-suite executives. Client IT leadership and business unit heads. Regulatory bodies and auditors on behalf of clients. Industry peers and professional community. |
| Degree / Experience | Bachelor's degree with 15-25+ years of security experience including senior leadership roles, OR Master's/MBA with 12-20+ years. Track record as a full-time CISO, VP of Security, or equivalent. Industry recognition and strong professional network. |
| Certifications |
|
| Salary: US Gov't | N/A |
| Salary: US Startup | $200,000 - $400,000 (retainer-based, 3-5 clients) |
| Salary: US Corporate | $250,000 - $500,000 (retainer-based, 3-5 clients) |
| Salary: Big Tech (Mag7) | N/A (role does not typically exist at Big Tech) |