Specialized Security Professional Titles

EVM Analyst

Professionals who identify, assess, and drive remediation of security vulnerabilities across the enterprise. Focus on risk-based prioritization, threat intelligence integration, and enabling systemic remediation rather than transactional ticket management. Partner with asset owners to address root causes and improve organizational security posture.

Attribute	Analyst 1 / Entry	Analyst 2 / Junior	Analyst 3 / Mid	Analyst 4 / Senior / Lead	Analyst 5 / Staff	Analyst 6 / Senior Staff	Analyst 7 / Principal
General Description	Entry-level EVM analyst learning vulnerability assessment fundamentals and remediation workflows. Assists with scan execution, finding validation, and remediation tracking. Develops foundational understanding of vulnerability types, risk rating methodologies, and the importance of context-driven prioritization.	Junior EVM analyst capable of independently executing vulnerability assessments and facilitating remediation efforts. Demonstrates proficiency in risk-based prioritization and can effectively communicate findings to technical stakeholders. Beginning to understand the importance of addressing root causes over individual findings.	Experienced EVM analyst who drives strategic remediation initiatives and identifies systemic vulnerability patterns. Expert in risk-based prioritization integrating threat intelligence, business context, and exploitability data. Focuses on enabling root-cause remediation rather than individual ticket management. Mentors junior analysts and shapes program processes.	Senior EVM analyst and program leader who defines vulnerability management strategy and drives organizational security improvement. Champions the philosophy that effective vulnerability management enables systemic remediation through automation, threat intelligence, and root-cause analysis rather than overwhelming teams with tickets. Leads major initiatives and represents the program to executive stakeholders.	Distinguished EVM strategist who shapes organizational and industry approaches to vulnerability management. Recognized externally as thought leader in risk-based vulnerability prioritization and strategic remediation. Drives innovation in vulnerability intelligence, automation, and program effectiveness measurement.	Elite EVM strategist with industry-defining influence in vulnerability management and risk prioritization. Operates at the intersection of deep expertise and organizational strategy. Shapes not only practice direction but industry approaches to vulnerability risk management.	Legendary practitioner at the pinnacle of vulnerability management expertise. Globally recognized authority who defines how the industry approaches vulnerability risk identification, prioritization, and remediation. Combines unparalleled expertise with strategic vision.
Primary Responsibilities	Execute scheduled vulnerability scans under guidance Validate and triage scan findings for false positives Document vulnerabilities in tracking systems Assist with remediation status tracking and follow-up Learn vulnerability scoring systems (CVSS, EPSS, SSVC) Support basic vulnerability reporting and metrics Maintain scan schedules and asset group documentation Escalate critical findings to senior analysts	Execute and manage vulnerability scans independently Perform risk-based prioritization of findings Facilitate remediation discussions with asset owners Develop and maintain vulnerability analytics and reports Track remediation progress and identify blockers Integrate threat intelligence into prioritization decisions Identify patterns indicating systemic issues Contribute to SLA development and tracking Support audit and compliance evidence gathering	Drive strategic remediation initiatives addressing root causes Develop advanced vulnerability analytics and trending Integrate threat intelligence for proactive prioritization Identify and escalate systemic vulnerability patterns Build relationships with key asset owner stakeholders Mentor junior analysts on risk-based methodology Develop program metrics and executive reporting Lead remediation campaigns for critical vulnerabilities Evaluate and recommend process improvements Support risk acceptance and exception governance	Define EVM program strategy and multi-year roadmap Drive organizational adoption of risk-based remediation Develop automation strategies for remediation enablement Lead critical vulnerability response and coordination Present program metrics and strategy to executives Mentor and develop EVM analyst team Build strategic partnerships with IT and development teams Drive continuous improvement in program maturity Evaluate emerging vulnerability intelligence sources Support M&A vulnerability assessment activities Represent EVM in cross-functional security initiatives	Define multi-year EVM strategy and vision Lead industry-impacting research and methodology development Build strategic relationships with vulnerability intelligence providers Develop next-generation prioritization methodologies Represent organization at highest industry levels Guide organizational investments in EVM capabilities Shape industry standards and practices Advise executive leadership on vulnerability risk strategy	Set multi-year vision for enterprise vulnerability management Lead transformational methodology development Build strategic alliances with vendors and intelligence providers Influence industry standards and frameworks Develop next-generation risk quantification approaches Guide organizational strategy alongside executive leadership Represent organization as premier thought leader	Define industry direction for vulnerability management Lead transformational multi-year initiatives Serve as ultimate strategic authority Shape vulnerability disclosure and coordination policy Build generational capabilities and practices Guide organizational transformation Represent organization at highest levels globally
Required Skills	Basic understanding of common vulnerability types Familiarity with vulnerability scanners (Tenable, Qualys, Rapid7) Understanding of CVSS scoring methodology Basic networking and system administration knowledge Documentation and attention to detail Spreadsheet and data analysis basics Understanding of patch management concepts	Proficiency with enterprise vulnerability scanners Risk-based prioritization using CVSS, EPSS, and business context Understanding of threat intelligence integration Remediation workflow management Data analysis and visualization Stakeholder communication skills Understanding of compensating controls Basic knowledge of exploit availability and weaponization	Expert-level vulnerability assessment and prioritization Threat intelligence integration and analysis Root cause analysis for systemic issues Advanced analytics and data visualization Executive communication and reporting Program metrics development Stakeholder relationship management Process improvement methodology	Mastery of enterprise vulnerability management Strategic program development and leadership Executive communication and influence Automation and process optimization strategy Team leadership and development Vendor and tool evaluation Business acumen and risk communication Cross-functional collaboration and influence	World-class vulnerability management expertise Strategic practice leadership Executive presence and influence Industry-wide recognition and relationships Innovation and methodology development Cross-functional leadership	Elite vulnerability management and risk expertise Transformational leadership Executive and board-level communication Industry-shaping influence and relationships Business strategy and risk quantification Innovation leadership	Globally recognized expertise Transformational strategic vision Executive and government-level influence Industry-defining thought leadership Strategic business development
Preferred Skills	Familiarity with ticketing systems (ServiceNow, Jira) Basic scripting ability (Python, PowerShell) Understanding of common CVEs and exploit vectors Cloud platform basics (AWS, Azure) ITIL or service management exposure	Scripting for data analysis and automation Dashboard development (Power BI, Tableau) Cloud vulnerability assessment Container and Kubernetes scanning Application security scanning basics	Automation development for analysis workflows Machine learning concepts for prioritization Supply chain vulnerability assessment Regulatory compliance mapping Published vulnerability research or writing	Industry speaking or thought leadership Vulnerability disclosure program experience Bug bounty program management Security metrics and KRI development Board-level risk communication	Published vulnerability research or frameworks Standards body participation (CVSS SIG, etc.) Advisory roles with vendors or industry bodies Academic affiliations	Major framework or methodology creator Vendor advisory roles Board positions Academic appointments	Founded significant vulnerability frameworks or programs Government or regulatory advisory Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior EVM analysts. Shadows on remediation discussions with asset owners. Expected to complete scanner training and certification within first 6 months. Learns risk-based prioritization philosophy.	Receives guidance from Senior analysts on complex prioritization decisions. Expected to begin mentoring Entry-level analysts informally. Contributes to process documentation and training materials. Should be developing expertise in specific asset types or vulnerability classes.	Primary mentor for Junior and Entry analysts. Leads training on risk-based prioritization methodology. Expected to develop program procedures and best practices. Establishes reputation as expert in vulnerability intelligence and prioritization.	Primary mentor for Mid and Junior analysts. Responsible for analyst career development. Creates program training and development curriculum. Industry mentorship through community engagement. Shapes EVM best practices.	Mentors Senior analysts and emerging leaders. Shapes organizational vulnerability management talent strategy. Industry-level mentorship through community engagement. Develops thought leaders in the space.	Develops organizational leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to the field.	Develops organizational and industry leadership. Mentors future industry leaders. Legacy-building through generational impact. May fund or sponsor research initiatives.
Impact Scope	Individual contributor on scan execution and finding validation. Impact limited to assigned scan segments and documentation. Work is reviewed before stakeholder communication. Supports overall program metrics and coverage.	Directly contributes to remediation outcomes. Responsible for accurate prioritization affecting asset owner workload. Analytics inform program decisions. Beginning to influence remediation strategies.	Shapes program strategy and remediation outcomes. Root cause identification prevents future vulnerabilities. Analytics drive organizational security investment. Influences technology and process decisions.	Defines program capabilities and strategic direction. Program effectiveness directly impacts organizational risk posture. Team development impacts security maturity. Executive relationships enable resource allocation.	Industry and organizational transformation. Shapes how vulnerability management is practiced. Multi-year strategic outcomes. Influences industry standards and vendor roadmaps.	Industry-defining impact. Organizational competitive differentiation through security posture. Multi-year strategic transformation. Shapes how vulnerability risk is understood and managed.	Global industry impact. Defines how vulnerability management is practiced. Organizational transformation. Lasting contributions to cybersecurity risk management.
Autonomy & Decision Authority	Works under close supervision. Follows established scan procedures and triage guidelines. Limited authority to close or disposition findings independently. Escalates prioritization questions to senior analysts.	Works with moderate supervision. Can make routine prioritization decisions. Authority to facilitate remediation discussions. Escalates risk acceptance and exception requests.	Works independently with strategic guidance. Makes significant prioritization and process decisions. Authority to approve risk acceptances within defined criteria. Consulted on program strategy and tooling decisions.	High autonomy with strategic alignment. Makes significant program and investment decisions. Authority over EVM processes and standards. Trusted to represent program to executives and externally.	Near-complete autonomy over domain. Strategic influence on organizational direction. Shapes investment and capability priorities. Makes decisions with significant organizational impact.	Full autonomy over strategic domain. Executive-level decision authority. May have significant budget authority. Shapes organizational direction.	Complete strategic autonomy. Executive-level authority. Shapes organizational strategy. May have significant influence over industry direction.
Communication & Stakeholders	Primarily internal communication with EVM team. May assist with remediation ticket creation. Documents findings in tracking systems. Limited direct interaction with asset owners.	Regular interaction with asset owners and IT teams. Presents findings in remediation meetings. Participates in risk discussions. Documents decisions for audit purposes.	Regular communication with security leadership. Presents to technical and management audiences. Primary analyst contact for major remediation initiatives. Builds relationships with senior asset owners.	Executive and board-level communication on risk posture. Represents program to organizational leadership. Industry conference presentations. Builds relationships with peers at other organizations.	C-suite engagement on risk strategy. Industry-wide influence through publications and speaking. Vendor and standards body relationships. Media and analyst engagement.	Peer engagement with executives and CISOs. Industry-defining thought leadership. Media and public presence. Board-level engagement.	Global presence. Government and international engagement. Media thought leadership. Premier industry venues.
Degree / Experience	Bachelor's degree in IT, Cybersecurity, Computer Science, or related field, OR 1-2 years of IT support or security operations experience, OR completion of vulnerability management training program.	Bachelor's degree in IT, Cybersecurity, or related field, OR 2-4 years of vulnerability management or security operations experience. Demonstrated ability to drive remediation outcomes.	Bachelor's degree in IT, Cybersecurity, or related field, OR 4-6 years of vulnerability management experience. Demonstrated track record of driving strategic remediation outcomes. May have Master's degree with less experience.	Bachelor's or Master's degree in relevant field, OR 6-10 years of vulnerability management experience. Demonstrated program leadership and strategic impact. Industry recognition through speaking or publications.	Advanced degree often expected, OR 10+ years of elite vulnerability management experience with demonstrated industry impact. Recognition is essential qualification.	Advanced degree often present, but industry recognition is primary qualification. 12+ years of elite experience with transformational impact.	Recognition is primary qualification. 15+ years with transformational impact. May be pioneers of major vulnerability frameworks or methodologies.
Certifications	CompTIA Security+ Vendor scanner certifications (Tenable, Qualys) CompTIA CySA+ GIAC Foundational certifications	CompTIA CySA+ Vendor advanced scanner certifications GIAC Vulnerability Assessment (GEVA) - if available Cloud security fundamentals	CISSP or equivalent GIAC certifications (GEVA, GPEN for context) Advanced scanner certifications Cloud security certifications	CISSP, CISM, or equivalent Multiple technical certifications Industry recognition may substitute Leadership or management training	Certifications secondary to demonstrated expertise May be certification or framework contributors Industry awards and recognition Published research and methodologies	Certifications irrelevant at this level Known by reputation and body of work Industry recognition and awards	Certifications irrelevant at this level Known by reputation and legacy May have frameworks or methods named after them
Salary: US Gov't	$55,000 - $75,000 (GS-7 to GS-9)	$70,000 - $95,000 (GS-9 to GS-11)	$90,000 - $120,000 (GS-12 to GS-13)	$115,000 - $150,000 (GS-14 to GS-15)	$145,000 - $180,000 (GS-15 / SES equivalent)	$165,000 - $200,000 (Senior SES equivalent)	$180,000 - $220,000+ (Senior SES / Political appointee)
Salary: US Startup	$60,000 - $80,000	$75,000 - $100,000	$100,000 - $140,000	$140,000 - $185,000 + equity	$175,000 - $240,000 + significant equity	$210,000 - $290,000 + major equity	$260,000 - $380,000+ + founder-level equity
Salary: US Corporate	$55,000 - $75,000	$70,000 - $95,000	$95,000 - $130,000	$130,000 - $175,000	$165,000 - $220,000	$195,000 - $260,000	$240,000 - $330,000+

↑ Back to navigation

EVM Engineer

Technical professionals who build, deploy, and maintain enterprise vulnerability management platforms and infrastructure. Focus on scanner deployment, platform integration, automation development, and enabling analyst effectiveness through tooling and dashboards. Serve as architects for scanning infrastructure and the technical bridge to vendors.

Attribute	Eng 1 / Entry	Eng 2 / Junior	Eng 3 / Mid	Eng 4 / Senior / Lead	Eng 5 / Staff	Eng 6 / Senior Staff	Eng 7 / Principal
General Description	Entry-level EVM engineer learning vulnerability scanning platform administration and deployment. Assists with scanner maintenance, agent deployments, and basic platform configuration. Develops foundational understanding of scanning technologies, network architecture requirements, and platform capabilities.	Junior EVM engineer capable of independently managing scanner deployments and platform administration. Demonstrates proficiency in scanning infrastructure and can troubleshoot complex scanning issues. Beginning to develop automation skills and expertise in specific platform capabilities.	Experienced EVM engineer who architects scanning infrastructure and develops platform integrations. Expert in scanner deployment strategies, API integrations, and automation development. Leads platform projects including M&A integrations and capability expansions. Mentors junior engineers and shapes platform standards.	Senior EVM engineer and technical leader who defines platform strategy and architecture for enterprise vulnerability management. Leads complex platform initiatives, M&A integrations, and capability development. Serves as the escalation point for critical platform issues and the primary technical interface with scanning vendors.	Distinguished EVM platform architect who defines organizational platform strategy and drives innovation. Recognized externally as expert in vulnerability management platform architecture and integration. Shapes how scanning infrastructure enables strategic vulnerability management programs.	Elite EVM platform architect with industry-defining technical influence. Operates at the frontier of vulnerability scanning and assessment technology. Shapes how the industry approaches vulnerability detection infrastructure and data platforms.	Legendary EVM platform engineer at the pinnacle of vulnerability scanning and assessment platform expertise. Globally recognized for transformational contributions to vulnerability detection technology. Defines how the industry approaches vulnerability scanning infrastructure.
Primary Responsibilities	Assist with vulnerability scanner maintenance and updates Support scan engine and agent deployments Monitor scanner health and availability Troubleshoot basic scanning issues Document platform configurations and procedures Assist with credential management for authenticated scans Support asset discovery and inventory activities Maintain scanner infrastructure documentation	Deploy and configure vulnerability scanners Manage scan engine placement and network connectivity Administer scanning platforms and user access Develop and maintain scan policies and configurations Troubleshoot scanning failures and coverage gaps Build basic reports and dashboards Support integration with ticketing systems Manage authenticated scanning credentials Document architecture decisions and configurations	Architect scanning infrastructure for enterprise coverage Lead scanner deployments for new environments and M&A Develop platform integrations and automation Build advanced dashboards and analytics capabilities Optimize scan configurations for accuracy and performance Mentor junior EVM engineers Manage vendor relationships and technical escalations Evaluate and pilot new scanning capabilities Develop platform standards and best practices Support critical vulnerability response with platform capabilities	Define EVM platform strategy and architecture roadmap Lead enterprise-wide platform implementations Architect integrations with security ecosystem Develop automation enabling strategic remediation Mentor and develop EVM engineering team Manage strategic vendor relationships Drive platform innovation and capability development Support M&A technical due diligence and integration Present platform strategy to executives Represent platform engineering in cross-functional initiatives	Define multi-year platform strategy and vision Lead platform innovation and research initiatives Architect enterprise vulnerability data platforms Build strategic partnerships with vendors Develop next-generation scanning capabilities Guide organizational platform investments Represent organization at vendor advisory boards Shape industry platform practices	Set multi-year technical vision for vulnerability platforms Lead transformational platform initiatives Build strategic technical alliances Develop capabilities that redefine possible Influence vendor product roadmaps Guide organizational technical strategy Serve as ultimate platform authority	Define industry technical direction for vulnerability platforms Lead generational platform capability development Serve as ultimate platform authority globally Shape vendor product strategies Build lasting technical contributions Guide organizational transformation Pioneer new approaches to vulnerability detection
Required Skills	Basic system administration (Windows, Linux) Understanding of networking fundamentals Familiarity with vulnerability scanning concepts Basic troubleshooting skills Documentation and procedure following Understanding of enterprise IT environments Basic scripting ability	Proficiency with vulnerability scanning platforms Scanner deployment and architecture basics Network troubleshooting for scan connectivity Platform administration and configuration Intermediate scripting (Python, PowerShell) API interaction basics Report and dashboard development Change management processes	Expert-level scanning platform architecture Advanced API integration development Automation and orchestration development Dashboard and visualization development Strong programming skills (Python, Go, etc.) Cloud scanning architecture Vendor management and technical liaison Project management fundamentals	Mastery of enterprise vulnerability scanning platforms Strategic platform architecture Team leadership and development Vendor management and negotiation Executive communication Enterprise integration architecture Automation strategy and implementation Budget planning and management	World-class vulnerability platform expertise Strategic platform leadership Executive presence and influence Industry-wide recognition Innovation and capability incubation Cross-functional technical leadership	Elite vulnerability platform expertise Transformational technical leadership Industry-wide technical influence Executive presence and communication Strategic vision and planning Innovation at scale	Globally recognized platform expertise Transformational capability development Industry-defining influence Strategic technical vision Innovation leadership at global scale
Preferred Skills	Experience with virtualization platforms Cloud platform basics (AWS, Azure) Database fundamentals API concepts ITIL or change management exposure	Cloud scanning deployment (AWS, Azure, GCP) Container scanning platforms Database querying and reporting Automation development Integration platform experience	Data engineering and analytics pipelines Machine learning for vulnerability analysis Custom scanner plugin development Infrastructure as code Security data lake integration	Security product development experience Open-source tool development Conference speaking experience Patent or IP development Multi-vendor platform experience	Vendor advisory board participation Published platform architecture work Open-source scanning tools Security data platform patents	Major platform framework development Multiple vendor advisory roles Security data platform patents Academic research collaborations	Founded significant scanning platforms or tools Major vulnerability detection innovations Hall of fame recognition Academic distinguished positions
Mentorship Requirements	Receives direct mentorship from Senior EVM engineers. Shadows on platform deployments and integrations. Expected to complete vendor platform training and certification. Learns scanning architecture principles.	Receives guidance from Senior engineers on complex deployments. Expected to begin mentoring Entry-level engineers informally. Contributes to platform documentation and procedures. Should be developing expertise in specific platform capabilities.	Primary mentor for Junior and Entry engineers. Leads training on platform capabilities and architecture. Expected to develop platform standards and patterns. Establishes reputation as expert in scanning infrastructure.	Primary mentor for multiple engineers. Responsible for engineering career development. Creates platform engineering development programs. Industry mentorship through vendor community engagement.	Mentors Senior engineers and emerging technical leaders. Shapes platform engineering career paths. Industry-level mentorship through vendor communities.	Develops technical leadership pipeline. Mentors future industry platform leaders. Legacy through platform innovations and people developed.	Develops generational technical talent. Mentors future industry pioneers. Legacy through lasting technical contributions.
Impact Scope	Individual contributor on platform maintenance tasks. Impact limited to assigned infrastructure components. Work is reviewed before production changes. Supports overall scanner coverage and reliability.	Directly maintains scanning infrastructure reliability. Responsible for scanner coverage and health. Platform decisions impact analyst effectiveness. Beginning to influence platform architecture.	Shapes scanning platform capabilities. Architecture decisions impact coverage and effectiveness. Integrations enable program automation. Influences technology investment decisions.	Defines platform capabilities for organization. Strategic decisions impact long-term program effectiveness. Team development impacts engineering maturity. Vendor relationships affect cost and capability.	Organizational platform differentiation. Industry-level impact through vendor relationships. Defines state-of-the-art in vulnerability scanning infrastructure.	Industry-defining platform impact. Shapes how vulnerability scanning is practiced. Organizational competitive differentiation.	Global technical impact. Defines vulnerability scanning capabilities. Lasting contributions to the field.
Autonomy & Decision Authority	Works under close supervision. Follows established deployment and maintenance procedures. Limited authority to make platform changes independently. Escalates technical issues to senior engineers.	Works with moderate supervision. Can make routine platform decisions. Authority to deploy standard configurations. Escalates architectural changes and integrations.	Works independently with strategic guidance. Makes significant architecture and integration decisions. Authority over platform configuration standards. Consulted on platform roadmap and vendor selection.	High autonomy with strategic alignment. Makes significant platform and investment decisions. Authority over platform standards and architecture. Trusted to represent organization with vendors.	Near-complete technical autonomy. Strategic influence on platform direction. Shapes investment priorities. Makes decisions with significant organizational impact.	Full technical autonomy. Strategic authority over platform direction. May have significant R&D budget authority. Shapes organizational strategy.	Complete technical autonomy. Executive authority over platform domain. Shapes organizational and industry direction.
Communication & Stakeholders	Primarily internal communication with EVM team. Documents work in ticketing systems. Participates in team meetings. Limited interaction with vendor support under guidance.	Regular interaction with EVM analysts and IT teams. Coordinates with network and infrastructure teams. Engages vendor support on technical issues. Documents changes for team consumption.	Regular communication with security leadership. Presents technical recommendations to stakeholders. Primary technical contact for vendor relationships. Coordinates with enterprise architecture.	Executive-level communication on platform strategy. Represents engineering to organizational leadership. Vendor executive relationships. Industry event participation.	C-level technical engagement. Vendor executive relationships. Industry conference keynotes. Shapes vendor product roadmaps.	Industry-defining technical presence. Vendor strategic engagement. Premier conference keynotes. Media thought leadership.	Global technical authority. Premier industry venues. Vendor and government engagement. Media presence.
Degree / Experience	Bachelor's degree in IT, Computer Science, Cybersecurity, or related field, OR 1-2 years of system administration or IT operations experience, OR completion of relevant technical training program.	Bachelor's degree in IT, Computer Science, or related field, OR 2-4 years of vulnerability management platform or security infrastructure experience. Demonstrated platform administration skills.	Bachelor's degree in Computer Science, IT, or related field, OR 4-6 years of vulnerability management platform engineering experience. Demonstrated track record of successful platform implementations.	Bachelor's or Master's degree in relevant field, OR 6-10 years of vulnerability management platform engineering experience. Demonstrated team leadership and strategic impact.	Advanced degree often expected, OR 10+ years of elite vulnerability platform engineering with demonstrated industry impact. Recognition is essential.	Advanced degree often present, but recognition is primary qualification. 12+ years of elite experience with transformational platform impact.	Recognition is primary qualification. 15+ years with transformational impact. May be pioneers of major scanning platforms or techniques.
Certifications	CompTIA Security+ Vendor scanner administrator certifications CompTIA Network+ Cloud fundamentals certifications	Advanced vendor scanner certifications Cloud security certifications Scripting and automation certifications GIAC certifications relevant to infrastructure	Advanced vendor platform certifications Cloud architect certifications Programming and automation certifications CISSP or equivalent for credibility	Multiple advanced platform certifications Enterprise architecture certifications Industry recognition may substitute Leadership training	Certifications secondary to demonstrated expertise May be certification developers Known for platform innovations	Certifications irrelevant at this level Known by technical contributions Platform innovations may be named after them	Certifications irrelevant Known by technical legacy May have platforms or techniques named after them
Salary: US Gov't	$60,000 - $80,000 (GS-9 to GS-11)	$75,000 - $100,000 (GS-11 to GS-12)	$95,000 - $125,000 (GS-12 to GS-13)	$120,000 - $155,000 (GS-14 to GS-15)	$150,000 - $185,000 (GS-15 / SES equivalent)	$170,000 - $210,000 (Senior SES equivalent)	$185,000 - $230,000+ (Senior SES / Technical fellow equivalent)
Salary: US Startup	$70,000 - $90,000	$85,000 - $115,000	$115,000 - $155,000	$150,000 - $200,000 + equity	$185,000 - $255,000 + significant equity	$225,000 - $310,000 + major equity	$275,000 - $400,000+ + founder-level equity
Salary: US Corporate	$65,000 - $85,000	$80,000 - $110,000	$105,000 - $145,000	$140,000 - $185,000	$175,000 - $230,000	$205,000 - $280,000	$250,000 - $350,000+

↑ Back to navigation

AppSec Engineer

Technical professionals who secure applications throughout the software development lifecycle. Focus on code review, security testing, DevSecOps integration, and developer enablement. Combine defensive expertise (secure coding guidance, SAST/DAST tooling) with offensive skills (manual testing, proof-of-concept development) to identify and help remediate application vulnerabilities. Prioritize enablement over gatekeeping, helping developers build secure code rather than just finding problems.

Attribute	Eng 1 / Entry	Eng 2 / Junior	Eng 3 / Mid	Eng 4 / Senior / Lead	Eng 5 / Staff	Eng 6 / Senior Staff	Eng 7 / Principal
General Description	Entry-level AppSec engineer learning application security fundamentals and secure development practices. Assists with security assessments, tool operation, and developer support. Develops foundational understanding of common vulnerabilities, secure coding principles, and application security testing methodologies.	Junior AppSec engineer capable of independently conducting security assessments and supporting development teams. Demonstrates proficiency with security testing tools and can identify vulnerabilities through both automated and manual techniques. Can use Burp Suite or ZAP to validate findings and demonstrate basic proof-of-concepts to developers.	Experienced AppSec engineer who independently conducts comprehensive application security assessments and drives secure development practices. Expert in both automated tooling and manual testing techniques, able to develop sophisticated proof-of-concepts that clearly demonstrate risk. Leads threat modeling sessions, mentors junior engineers, and builds relationships with development teams as a trusted security partner.	Senior AppSec engineer and team leader who defines application security strategy and leads high-impact initiatives. Expert in sophisticated attack techniques, able to identify and demonstrate complex vulnerability chains. Champions the enablement philosophy, building programs that scale security through developer education and tooling rather than creating bottlenecks. Represents AppSec to executive stakeholders.	Distinguished AppSec engineer who shapes organizational and industry approaches to application security. Recognized externally as thought leader in secure development, application testing, or DevSecOps. Drives innovation in assessment methodologies, tooling, and developer enablement programs.	Elite AppSec engineer with industry-defining influence in application security and secure development. Operates at the intersection of deep technical expertise and organizational strategy. Shapes not only practice direction but industry approaches to building secure software.	Legendary practitioner at the pinnacle of application security expertise. Globally recognized authority who defines how the industry approaches secure software development, application testing, and DevSecOps. Combines unparalleled technical expertise with strategic vision.
Primary Responsibilities	Assist with SAST/DAST tool operation and triage Learn to identify common vulnerabilities (OWASP Top 10) Support code review activities under guidance Document security findings and remediation guidance Assist developers with basic security questions Maintain security testing documentation Learn secure coding practices for common languages Shadow senior engineers on threat modeling sessions	Conduct security code reviews with guidance Operate and tune SAST/DAST/SCA tools Validate findings using Burp Suite or ZAP Proxy Develop basic proof-of-concept exploits for validation Provide remediation guidance to developers Support threat modeling activities Triage and prioritize security findings Contribute to secure coding guidelines Assist with security champion program activities	Lead application security assessments end-to-end Conduct advanced manual penetration testing of applications Develop proof-of-concept exploits demonstrating business impact Lead threat modeling sessions with development teams Design and implement DevSecOps pipeline integrations Mentor junior AppSec engineers Build secure coding guidelines and training content Develop and tune security scanning policies Support security champion program development Evaluate and pilot new security testing tools	Define AppSec program strategy and roadmap Lead security assessments of critical applications Develop advanced exploitation techniques and methodologies Build and scale security champion programs Design enterprise DevSecOps architecture Mentor and develop AppSec engineering team Present application risk to executive leadership Drive adoption of secure development practices Evaluate and select security testing platforms Support M&A application security due diligence Contribute to thought leadership (blogs, talks, tools)	Define multi-year AppSec strategy and vision Lead industry-impacting research and methodology development Build strategic relationships with development leadership Develop next-generation security testing capabilities Represent organization at highest industry levels Guide organizational investments in AppSec capabilities Shape industry standards and practices Advise executive leadership on application risk strategy	Set multi-year vision for enterprise application security Lead transformational methodology development Build strategic alliances with vendors and platform providers Influence industry standards and frameworks Develop next-generation secure development approaches Guide organizational strategy alongside executive leadership Represent organization as premier thought leader	Define industry direction for application security Lead transformational multi-year initiatives Serve as ultimate strategic authority Shape secure development standards and practices globally Build generational capabilities and methodologies Guide organizational transformation Represent organization at highest levels globally
Required Skills	Understanding of common web vulnerabilities (OWASP Top 10) Basic programming in at least one language (Python, Java, JavaScript, etc.) Familiarity with SAST/DAST concepts Understanding of HTTP, REST APIs, and web architecture Basic knowledge of authentication and authorization Documentation and communication skills Willingness to learn both offensive and defensive techniques	Proficiency with SAST tools (Checkmarx, SonarQube, Semgrep) Proficiency with DAST tools (Burp Suite, ZAP, Invicti) Manual web application testing techniques Code review for security in 1-2 languages Understanding of secure coding practices API security testing fundamentals Basic threat modeling participation Developer communication and empathy	Expert-level web application penetration testing Advanced Burp Suite/ZAP techniques and extensions Code review expertise in multiple languages Threat modeling methodologies (STRIDE, PASTA, etc.) DevSecOps and CI/CD security integration API security testing (REST, GraphQL, gRPC) Strong programming skills for tool development Executive-ready vulnerability communication	Mastery of application security testing Advanced exploitation and vulnerability chaining Strategic program development and leadership Executive communication and influence Team leadership and development Vendor evaluation and management DevSecOps strategy and architecture Security metrics and risk communication	World-class application security expertise Strategic practice leadership Executive presence and influence Industry-wide recognition and relationships Innovation and methodology development Cross-functional leadership	Elite application security and development expertise Transformational leadership Executive and board-level communication Industry-shaping influence and relationships Business strategy and risk quantification Innovation leadership	Globally recognized expertise Transformational strategic vision Executive and government-level influence Industry-defining thought leadership Strategic business development
Preferred Skills	Exposure to Burp Suite or ZAP Proxy CTF or web hacking challenge experience Basic understanding of CI/CD pipelines Familiarity with cloud platforms Bug bounty participation	SCA tools (Snyk, Dependabot, Black Duck) CI/CD security integration Container security basics Mobile application security fundamentals Scripting for security automation	Mobile application security testing Cloud-native application security Custom security tool development Security research and CVE discovery Conference speaking or published research	Published security research or CVEs Conference speaking experience Open-source security tool development Bug bounty program management Security product development experience	Published security research or frameworks OWASP project leadership Advisory roles with vendors or industry bodies Bug bounty platform advisory	Major OWASP project founder or leader Vendor advisory roles Published books on application security Academic appointments	Founded significant security frameworks or tools Government or regulatory advisory Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior AppSec engineers. Shadows on security assessments and code reviews. Expected to complete secure coding training and tool certifications within first 6 months. Learns the enablement-focused philosophy of helping developers.	Receives guidance from Senior engineers on complex assessments. Expected to begin mentoring Entry-level engineers informally. Contributes to documentation and training materials. Should be developing expertise in specific languages or vulnerability classes.	Primary mentor for Junior and Entry engineers. Leads training on assessment methodologies and tools. Expected to develop team procedures and best practices. Establishes reputation as expert in specific application types or vulnerability classes.	Primary mentor for Mid and Junior engineers. Responsible for team career development. Creates assessment methodology training programs. Industry mentorship through community engagement. Shapes AppSec engineering practices.	Mentors Senior engineers and emerging leaders. Shapes organizational AppSec talent strategy. Industry-level mentorship through community engagement. Develops thought leaders in the space.	Develops organizational leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to the field.	Develops organizational and industry leadership. Mentors future industry leaders. Legacy-building through generational impact. May fund or sponsor research initiatives.
Impact Scope	Individual contributor on assigned triage and documentation tasks. Impact limited to supporting assessment activities. Work is reviewed before developer communication. Supports overall application security coverage.	Directly contributes to application security outcomes. Responsible for accurate finding validation and prioritization. Remediation guidance impacts developer productivity. Beginning to influence security practices.	Shapes application security practices for assigned products or teams. Assessment quality directly impacts product security. Threat models influence architectural decisions. Developer enablement improves security culture.	Defines AppSec capabilities and strategic direction. Program effectiveness directly impacts product security posture. Team development impacts security organization maturity. Executive relationships enable security investment.	Industry and organizational transformation. Shapes how application security is practiced. Multi-year strategic outcomes. Influences industry standards and vendor roadmaps.	Industry-defining impact. Organizational competitive differentiation through secure software practices. Multi-year strategic transformation. Shapes how application security is understood and practiced.	Global industry impact. Defines how application security is practiced. Organizational transformation. Lasting contributions to secure software development.
Autonomy & Decision Authority	Works under close supervision. Follows established assessment procedures and triage guidelines. Limited authority to disposition findings independently. Escalates vulnerability questions to senior engineers.	Works with moderate supervision. Can make routine triage decisions. Authority to validate and close false positives. Escalates complex vulnerabilities and architectural concerns.	Works independently with strategic guidance. Makes significant assessment and prioritization decisions. Authority over tool configuration and scanning policies. Consulted on security architecture and tool selection.	High autonomy with strategic alignment. Makes significant program and investment decisions. Authority over AppSec processes and standards. Trusted to represent program to executives and externally.	Near-complete autonomy over domain. Strategic influence on organizational direction. Shapes investment and capability priorities. Makes decisions with significant organizational impact.	Full autonomy over strategic domain. Executive-level decision authority. May have significant budget authority. Shapes organizational direction.	Complete strategic autonomy. Executive-level authority. Shapes organizational strategy. May have significant influence over industry direction.
Communication & Stakeholders	Primarily internal communication with AppSec team. May assist with documenting remediation guidance. Limited direct interaction with development teams initially.	Regular interaction with development teams. Presents findings and remediation guidance. Participates in security review meetings. Documents findings for developer consumption.	Regular communication with development leadership. Presents to technical and management audiences. Primary AppSec contact for assigned development teams. Builds relationships with engineering managers.	Executive-level communication on application risk. Represents AppSec to organizational leadership. Industry conference presentations. Builds relationships with peers at other organizations.	C-suite engagement on application risk strategy. Industry-wide influence through publications and speaking. Vendor and standards body relationships. Media and analyst engagement.	Peer engagement with executives and CISOs. Industry-defining thought leadership. Media and public presence. Board-level engagement.	Global presence. Government and international engagement. Media thought leadership. Premier industry venues.
Degree / Experience	Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or related field, OR 1-2 years of software development or security experience, OR completion of application security training program.	Bachelor's degree in Computer Science, Software Engineering, or related field, OR 2-4 years of application security or software development experience. Demonstrated ability to find and validate vulnerabilities.	Bachelor's degree in Computer Science, Software Engineering, or related field, OR 4-6 years of application security experience. Demonstrated track record of comprehensive security assessments. May have Master's degree with less experience.	Bachelor's or Master's degree in relevant field, OR 6-10 years of application security experience. Demonstrated program leadership and strategic impact. Industry recognition through research or speaking.	Advanced degree often expected, OR 10+ years of elite application security experience with demonstrated industry impact. Recognition is essential qualification.	Advanced degree often present, but industry recognition is primary qualification. 12+ years of elite experience with transformational impact.	Recognition is primary qualification. 15+ years with transformational impact. May be pioneers of major application security methodologies or tools.
Certifications	CompTIA Security+ GIAC Web Application Defender (GWEB) Certified Secure Software Lifecycle Professional (CSSLP) - in progress eWPT (eLearnSecurity Web Penetration Tester)	GIAC Web Application Penetration Tester (GWAPT) eWPT or eWPTX OSCP (helpful for offensive validation) CSSLP	GWAPT, GWEB OSWE (Offensive Security Web Expert) CSSLP Cloud security certifications	OSWE, OSCP GWAPT, GWEB CISSP or CSSLP Industry recognition may substitute	Certifications secondary to demonstrated expertise May be certification or framework contributors OWASP leadership or similar Industry awards and recognition	Certifications irrelevant at this level Known by reputation and body of work May have methodologies named after them	Certifications irrelevant at this level Known by reputation and legacy May have OWASP projects or methodologies named after them
Salary: US Gov't	$65,000 - $85,000 (GS-9 to GS-11)	$80,000 - $105,000 (GS-11 to GS-12)	$100,000 - $130,000 (GS-12 to GS-13)	$120,000 - $155,000 (GS-14 to GS-15)	$150,000 - $185,000 (GS-15 / SES equivalent)	$170,000 - $210,000 (Senior SES equivalent)	$185,000 - $230,000+ (Senior SES / Technical fellow equivalent)
Salary: US Startup	$75,000 - $100,000	$95,000 - $130,000	$125,000 - $165,000	$155,000 - $205,000 + equity	$190,000 - $260,000 + significant equity	$230,000 - $320,000 + major equity	$280,000 - $400,000+ + founder-level equity
Salary: US Corporate	$70,000 - $95,000	$90,000 - $120,000	$115,000 - $155,000	$145,000 - $190,000	$180,000 - $240,000	$215,000 - $290,000	$260,000 - $360,000+

↑ Back to navigation

AppSec Architect

Strategic technical leaders who design secure application architectures, develop security standards, and build frameworks for secure software development. Focus on threat modeling, secure design patterns, SSDLC program development, and enterprise-wide application security strategy. Enable development organizations to build security into applications from design through deployment.

Attribute	Architect 1 / Entry	Architect 2 / Junior	Architect 3 / Mid	Architect 4 / Senior / Lead	Architect 5 / Staff	Architect 6 / Senior Staff	Architect 7 / Principal
General Description	Entry-level AppSec architect learning secure design principles and application security architecture. Assists with threat modeling, security design reviews, and documentation. Develops foundational understanding of secure architecture patterns, SSDLC frameworks, and application security standards.	Junior AppSec architect capable of contributing to secure design work and conducting threat modeling with guidance. Demonstrates proficiency in security architecture patterns and can participate in design reviews. Understands the importance of enabling secure development without creating friction.	Experienced AppSec architect who independently leads secure design initiatives and threat modeling programs. Expert in security architecture patterns across multiple technology stacks. Develops security standards and frameworks that enable developers to build secure applications efficiently. Mentors junior architects and shapes organizational security design practices.	Senior AppSec architect who sets direction for enterprise application security architecture. Leads complex, high-impact architecture initiatives and serves as the escalation point for difficult design challenges. Drives security architecture strategy and builds frameworks that scale secure development across the organization.	Distinguished AppSec architect who defines organizational application security architecture vision and strategy. Recognized externally as industry expert in secure design, threat modeling, or SSDLC frameworks. Shapes how secure software architecture is practiced and drives innovation in security-by-design approaches.	Elite AppSec architect with industry-defining influence in application security architecture and secure design. Operates at the intersection of deep architectural expertise and organizational strategy. Shapes not only practice direction but industry approaches to building secure software at scale.	Legendary practitioner at the pinnacle of application security architecture expertise. Globally recognized authority who defines how the industry approaches secure software design, SSDLC, and security-by-design. Combines unparalleled architectural depth with strategic vision and transformational leadership.
Primary Responsibilities	Assist with threat modeling documentation Learn secure design patterns and anti-patterns Support security design review activities Document security architecture decisions Research secure development frameworks Assist with security standards documentation Learn application security architecture concepts Shadow senior architects on design reviews	Conduct threat modeling sessions with support Contribute to security architecture designs Perform security design reviews Develop secure design patterns and templates Create security architecture documentation Support SSDLC framework development Assess third-party and API integrations Contribute to security standards development Support developer education on secure design	Lead threat modeling programs and complex sessions Design security architecture for critical applications Develop enterprise secure design standards Create reusable security architecture patterns Build SSDLC frameworks and processes Mentor junior AppSec architects Evaluate and recommend security technologies Lead security architecture reviews Develop security champion technical training Support secure by design initiatives	Define enterprise AppSec architecture strategy Lead complex, enterprise-wide architecture initiatives Develop organizational threat modeling programs Build security architecture governance frameworks Mentor and develop architecture team Present architecture strategy to executives Drive secure by design culture Evaluate emerging technologies and architectures Support M&A architecture due diligence Build strategic relationships with development leadership Contribute to industry architecture practices	Define application security architecture vision and strategy Lead architecture innovation and research Develop next-generation secure design frameworks Build strategic architecture partnerships Guide organizational security transformation Create thought leadership content Represent organization in industry forums Advise executive leadership on architecture strategy Shape industry architecture standards	Set multi-year vision for enterprise application security architecture Lead transformational architecture initiatives Shape industry secure design standards Build strategic technology alliances Influence platform and vendor security roadmaps Guide organizational transformation Serve as ultimate architecture authority	Define industry direction for application security architecture Lead transformational multi-year initiatives Serve as ultimate architecture authority Shape secure development standards globally Build lasting architecture contributions Guide organizational and industry transformation Represent organization at highest levels globally Influence regulatory and standards bodies
Required Skills	Understanding of software architecture principles Knowledge of common security design patterns Familiarity with threat modeling concepts Understanding of authentication and authorization architectures Basic knowledge of cryptography applications Documentation and diagramming skills Software development background	Threat modeling methodologies (STRIDE, PASTA, etc.) Secure design patterns and principles Authentication and authorization architecture API security design Cloud security architecture fundamentals Data protection and privacy architecture Security standards development Developer-friendly communication	Expert threat modeling and risk assessment Advanced security architecture design Cloud-native security architecture Zero trust architecture implementation Identity and access management architecture Security standards and framework development Strategic planning and roadmapping Executive communication	Mastery of application security architecture Enterprise architecture strategy Team leadership and development Strategic planning and governance Executive communication and influence Vendor and technology evaluation Cross-functional collaboration Change management	World-class application security architecture expertise Strategic vision and leadership Executive and board-level communication Industry influence and recognition Innovation and framework development Cross-organizational leadership	Elite application security architecture expertise Transformational leadership and vision Executive and board-level influence Industry-shaping thought leadership Business strategy and technology alignment Innovation leadership	Globally recognized architecture expertise Transformational leadership and vision Executive and board-level influence Industry-shaping thought leadership Strategic business impact
Preferred Skills	Experience as software developer or architect Cloud architecture fundamentals API design experience Microservices architecture exposure TOGAF or other EA framework basics	Microservices security patterns Zero trust architecture concepts Identity architecture Container and Kubernetes security design Regulatory compliance mapping	Enterprise architecture frameworks Security architecture frameworks (SABSA) Published architecture work Regulatory and compliance architecture M&A security architecture	Industry thought leadership Published architecture frameworks Board-level communication Architecture practice development Standards body participation	Published architecture frameworks OWASP architecture project leadership Standards body participation Advisory board roles Academic affiliations	Major framework or methodology creator Vendor advisory roles Published books on secure architecture Academic appointments	Founded architecture frameworks or methodologies Government or regulatory advisory Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior AppSec architects. Shadows on threat modeling and design reviews. Expected to complete secure architecture training. Learns to balance security with developer experience.	Receives guidance from Senior architects on complex designs. Expected to begin mentoring Entry-level team members. Contributes to architecture standards and patterns. Should be developing expertise in specific architecture domains.	Primary mentor for Junior and Entry architects. Leads architecture training and knowledge sharing. Expected to develop architecture patterns and standards. Establishes reputation as expert in specific architecture domains.	Primary mentor for Mid and Junior architects. Responsible for architecture team development. Creates architecture career paths and programs. Industry mentorship through community engagement.	Mentors Senior architects and emerging leaders. Shapes architecture career paths organization-wide. Industry-level mentorship through community engagement. Develops architecture thought leaders.	Develops organizational architecture leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to the field.	Develops organizational and industry architecture leadership pipeline. Mentors future industry leaders. Legacy-building through generational impact. May sponsor architecture education initiatives.
Impact Scope	Individual contributor on documentation and research. Impact limited to supporting architecture deliverables. Work is reviewed by senior architects. Contributes to architecture team effectiveness.	Directly contributes to secure design quality. Responsible for specific architecture components. Design decisions impact application security posture. Beginning to influence architecture standards.	Shapes security architecture for major applications and platforms. Standards and patterns improve organizational security posture. Influences technology strategy and investment. Developer enablement improves security culture.	Defines application security architecture for organization. Strategic decisions impact long-term security posture. Team development impacts organizational maturity. Architecture standards enable secure development at scale.	Organizational and industry-level impact. Defines how application security architecture is practiced. Shapes organizational security transformation. Influences industry standards and practices.	Industry-defining architecture impact. Organizational competitive differentiation through secure design practices. Multi-year strategic transformation. Shapes how secure software is designed.	Global industry architecture impact. Defines how secure software is designed. Organizational transformation and long-term success. Creates lasting contributions to the profession.
Autonomy & Decision Authority	Works under close supervision. Follows established architecture standards and templates. Limited authority to make design decisions independently. Escalates architecture questions to senior team.	Works with moderate supervision. Can make design decisions within defined scope. Authority to approve standard patterns. Escalates novel or high-risk design decisions.	Works independently with strategic guidance. Makes significant architecture and design decisions. Authority over security standards and patterns. Consulted on major technology and security decisions.	High autonomy with strategic alignment. Makes significant architecture and strategy decisions. Authority over architecture standards and governance. Trusted to represent organization on architecture matters.	Near-complete architecture autonomy. Strategic decision-making authority. Influences organizational direction. Authority over architecture vision. Trusted advisor to executive leadership.	Full autonomy over architecture strategic domain. Executive-level decision authority. May have significant investment authority. Shapes organizational direction.	Complete autonomy over architecture domain. Executive-level decision authority. Shapes organizational and industry direction. May have significant influence over standards and regulations.
Communication & Stakeholders	Primarily internal communication with architecture team. Documents findings and research. Participates in design review meetings as observer. Limited stakeholder interaction outside immediate team.	Regular interaction with development teams and architects. Presents design recommendations. Participates in architecture review boards. Documents designs for developer consumption.	Regular communication with development and security leadership. Presents to executive stakeholders. Engages with enterprise architecture. Documents standards for organization.	Executive-level communication on architecture strategy. Presents to steering committees and governance boards. Represents architecture to organizational leadership. Builds relationships with industry peers.	C-suite and board-level engagement. Industry-wide influence through publications. Standards body and industry forum participation. Media and analyst engagement.	Peer engagement with executives and CTOs. Industry-defining thought leadership. Media and public presence. Board-level engagement.	Global industry presence. Regulatory and government engagement. Media thought leadership. Premier industry and academic venues.
Degree / Experience	Bachelor's degree in Computer Science, Software Engineering, or related field, OR 3-4 years of software development experience with security exposure. Understanding of application architecture concepts.	Bachelor's degree in Computer Science, Software Engineering, or related field, OR 4-6 years of software architecture or application security experience. Demonstrated ability to contribute to secure designs.	Bachelor's degree in relevant field with strong experience, OR Master's degree with moderate experience, OR 6-8 years of application security architecture experience. Demonstrated track record of successful architecture initiatives.	Master's degree preferred, OR Bachelor's with 8-12 years of application security architecture experience. Demonstrated strategic impact and team leadership. Industry recognition through publications or speaking.	Master's degree or higher often expected, OR 12+ years of application security architecture experience with demonstrated industry impact. Industry recognition is essential qualification.	Advanced degree often present, but industry recognition is primary qualification. 14+ years of elite experience with transformational impact.	Advanced degree often present, but industry recognition is primary qualification. 15+ years of elite experience with transformational impact. May be founders of major secure design frameworks or methodologies.
Certifications	CSSLP GWEB Cloud architecture certifications TOGAF Foundation	CSSLP GWEB Cloud security architecture certifications SABSA Foundation	CSSLP SABSA Chartered Architect CISSP-ISSAP Cloud architect certifications	CISSP-ISSAP SABSA Chartered Master Industry recognition may substitute Enterprise architecture certifications	Multiple advanced architecture certifications Industry recognition supersedes certifications Published frameworks or methods Standards body participation	Certifications irrelevant at this level Known by reputation and body of work May have frameworks named after them	Certifications irrelevant at this level Known by reputation and body of work May have frameworks or methods named after them Industry hall of fame recognition
Salary: US Gov't	$85,000 - $110,000 (GS-11 to GS-12)	$100,000 - $130,000 (GS-12 to GS-13)	$120,000 - $155,000 (GS-13 to GS-14)	$145,000 - $180,000 (GS-14 to GS-15)	$170,000 - $215,000 (GS-15 / SES equivalent)	$190,000 - $240,000 (Senior SES equivalent)	$210,000 - $270,000+ (Senior SES equivalent)
Salary: US Startup	$100,000 - $135,000	$120,000 - $160,000	$150,000 - $200,000	$185,000 - $250,000 + equity	$220,000 - $300,000 + significant equity	$270,000 - $370,000 + major equity	$320,000 - $450,000+ + major equity
Salary: US Corporate	$95,000 - $125,000	$115,000 - $150,000	$140,000 - $185,000	$175,000 - $230,000	$210,000 - $280,000	$250,000 - $340,000	$300,000 - $400,000+

↑ Back to navigation

Cloud Security Engineer

Technical professionals who implement, configure, and maintain security controls in cloud environments. Focus on IAM, network security, CSPM/CWPP tooling, container and Kubernetes security, and infrastructure as code security. Combine deep platform expertise with automation skills to secure cloud workloads at scale. Prioritize enablement over blocking, helping organizations adopt cloud securely rather than slowing them down.

Attribute	Eng 1 / Entry	Eng 2 / Junior	Eng 3 / Mid	Eng 4 / Senior / Lead	Eng 5 / Staff	Eng 6 / Senior Staff	Eng 7 / Principal
General Description	Entry-level cloud security engineer learning cloud security fundamentals and platform-specific controls. Assists with security configurations, policy implementation, and monitoring. Develops foundational understanding of shared responsibility, IAM, network security, and cloud-native security services in one major cloud platform.	Junior cloud security engineer capable of independently implementing security controls and managing cloud security tooling. Demonstrates proficiency in one major cloud platform with developing knowledge of another. Can configure IAM policies, network security, and operate CSPM/CWPP tools effectively.	Experienced cloud security engineer who independently designs and implements comprehensive cloud security solutions. Deep expertise in primary platform with working knowledge of another. Expert in IAM, network security, container security, and security automation. Leads cloud security initiatives, mentors junior engineers, and partners with DevOps teams to enable secure cloud adoption.	Senior cloud security engineer and team leader who defines cloud security strategy and leads high-impact initiatives. Multi-cloud expertise with deep knowledge across platforms. Champions automation-first approaches and builds security programs that enable rather than block cloud adoption. Represents cloud security to executive stakeholders and drives organizational cloud security maturity.	Distinguished cloud security engineer who shapes organizational and industry approaches to cloud security. Recognized externally as thought leader in cloud-native security, multi-cloud architecture, or DevSecOps. Drives innovation in cloud security automation, tooling, and enabling secure cloud adoption at enterprise scale.	Elite cloud security engineer with industry-defining influence in cloud security and DevSecOps. Operates at the intersection of deep technical expertise and organizational strategy. Shapes not only practice direction but industry approaches to securing cloud infrastructure at scale.	Legendary practitioner at the pinnacle of cloud security expertise. Globally recognized authority who defines how the industry approaches cloud security, DevSecOps, and securing cloud-native infrastructure. Combines unparalleled technical expertise with strategic vision.
Primary Responsibilities	Assist with cloud security configurations and policies Learn IAM fundamentals and access management Support security group and network policy management Monitor cloud security alerts and findings Document cloud security configurations Assist with CSPM tool operation and triage Learn infrastructure as code security basics Shadow senior engineers on security implementations	Implement IAM policies and access controls Configure cloud network security (security groups, NACLs, firewalls) Operate and tune CSPM tools (Prisma Cloud, Wiz, etc.) Develop security baselines and hardening guides Review and remediate cloud security findings Support container and Kubernetes security basics Implement infrastructure as code security scanning Assist with cloud security incident response Contribute to security automation development	Design and implement cloud security architectures Develop advanced IAM strategies and policies Lead container and Kubernetes security implementations Build cloud security automation and pipelines Implement cloud-native security services Mentor junior cloud security engineers Lead cloud security assessments and reviews Develop security guardrails for cloud platforms Partner with DevOps on secure pipeline development Evaluate and implement CSPM/CWPP solutions	Define cloud security engineering strategy and roadmap Lead multi-cloud security architecture implementations Build enterprise cloud security automation frameworks Develop cloud security guardrails and landing zones Mentor and develop cloud security engineering team Present cloud security posture to executives Drive adoption of cloud-native security services Evaluate and select cloud security platforms Lead cloud security incident response for major events Support M&A cloud security due diligence Contribute to thought leadership (blogs, talks, tools)	Define multi-year cloud security strategy and vision Lead industry-impacting research and tool development Build strategic relationships with cloud providers Develop next-generation cloud security capabilities Represent organization at highest industry levels Guide organizational investments in cloud security Shape industry standards and practices Advise executive leadership on cloud risk strategy	Set multi-year vision for enterprise cloud security Lead transformational methodology development Build strategic alliances with CSPs and vendors Influence industry standards and frameworks Develop next-generation cloud security approaches Guide organizational strategy alongside executive leadership Represent organization as premier thought leader	Define industry direction for cloud security Lead transformational multi-year initiatives Serve as ultimate strategic authority Shape CSP security roadmaps and standards Build generational capabilities and methodologies Guide organizational transformation Represent organization at highest levels globally
Required Skills	Understanding of one major cloud platform (AWS, Azure, or GCP) Basic knowledge of cloud IAM concepts Familiarity with cloud networking (VPCs, security groups) Understanding of shared responsibility model Basic scripting ability (Python, Bash) Familiarity with infrastructure as code concepts Documentation and communication skills	Proficiency in one major cloud platform security IAM policy development and least privilege Cloud network security configuration CSPM/CWPP tool operation and triage Infrastructure as code (Terraform, CloudFormation) Scripting for automation (Python, Go) Container security fundamentals Understanding of cloud logging and monitoring	Expert-level security in primary cloud platform Working knowledge of second cloud platform Advanced IAM and identity federation Kubernetes security and service mesh Security automation and GitOps Infrastructure as code security at scale Cloud security architecture patterns Strong programming skills for tooling	Multi-cloud security expertise (AWS, Azure, GCP) Enterprise cloud security architecture Strategic program development and leadership Executive communication and influence Team leadership and development Vendor evaluation and management Cloud security automation at scale Identity architecture and zero trust	World-class cloud security expertise Strategic practice leadership Executive presence and influence Industry-wide recognition and relationships Innovation and capability development Cross-functional leadership	Elite cloud security and DevSecOps expertise Transformational leadership Executive and board-level communication Industry-shaping influence and relationships Business strategy and risk quantification Innovation leadership	Globally recognized expertise Transformational strategic vision Executive and government-level influence Industry-defining thought leadership Strategic business development
Preferred Skills	Cloud platform certification (Associate level) Exposure to Terraform or CloudFormation Container basics (Docker) Linux system administration Basic understanding of CI/CD pipelines	Working knowledge of second cloud platform Kubernetes security basics CI/CD pipeline security Secrets management tools Cloud-native security services	Multi-cloud security experience Serverless security Cloud security tool development Zero trust implementation in cloud Published cloud security research	Published cloud security research or tools Conference speaking experience Open-source cloud security contributions Cloud security product development Startup or consulting experience	Published cloud security research or frameworks CSP advisory or partnership roles Major open-source cloud security tools Industry working group participation	Major framework or tool creator CSP advisory board participation Published books on cloud security Academic appointments	Founded significant cloud security tools or companies Government or regulatory advisory Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior cloud security engineers. Shadows on security implementations and reviews. Expected to achieve cloud platform certification within first 6 months. Learns enablement-focused philosophy of accelerating secure cloud adoption.	Receives guidance from Senior engineers on complex implementations. Expected to begin mentoring Entry-level engineers informally. Contributes to documentation and procedures. Should be developing deep expertise in primary platform.	Primary mentor for Junior and Entry engineers. Leads training on cloud security practices. Expected to develop team procedures and automation. Establishes reputation as expert in specific cloud security domains.	Primary mentor for Mid and Junior engineers. Responsible for team career development. Creates cloud security training programs. Industry mentorship through community engagement. Shapes cloud security engineering practices.	Mentors Senior engineers and emerging leaders. Shapes organizational cloud security talent strategy. Industry-level mentorship through community engagement. Develops thought leaders in the space.	Develops organizational leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to the field.	Develops organizational and industry leadership. Mentors future industry leaders. Legacy-building through generational impact. May fund or sponsor research initiatives.
Impact Scope	Individual contributor on assigned configuration tasks. Impact limited to supporting security operations. Work is reviewed before implementation. Supports overall cloud security coverage.	Directly implements security controls protecting cloud workloads. Responsible for configuration accuracy and policy effectiveness. Beginning to influence cloud security practices.	Shapes cloud security practices for organization. Security implementations directly impact cloud posture. Automation improves team efficiency. Enables secure cloud adoption at scale.	Defines cloud security capabilities and strategic direction. Program effectiveness directly impacts organizational cloud posture. Team development impacts security maturity. Executive relationships enable security investment.	Industry and organizational transformation. Shapes how cloud security is practiced. Multi-year strategic outcomes. Influences CSP security roadmaps.	Industry-defining impact. Organizational competitive differentiation through cloud security capabilities. Multi-year strategic transformation. Shapes how cloud security is practiced.	Global industry impact. Defines how cloud security is practiced. Organizational transformation. Lasting contributions to securing cloud infrastructure.
Autonomy & Decision Authority	Works under close supervision. Follows established procedures and security baselines. Limited authority to make configuration changes independently. Escalates security decisions to senior engineers.	Works with moderate supervision. Can make routine security configuration decisions. Authority to implement approved baselines. Escalates architectural changes and exceptions.	Works independently with strategic guidance. Makes significant security design decisions. Authority over security tooling and automation. Consulted on cloud security architecture decisions.	High autonomy with strategic alignment. Makes significant program and investment decisions. Authority over cloud security standards and tooling. Trusted to represent organization externally.	Near-complete autonomy over domain. Strategic influence on organizational direction. Shapes investment and capability priorities. Makes decisions with significant organizational impact.	Full autonomy over strategic domain. Executive-level decision authority. May have significant budget authority. Shapes organizational direction.	Complete strategic autonomy. Executive-level authority. Shapes organizational strategy. May have significant influence over industry direction.
Communication & Stakeholders	Primarily internal communication with cloud security team. Documents configurations and procedures. Limited direct interaction with cloud platform teams initially.	Regular interaction with cloud platform and DevOps teams. Participates in security reviews. Documents findings and recommendations for stakeholders.	Regular communication with cloud platform and security leadership. Presents to technical and management audiences. Primary cloud security contact for assigned platforms or projects.	Executive-level communication on cloud security. Represents cloud security to organizational leadership. Industry conference presentations. Builds relationships with CSP security teams.	C-suite engagement on cloud risk strategy. Industry-wide influence through publications and speaking. CSP executive relationships. Media and analyst engagement.	Peer engagement with executives and CISOs. Industry-defining thought leadership. Media and public presence. Board-level engagement.	Global presence. Government and international engagement. Media thought leadership. Premier industry venues.
Degree / Experience	Bachelor's degree in Computer Science, IT, Cybersecurity, or related field, OR 1-2 years of cloud operations or IT experience, OR completion of cloud security training program.	Bachelor's degree in relevant field, OR 2-4 years of cloud security or cloud engineering experience. Demonstrated ability to implement cloud security controls.	Bachelor's degree in relevant field, OR 4-6 years of cloud security experience. Demonstrated track record of complex cloud security implementations. May have Master's degree with less experience.	Bachelor's or Master's degree in relevant field, OR 6-10 years of cloud security experience. Demonstrated program leadership and strategic impact. Industry recognition through research or speaking.	Advanced degree often expected, OR 10+ years of elite cloud security experience with demonstrated industry impact. Recognition is essential qualification.	Advanced degree often present, but industry recognition is primary qualification. 12+ years of elite experience with transformational impact.	Recognition is primary qualification. 15+ years with transformational impact. May be pioneers of major cloud security tools or methodologies.
Certifications	AWS Solutions Architect Associate or equivalent CompTIA Security+ CompTIA Cloud+ AZ-900 / AWS Cloud Practitioner	AWS Security Specialty or equivalent CKS (Certified Kubernetes Security Specialist) Platform-specific security certifications HashiCorp Terraform Associate	AWS Security Specialty + another platform cert CKS CCSP Advanced platform certifications	Multiple cloud security specialty certifications CCSP CISSP Industry recognition may substitute	Certifications secondary to demonstrated expertise May be certification or framework contributors Industry awards and recognition Published research and tools	Certifications irrelevant at this level Known by reputation and body of work May have tools or methodologies named after them	Certifications irrelevant at this level Known by reputation and legacy May have tools or frameworks named after them
Salary: US Gov't	$65,000 - $85,000 (GS-9 to GS-11)	$80,000 - $110,000 (GS-11 to GS-12)	$105,000 - $140,000 (GS-12 to GS-13)	$130,000 - $165,000 (GS-14 to GS-15)	$155,000 - $195,000 (GS-15 / SES equivalent)	$175,000 - $220,000 (Senior SES equivalent)	$195,000 - $250,000+ (Senior SES / Technical fellow equivalent)
Salary: US Startup	$80,000 - $105,000	$100,000 - $140,000	$135,000 - $180,000	$170,000 - $225,000 + equity	$210,000 - $285,000 + significant equity	$250,000 - $340,000 + major equity	$300,000 - $420,000+ + founder-level equity
Salary: US Corporate	$75,000 - $100,000	$95,000 - $130,000	$125,000 - $165,000	$160,000 - $210,000	$195,000 - $260,000	$235,000 - $310,000	$280,000 - $380,000+

↑ Back to navigation

Cloud Security Architect

Strategic technical leaders who design cloud security architectures, develop security frameworks, and build strategies for securing cloud infrastructure at enterprise scale. Focus on landing zone design, multi-cloud strategy, zero trust architecture, and enabling secure cloud adoption. Partner with enterprise architecture and cloud platform teams to embed security into cloud foundations.

Attribute	Architect 1 / Entry	Architect 2 / Junior	Architect 3 / Mid	Architect 4 / Senior / Lead	Architect 5 / Staff	Architect 6 / Senior Staff	Architect 7 / Principal
General Description	Entry-level cloud security architect learning cloud security architecture principles and framework development. Assists with security design reviews, documentation, and reference architecture development. Develops foundational understanding of cloud security patterns, shared responsibility implementation, and enterprise cloud strategy.	Junior cloud security architect capable of contributing to security design work and conducting architecture reviews with guidance. Demonstrates proficiency in cloud security patterns and can participate in landing zone and security framework development. Understands the importance of enabling secure cloud adoption.	Experienced cloud security architect who independently leads cloud security design initiatives and develops enterprise security frameworks. Expert in multi-cloud security patterns with deep knowledge of landing zones, identity architecture, and zero trust implementation. Mentors junior architects and shapes organizational cloud security architecture practices.	Senior cloud security architect who sets direction for enterprise cloud security architecture. Leads complex, high-impact architecture initiatives across multi-cloud environments. Drives cloud security strategy and builds frameworks that enable secure cloud adoption at enterprise scale. Represents cloud security architecture to executive stakeholders.	Distinguished cloud security architect who defines organizational cloud security architecture vision and strategy. Recognized externally as industry expert in cloud security architecture, multi-cloud strategy, or zero trust. Shapes how cloud security architecture is practiced and drives innovation in securing cloud infrastructure at scale.	Elite cloud security architect with industry-defining influence in cloud security architecture and strategy. Operates at the intersection of deep architectural expertise and organizational strategy. Shapes not only practice direction but industry approaches to securing cloud infrastructure at enterprise scale.	Legendary practitioner at the pinnacle of cloud security architecture expertise. Globally recognized authority who defines how the industry approaches cloud security architecture, multi-cloud strategy, and securing cloud-native infrastructure. Combines unparalleled architectural depth with strategic vision and transformational leadership.
Primary Responsibilities	Assist with cloud security architecture documentation Learn cloud security design patterns and anti-patterns Support security design review activities Research cloud security frameworks and standards Document security architecture decisions Assist with landing zone security documentation Learn multi-cloud security concepts Shadow senior architects on design reviews	Contribute to cloud security architecture designs Conduct security architecture reviews Develop cloud security reference architectures Support landing zone security design Create security architecture documentation Assess cloud security tool architectures Support multi-cloud security strategy development Contribute to cloud security standards Participate in enterprise architecture reviews	Lead cloud security architecture design initiatives Design enterprise landing zone security Develop multi-cloud security frameworks Create cloud security reference architectures Build zero trust architecture for cloud Mentor junior cloud security architects Lead cloud security architecture reviews Develop cloud security standards and patterns Support cloud security transformation initiatives Evaluate cloud security platform architectures	Define enterprise cloud security architecture strategy Lead complex, multi-cloud architecture initiatives Develop organizational cloud security frameworks Build cloud security architecture governance Mentor and develop architecture team Present architecture strategy to executives Drive cloud security transformation programs Evaluate emerging cloud technologies and architectures Support M&A cloud architecture due diligence Build strategic relationships with CSPs Contribute to industry architecture practices	Define cloud security architecture vision and strategy Lead architecture innovation and research Develop next-generation cloud security frameworks Build strategic CSP architecture partnerships Guide organizational cloud transformation Create thought leadership content Represent organization in industry forums Advise executive leadership on cloud architecture strategy Shape industry architecture standards	Set multi-year vision for enterprise cloud security architecture Lead transformational architecture initiatives Shape industry cloud security standards Build strategic CSP and technology alliances Influence CSP security roadmaps Guide organizational transformation Serve as ultimate architecture authority	Define industry direction for cloud security architecture Lead transformational multi-year initiatives Serve as ultimate architecture authority Shape CSP security strategies globally Build lasting architecture contributions Guide organizational and industry transformation Represent organization at highest levels globally Influence regulatory and standards bodies
Required Skills	Understanding of cloud architecture principles Knowledge of cloud security design patterns Familiarity with shared responsibility model Basic understanding of IAM architecture Cloud networking concepts Documentation and diagramming skills Understanding of one major cloud platform	Cloud security architecture patterns Landing zone and account strategy design IAM architecture and identity federation Cloud network security architecture Security framework development Multi-cloud concepts Zero trust principles in cloud Architecture documentation and communication	Expert cloud security architecture design Multi-cloud security strategy Landing zone and account architecture Zero trust architecture implementation Identity and access management architecture Cloud security framework development Strategic planning and roadmapping Executive communication	Mastery of cloud security architecture Enterprise architecture strategy Team leadership and development Strategic planning and governance Executive communication and influence CSP relationship management Cross-functional collaboration Change management	World-class cloud security architecture expertise Strategic vision and leadership Executive and board-level communication Industry influence and recognition Innovation and framework development Cross-organizational leadership	Elite cloud security architecture expertise Transformational leadership and vision Executive and board-level influence Industry-shaping thought leadership Business strategy and technology alignment Innovation leadership	Globally recognized architecture expertise Transformational leadership and vision Executive and board-level influence Industry-shaping thought leadership Strategic business impact
Preferred Skills	Cloud platform certification Enterprise architecture exposure Infrastructure as code experience TOGAF or cloud framework basics Prior cloud engineering experience	Working knowledge of multiple clouds Container and Kubernetes architecture Data security architecture Compliance architecture mapping Enterprise architecture frameworks	Enterprise architecture frameworks Cloud security architecture frameworks Published architecture work Regulatory compliance architecture M&A cloud security architecture	Industry thought leadership Published architecture frameworks Board-level communication CSP advisory participation Standards body participation	Published architecture frameworks CSP advisory board participation Standards body leadership Advisory board roles Academic affiliations	Major framework or methodology creator CSP advisory board leadership Published books on cloud security Academic appointments	Founded architecture frameworks or methodologies Government or regulatory advisory Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior cloud security architects. Shadows on architecture reviews and design sessions. Expected to complete cloud architecture training. Learns to balance security with cloud adoption enablement.	Receives guidance from Senior architects on complex designs. Expected to begin mentoring Entry-level team members. Contributes to architecture standards and patterns. Should be developing expertise in specific cloud security domains.	Primary mentor for Junior and Entry architects. Leads architecture training and knowledge sharing. Expected to develop architecture patterns and standards. Establishes reputation as expert in specific cloud security domains.	Primary mentor for Mid and Junior architects. Responsible for architecture team development. Creates architecture career paths and programs. Industry mentorship through community engagement.	Mentors Senior architects and emerging leaders. Shapes architecture career paths organization-wide. Industry-level mentorship through community engagement. Develops architecture thought leaders.	Develops organizational architecture leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to the field.	Develops organizational and industry architecture leadership pipeline. Mentors future industry leaders. Legacy-building through generational impact. May sponsor architecture education initiatives.
Impact Scope	Individual contributor on documentation and research. Impact limited to supporting architecture deliverables. Work is reviewed by senior architects. Contributes to architecture team effectiveness.	Directly contributes to security design quality. Responsible for specific architecture components. Design decisions impact cloud security posture. Beginning to influence architecture standards.	Shapes cloud security architecture for major initiatives. Standards and patterns improve organizational cloud security posture. Influences technology strategy and investment. Enables secure cloud adoption at scale.	Defines cloud security architecture for organization. Strategic decisions impact long-term cloud security posture. Team development impacts organizational maturity. Architecture standards enable secure cloud at scale.	Organizational and industry-level impact. Defines how cloud security architecture is practiced. Shapes organizational cloud transformation. Influences industry standards and CSP roadmaps.	Industry-defining architecture impact. Organizational competitive differentiation through cloud security architecture. Multi-year strategic transformation. Shapes how cloud security is designed.	Global industry architecture impact. Defines how cloud security is designed. Organizational transformation and long-term success. Creates lasting contributions to the profession.
Autonomy & Decision Authority	Works under close supervision. Follows established architecture standards and templates. Limited authority to make design decisions independently. Escalates architecture questions to senior team.	Works with moderate supervision. Can make design decisions within defined scope. Authority to approve standard patterns. Escalates novel or high-risk design decisions.	Works independently with strategic guidance. Makes significant architecture and design decisions. Authority over cloud security standards and patterns. Consulted on major technology and cloud security decisions.	High autonomy with strategic alignment. Makes significant architecture and strategy decisions. Authority over architecture standards and governance. Trusted to represent organization on architecture matters.	Near-complete architecture autonomy. Strategic decision-making authority. Influences organizational direction. Authority over architecture vision. Trusted advisor to executive leadership.	Full autonomy over architecture strategic domain. Executive-level decision authority. May have significant investment authority. Shapes organizational direction.	Complete autonomy over architecture domain. Executive-level decision authority. Shapes organizational and industry direction. May have significant influence over standards and CSP roadmaps.
Communication & Stakeholders	Primarily internal communication with architecture team. Documents findings and research. Participates in design review meetings as observer. Limited stakeholder interaction outside immediate team.	Regular interaction with cloud platform and enterprise architecture teams. Presents design recommendations. Participates in architecture review boards. Documents designs for stakeholder consumption.	Regular communication with cloud platform and security leadership. Presents to executive stakeholders. Engages with enterprise architecture. Documents standards for organization.	Executive-level communication on architecture strategy. Presents to steering committees and governance boards. Represents architecture to organizational leadership. Builds relationships with CSP architecture teams.	C-suite and board-level engagement. Industry-wide influence through publications. Standards body and industry forum participation. Media and analyst engagement.	Peer engagement with executives and CTOs. Industry-defining thought leadership. Media and public presence. Board-level engagement.	Global industry presence. Regulatory and government engagement. Media thought leadership. Premier industry and academic venues.
Degree / Experience	Bachelor's degree in Computer Science, IT, or related field, OR 3-4 years of cloud engineering or architecture experience with security exposure. Understanding of cloud architecture concepts.	Bachelor's degree in relevant field, OR 4-6 years of cloud architecture or security experience. Demonstrated ability to contribute to cloud security designs.	Bachelor's degree with strong experience, OR Master's degree with moderate experience, OR 6-8 years of cloud security architecture experience. Demonstrated track record of successful architecture initiatives.	Master's degree preferred, OR Bachelor's with 8-12 years of cloud security architecture experience. Demonstrated strategic impact and team leadership. Industry recognition through publications or speaking.	Master's degree or higher often expected, OR 12+ years of cloud security architecture experience with demonstrated industry impact. Industry recognition is essential qualification.	Advanced degree often present, but industry recognition is primary qualification. 14+ years of elite experience with transformational impact.	Advanced degree often present, but industry recognition is primary qualification. 15+ years of elite experience with transformational impact. May be founders of major cloud security frameworks or methodologies.
Certifications	AWS Solutions Architect Professional or equivalent CCSP (in progress acceptable) Cloud platform security certifications TOGAF Foundation	CCSP Multiple cloud platform certifications SABSA Foundation TOGAF Certified	CCSP CISSP-ISSAP Multiple cloud platform professional certs SABSA Chartered Architect	CCSP, CISSP-ISSAP SABSA Chartered Master Industry recognition may substitute Enterprise architecture certifications	Multiple advanced architecture certifications Industry recognition supersedes certifications Published frameworks or methods Standards body participation	Certifications irrelevant at this level Known by reputation and body of work May have frameworks named after them	Certifications irrelevant at this level Known by reputation and body of work May have frameworks or methods named after them Industry hall of fame recognition
Salary: US Gov't	$90,000 - $115,000 (GS-11 to GS-12)	$110,000 - $140,000 (GS-12 to GS-13)	$130,000 - $165,000 (GS-13 to GS-14)	$155,000 - $195,000 (GS-14 to GS-15)	$180,000 - $230,000 (GS-15 / SES equivalent)	$205,000 - $260,000 (Senior SES equivalent)	$230,000 - $300,000+ (Senior SES equivalent)
Salary: US Startup	$110,000 - $145,000	$135,000 - $175,000	$165,000 - $220,000	$200,000 - $270,000 + equity	$245,000 - $330,000 + significant equity	$295,000 - $400,000 + major equity	$350,000 - $480,000+ + major equity
Salary: US Corporate	$105,000 - $135,000	$125,000 - $165,000	$155,000 - $200,000	$190,000 - $250,000	$230,000 - $300,000	$275,000 - $360,000	$320,000 - $430,000+

↑ Back to navigation

Forensic Analyst

Technical professionals who conduct digital forensic examinations to support incident response, insider threat investigations, HR matters, and legal proceedings. Focus on evidence acquisition, artifact analysis, timeline reconstruction, and producing court-ready documentation. Maintain strict chain of custody and apply scientific methodology to ensure defensible, reproducible findings. Corporate forensics teams are typically small, requiring practitioners to be versatile across disk, memory, mobile, and cloud forensics as they advance.

Attribute	Analyst 1 / Entry	Analyst 2 / Junior	Analyst 3 / Mid	Analyst 4 / Senior / Lead	Analyst 5 / Staff	Analyst 6 / Senior Staff	Analyst 7 / Principal
General Description	Entry-level forensic analyst learning digital forensics fundamentals and evidence handling procedures. Assists with evidence acquisition, basic analysis, and documentation under direct supervision. Develops foundational understanding of file systems, forensic artifacts, chain of custody requirements, and forensic tool operation. Focuses primarily on Windows disk forensics with exposure to other platforms.	Junior forensic analyst capable of independently conducting routine forensic examinations with guidance on complex matters. Demonstrates proficiency in Windows forensics and developing skills in memory analysis. Can perform complete acquisitions, analyze common artifacts, and produce examination reports. Begins exposure to macOS and Linux forensics.	Experienced forensic analyst who independently conducts complex forensic examinations across multiple platforms. Expert in Windows forensics with strong capabilities in memory analysis, macOS, and developing Linux skills. Leads forensic support for major incidents and produces reports suitable for legal proceedings. May provide testimony in depositions or HR hearings. Begins developing mobile forensics capabilities.	Senior forensic analyst and team leader who defines forensic capabilities and leads high-profile investigations. Expert across disk, memory, mobile, and cloud forensics. Handles the most sensitive investigations including executive matters, major breaches, and cases with significant legal exposure. Provides expert testimony in legal proceedings. Represents forensics to executive stakeholders and external parties.	Distinguished forensic analyst who shapes organizational and industry forensic practices. Recognized externally as thought leader in digital forensics, incident response forensics, or emerging forensic domains. Handles investigations with existential organizational risk. Drives innovation in forensic methodology and tooling.	Elite forensic practitioner with industry-defining influence in digital forensics. Operates at the intersection of deep forensic expertise and organizational strategy. Shapes not only practice direction but industry approaches to digital investigations, evidence handling, and forensic methodology.	Legendary practitioner at the pinnacle of digital forensics expertise. Globally recognized authority who defines how the industry approaches digital investigations, evidence handling, and forensic science. Combines unparalleled technical expertise with strategic vision. May have pioneered forensic methodologies or tools used industry-wide.
Primary Responsibilities	Assist with forensic evidence acquisition and imaging Learn proper chain of custody procedures Perform basic file system analysis under guidance Document forensic activities and findings Maintain forensic workstation and tool updates Learn Windows artifact analysis fundamentals Assist with evidence storage and management Shadow senior analysts on examinations Support basic data recovery tasks	Conduct forensic acquisitions independently Perform Windows artifact analysis and timeline reconstruction Analyze memory captures for malware and artifacts Write forensic examination reports Support incident response with forensic analysis Maintain chain of custody documentation Perform basic malware triage Assist with HR and policy violation investigations Learn macOS and Linux forensic fundamentals Support eDiscovery collections when required	Lead complex forensic examinations end-to-end Conduct advanced memory and malware analysis Perform cross-platform forensics (Windows, macOS, Linux) Develop mobile device forensics capabilities Write reports for legal and executive audiences Provide forensic support for major incident response Mentor junior forensic analysts Develop and refine forensic procedures Coordinate with legal counsel on litigation holds Support law enforcement coordination when required Provide deposition or hearing testimony	Lead high-profile and sensitive investigations Define forensic program strategy and capabilities Conduct expert-level analysis across all platforms Provide expert witness testimony in legal proceedings Mentor and develop forensic analyst team Coordinate with law enforcement on criminal matters Lead forensic aspects of major incident response Manage relationships with external forensic vendors Present forensic findings to executives and board Develop forensic lab capabilities and architecture Support M&A due diligence forensic assessments Manage eDiscovery coordination for litigation	Define multi-year forensic strategy and vision Lead industry-impacting research and methodology development Handle investigations with critical organizational impact Build strategic relationships with law enforcement and regulators Develop next-generation forensic capabilities Represent organization at highest industry levels Guide organizational investments in forensic capabilities Shape industry forensic standards and practices Advise executive leadership on investigative matters	Set multi-year vision for enterprise forensic capabilities Lead transformational methodology development Build strategic alliances with law enforcement and industry Influence industry standards and legal frameworks Develop next-generation investigative approaches Guide organizational strategy alongside executive leadership Represent organization as premier forensic authority Advise on matters of national or industry significance	Define industry direction for digital forensics Lead transformational multi-year initiatives Serve as ultimate forensic authority Shape legal and regulatory frameworks for digital evidence Build generational capabilities and methodologies Guide organizational transformation Represent organization at highest levels globally Advise government and law enforcement at highest levels
Required Skills	Understanding of Windows file systems (NTFS, FAT) Basic knowledge of forensic imaging concepts Familiarity with forensic tools (EnCase, FTK, Autopsy) Understanding of chain of custody requirements Basic Windows artifact knowledge (Registry, Event Logs) Documentation and report writing skills Attention to detail and methodical approach	Proficiency in Windows forensic analysis Memory forensics fundamentals (Volatility) Timeline analysis and reconstruction Forensic report writing for technical audiences Understanding of anti-forensics techniques Basic malware triage and identification Multiple forensic tool proficiency Evidence handling and court requirements	Expert Windows forensic analysis Advanced memory forensics and malware analysis macOS forensic proficiency Linux forensics fundamentals Mobile forensics basics (iOS, Android) Legal-ready report writing Testimony and deposition preparation Advanced timeline and artifact correlation	Mastery of cross-platform forensics Mobile forensics expertise (iOS, Android) Cloud forensics proficiency (M365, Google, AWS, Azure) Expert witness testimony experience Strategic program development Executive communication and influence Team leadership and development Legal and regulatory coordination Law enforcement liaison experience	World-class forensic expertise across all platforms Strategic practice leadership Executive presence and influence Industry-wide recognition and relationships Innovation and methodology development Cross-functional leadership Expert testimony at highest levels	Elite forensic expertise across all domains Transformational leadership Executive and board-level communication Industry-shaping influence and relationships Legal and regulatory expertise Innovation leadership	Globally recognized forensic expertise Transformational strategic vision Executive and government-level influence Industry-defining thought leadership Legal and policy expertise
Preferred Skills	Exposure to Linux file systems Basic scripting ability (Python, PowerShell) Understanding of disk structures and partitioning Familiarity with hashing and integrity verification CTF or forensics challenge experience	macOS forensics basics Linux forensics basics Network forensics exposure Scripting for forensic automation eDiscovery tool familiarity	Cloud forensics fundamentals (M365, AWS) Network forensics and packet analysis Custom forensic tool development eDiscovery platform proficiency Malware reverse engineering basics	Published forensic research or tools Malware reverse engineering Forensic lab design and architecture eDiscovery program management Conference speaking experience	Published forensic research or frameworks Forensic tool or methodology development Law enforcement advisory relationships Academic affiliations or teaching Industry working group participation	Major methodology or tool creator Government or law enforcement advisory Published books on digital forensics Academic appointments	Founded significant forensic tools or methodologies Government advisory at national level Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior forensic analysts. Shadows on all examinations initially. Expected to complete forensic tool training and achieve foundational certification within first year. Learns the critical importance of evidence integrity and defensible processes.	Receives guidance from Senior analysts on complex cases. Expected to begin assisting Entry-level analysts. Contributes to procedure documentation. Should be developing expertise in specific artifact types or investigation categories.	Primary mentor for Junior and Entry analysts. Leads training on examination techniques. Expected to develop team procedures and playbooks. Establishes reputation as expert in specific forensic domains or investigation types.	Primary mentor for Mid and Junior analysts. Responsible for team career development. Creates forensic training programs and certification paths. Industry mentorship through community engagement. Shapes organizational forensic practices.	Mentors Senior analysts and emerging leaders. Shapes organizational forensic talent strategy. Industry-level mentorship through community engagement. Develops thought leaders in the forensics space.	Develops organizational leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to the field of digital forensics.	Develops organizational and industry leadership. Mentors future industry leaders. Legacy-building through generational impact on digital forensics. May fund or sponsor forensic research.
Impact Scope	Individual contributor on assigned acquisition and documentation tasks. Impact limited to supporting examination activities. All findings reviewed before inclusion in reports. Supports overall forensic team capacity.	Directly contributes to investigation outcomes. Responsible for accurate analysis and documentation. Reports may be used in HR actions or legal proceedings. Beginning to influence forensic procedures.	Shapes forensic practices for the organization. Complex examination findings directly impact legal outcomes and incident response. Procedural improvements enhance team capabilities. May influence security detection through forensic insights.	Defines forensic capabilities and strategic direction. Investigation outcomes directly impact organizational risk and legal exposure. Team development impacts security maturity. Expert testimony can determine case outcomes.	Industry and organizational transformation. Shapes how digital forensics is practiced. Multi-year strategic outcomes. Influences forensic tool development and standards.	Industry-defining impact. Organizational competitive differentiation through forensic capabilities. Multi-year strategic transformation. Shapes how digital forensics is practiced globally.	Global industry impact. Defines how digital forensics is practiced worldwide. Shapes legal frameworks for digital evidence. Creates lasting contributions to investigative science.
Autonomy & Decision Authority	Works under close supervision. Follows established forensic procedures strictly. No authority to make independent evidentiary decisions. Escalates all findings and anomalies to senior analysts.	Works with moderate supervision. Can make routine analytical decisions. Authority to conduct standard examinations independently. Escalates complex findings, legal matters, and scope decisions.	Works independently with strategic guidance. Makes significant analytical and procedural decisions. Authority over examination methodology. Consulted on case strategy and legal coordination.	High autonomy with strategic alignment. Makes significant program and investigation decisions. Authority over forensic standards and procedures. Trusted to handle the most sensitive matters independently.	Near-complete autonomy over domain. Strategic influence on organizational direction. Shapes investment and capability priorities. Makes decisions with significant organizational and legal impact.	Full autonomy over strategic domain. Executive-level decision authority. May have significant budget authority. Shapes organizational direction on investigative matters.	Complete strategic autonomy. Executive-level authority. Shapes organizational strategy. Significant influence over industry direction and legal standards.
Communication & Stakeholders	Primarily internal communication with forensic team. Documents activities in case management systems. Limited direct interaction with IR team or legal initially. May assist with evidence handoffs.	Regular interaction with IR team and security operations. Presents findings to technical audiences. Coordinates with HR on employee investigations. May interact with legal counsel on case requirements.	Regular communication with legal, HR, and security leadership. Presents findings to executive stakeholders. Primary forensic contact for IR team. Coordinates with external counsel on litigation matters. May interface with law enforcement.	Executive-level communication on investigations and capabilities. Represents forensics to legal leadership and external counsel. Coordinates with law enforcement agencies. May present to board on significant matters.	C-suite engagement on investigative strategy. Industry-wide influence through publications and speaking. Law enforcement and regulatory relationships. Media engagement on forensic matters.	Peer engagement with executives and general counsel. Industry-defining thought leadership. Media and public presence on forensic matters. Government and regulatory engagement.	Global presence. Government and international engagement. Media thought leadership. Premier industry and legal venues. Congressional or parliamentary testimony.
Degree / Experience	Bachelor's degree in Computer Science, Digital Forensics, Criminal Justice, or related field, OR 1-2 years of IT experience with forensics exposure, OR completion of digital forensics training program.	Bachelor's degree in relevant field, OR 2-4 years of digital forensics or IT security experience. Demonstrated ability to conduct forensic examinations and produce quality reports.	Bachelor's degree in relevant field, OR 4-6 years of digital forensics experience. Demonstrated track record of complex examinations and legal proceedings support. May have Master's degree with less experience.	Bachelor's or Master's degree in relevant field, OR 6-10 years of digital forensics experience. Demonstrated program leadership and expert testimony experience. Industry recognition through research or speaking.	Advanced degree often expected, OR 10+ years of elite forensic experience with demonstrated industry impact. Recognition is essential qualification.	Advanced degree often present, but industry recognition is primary qualification. 12+ years of elite experience with transformational impact.	Recognition is primary qualification. 15+ years with transformational impact. May be pioneers of foundational forensic methodologies or tools.
Certifications	CompTIA Security+ GIAC Certified Forensic Examiner (GCFE) EnCase Certified Examiner (EnCE) - in progress AccessData Certified Examiner (ACE)	GCFE or GCFA EnCE CFCE (Certified Forensic Computer Examiner) GIAC Certified Forensic Analyst (GCFA)	GCFA, GCFE EnCE GIAC Network Forensic Analyst (GNFA) Cellebrite Certified Operator (CCO) or similar mobile cert	Multiple GIAC forensics certifications EnCE, CCE, or equivalent Mobile forensics certifications Cloud platform certifications helpful	Certifications secondary to demonstrated expertise May be certification or methodology contributors Industry awards and recognition Expert witness credentials	Certifications irrelevant at this level Known by reputation and body of work May have methodologies named after them	Certifications irrelevant at this level Known by reputation and legacy May have tools or methodologies named after them
Salary: US Gov't	$55,000 - $75,000 (GS-7 to GS-9)	$70,000 - $95,000 (GS-9 to GS-11)	$90,000 - $120,000 (GS-11 to GS-13)	$115,000 - $150,000 (GS-13 to GS-14)	$140,000 - $175,000 (GS-15 / SES equivalent)	$165,000 - $210,000 (Senior SES equivalent)	$185,000 - $240,000+ (Senior SES / Technical fellow equivalent)
Salary: US Startup	$65,000 - $90,000	$85,000 - $115,000	$110,000 - $150,000	$145,000 - $195,000 + equity	$180,000 - $245,000 + significant equity	$220,000 - $300,000 + major equity	$270,000 - $380,000+ + founder-level equity
Salary: US Corporate	$60,000 - $85,000	$80,000 - $110,000	$105,000 - $140,000	$135,000 - $180,000	$170,000 - $230,000	$205,000 - $275,000	$250,000 - $340,000+

↑ Back to navigation

CTI Analyst

Intelligence professionals who produce actionable threat intelligence tailored to their organization's specific risk landscape. Focus on threat actor tracking, campaign analysis, and intelligence products (strategic, operational, tactical) that inform security decisions. Go beyond republishing external reports by correlating internal data sources to identify organization-specific threats—understanding who the real targets are based on access, exposure, and observed targeting patterns, not just titles. Intelligence serves decisions; if it doesn't inform action, it's just information.

Attribute	Analyst 1 / Entry	Analyst 2 / Junior	Analyst 3 / Mid	Analyst 4 / Senior / Lead	Analyst 5 / Staff	Analyst 6 / Senior Staff	Analyst 7 / Principal
General Description	Entry-level CTI analyst learning intelligence fundamentals and collection techniques. Assists with open-source intelligence gathering, indicator processing, and report development. Develops foundational understanding of threat actors, attack frameworks, and analytic tradecraft. Begins learning how to correlate external threats with internal organizational context.	Junior CTI analyst capable of independently producing tactical intelligence products and conducting structured analysis. Demonstrates proficiency in OSINT collection and threat actor research. Begins correlating external threat data with internal telemetry to identify organization-specific risks. Can produce indicator-focused intelligence and contribute to operational reporting.	Experienced CTI analyst who independently produces comprehensive intelligence assessments across strategic, operational, and tactical levels. Expert at correlating internal organizational data with external threat intelligence to identify true risk—understanding that the person with 80% of patent access who receives 30% of phishing attempts may be a higher-value target than the CEO. Leads threat actor tracking and provides intelligence that directly informs security investment and defensive priorities.	Senior CTI analyst and team leader who defines intelligence strategy and leads high-impact analysis. Expert at thinking like an attacker to identify organizational risk—correlating access patterns, targeting data, business context, and threat actor capabilities to produce intelligence that truly reflects threats to the specific organization. Builds intelligence programs that go beyond external report aggregation to deliver unique, actionable organizational insight.	Distinguished CTI analyst who shapes organizational and industry intelligence practices. Recognized externally as thought leader in threat intelligence, threat actor research, or specific threat domains. Produces intelligence that transforms how the organization understands and responds to threats. Drives innovation in threat correlation and organization-specific risk identification.	Elite CTI practitioner with industry-defining influence in threat intelligence. Operates at the intersection of deep intelligence expertise and organizational strategy. Shapes not only practice direction but industry approaches to understanding and responding to sophisticated threats.	Legendary practitioner at the pinnacle of threat intelligence expertise. Globally recognized authority who defines how the industry understands sophisticated threats, threat actors, and adversary operations. Combines unparalleled intelligence expertise with strategic vision. May have named major threat actors or developed foundational intelligence methodologies.
Primary Responsibilities	Conduct open-source intelligence (OSINT) collection Process and validate indicators of compromise Monitor threat feeds and vendor reports Assist with intelligence report drafting Learn MITRE ATT&CK framework mapping Document threat actor profiles and TTPs Support indicator enrichment activities Shadow senior analysts on intelligence production Learn internal systems and data sources	Produce tactical intelligence products independently Conduct threat actor and campaign research Correlate external threats with internal targeting data Analyze phishing campaigns targeting the organization Map threat actor TTPs to MITRE ATT&CK Develop and maintain threat actor profiles Support threat hunting with intelligence Contribute to operational intelligence reports Brief SOC and IR teams on relevant threats Participate in intelligence sharing communities	Produce strategic, operational, and tactical intelligence Lead internal threat correlation and targeting analysis Identify high-value targets based on access and exposure Conduct comprehensive threat actor investigations Brief executive and technical stakeholders Develop intelligence requirements with stakeholders Mentor junior CTI analysts Lead threat hunting hypothesis development Build relationships with ISAC and industry peers Develop collection strategies for priority intelligence Assess organization-specific threat landscape	Define CTI program strategy and priorities Lead strategic threat assessments Build comprehensive internal threat correlation capabilities Develop organization-specific threat models Mentor and develop CTI analyst team Present threat landscape to executives and board Build industry intelligence sharing relationships Lead intelligence support for major incidents Develop intelligence requirements framework Evaluate and select intelligence sources and vendors Publish thought leadership and research	Define multi-year CTI strategy and vision Lead industry-impacting threat research Build strategic intelligence partnerships Develop next-generation threat correlation capabilities Represent organization at highest industry levels Guide organizational investments in intelligence Shape industry intelligence practices Advise executive leadership on threat strategy Lead threat attribution at highest confidence levels	Set multi-year vision for enterprise threat intelligence Lead transformational research and methodology development Build strategic alliances with government and industry Influence industry standards and frameworks Develop next-generation intelligence approaches Guide organizational strategy alongside executive leadership Represent organization as premier intelligence authority Lead attribution on nation-state and advanced threats	Define industry direction for threat intelligence Lead transformational multi-year initiatives Serve as ultimate intelligence authority Shape government and industry threat understanding Build generational capabilities and methodologies Guide organizational transformation Represent organization at highest levels globally Advise government at national security levels
Required Skills	OSINT collection techniques and tools Understanding of common threat actors and motivations Basic knowledge of MITRE ATT&CK framework Familiarity with indicator types (hashes, IPs, domains) Understanding of malware categories and attack chains Documentation and writing skills Analytical thinking and attention to detail	Tactical intelligence production Threat actor research and profiling Campaign analysis and tracking MITRE ATT&CK mapping proficiency Internal data correlation (SIEM, email security, etc.) Structured analytic techniques Intelligence writing for technical audiences Threat intelligence platform operation	Multi-level intelligence production (strategic to tactical) Internal data source integration and analysis Advanced threat actor tracking and attribution Stakeholder communication across all levels Intelligence requirements development Collection planning and management Advanced analytic tradecraft Industry threat landscape expertise	Intelligence program strategy and leadership Advanced internal-external threat correlation Threat modeling from attacker perspective Executive communication and influence Team leadership and development Vendor and source evaluation Cross-functional partnership Industry relationship building	World-class threat intelligence expertise Strategic practice leadership Executive presence and influence Industry-wide recognition and relationships Innovation and methodology development Cross-functional leadership	Elite threat intelligence expertise Transformational leadership Executive and board-level communication Industry-shaping influence and relationships Geopolitical and strategic analysis Innovation leadership	Globally recognized intelligence expertise Transformational strategic vision Executive and government-level influence Industry-defining thought leadership Geopolitical and national security expertise
Preferred Skills	SOC or security operations background Intelligence community or military intel experience Foreign language proficiency Scripting basics (Python) Familiarity with threat intelligence platforms	Malware analysis basics Network traffic analysis Dark web monitoring ISAC participation Scripting for collection automation	IC or military all-source analysis background Malware reverse engineering Geopolitical analysis Published threat research Conference speaking	Published threat research or attribution work IC senior analyst or leadership background Conference keynotes or major presentations Government or law enforcement relationships Academic or training development	Published threat research or frameworks Named threat actor attribution work Government advisory relationships Academic affiliations Industry working group leadership	Named major threat actor discoveries Government advisory at senior levels Published books on threat intelligence Academic appointments	Named major threat actors or campaigns Government advisory at national level Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior CTI analysts. Shadows on intelligence production and stakeholder briefings. Expected to complete analytic tradecraft training. Learns the organization's business, assets, and threat landscape to ground intelligence in internal context.	Receives guidance from Senior analysts on complex analysis. Expected to begin mentoring Entry-level analysts informally. Contributes to collection plans and procedures. Should be developing expertise in specific threat actors or industry threats.	Primary mentor for Junior and Entry analysts. Leads training on analytic tradecraft and internal correlation. Expected to develop team procedures and intelligence standards. Establishes reputation as expert in specific threat actors or threat domains.	Primary mentor for Mid and Junior analysts. Responsible for team career development. Creates analytic training programs. Industry mentorship through community engagement. Shapes organizational intelligence practices.	Mentors Senior analysts and emerging leaders. Shapes organizational CTI talent strategy. Industry-level mentorship through community engagement. Develops thought leaders in the intelligence space.	Develops organizational leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to the threat intelligence field.	Develops organizational and industry leadership. Mentors future industry leaders. Legacy-building through generational impact on threat intelligence. May fund or sponsor research.
Impact Scope	Individual contributor on collection and processing tasks. Impact limited to supporting intelligence production. Work is reviewed before dissemination. Supports overall intelligence coverage.	Directly contributes to organizational threat awareness. Responsible for accurate tactical intelligence. Analysis informs detection and hunting activities. Beginning to influence security priorities based on threat landscape.	Shapes organizational threat understanding. Intelligence directly informs security strategy and investment. Targeting analysis identifies organizational risk beyond obvious assumptions. Intelligence products drive defensive priorities.	Defines intelligence capabilities and strategic direction. Program effectiveness directly impacts organizational threat posture. Team development impacts security maturity. Executive relationships enable threat-informed investment.	Industry and organizational transformation. Shapes how threat intelligence is practiced. Multi-year strategic outcomes. Influences how threats are understood industry-wide.	Industry-defining impact. Organizational competitive differentiation through intelligence capabilities. Multi-year strategic transformation. Shapes how threats are understood globally.	Global industry impact. Defines how threats are understood worldwide. Shapes government and industry response to threats. Creates lasting contributions to intelligence practice.
Autonomy & Decision Authority	Works under close supervision. Follows established collection and processing procedures. Limited authority to make analytic judgments independently. Escalates potential threats and findings to senior analysts.	Works with moderate supervision. Can make routine analytic judgments. Authority to produce tactical intelligence products. Escalates strategic assessments and high-confidence attributions.	Works independently with strategic guidance. Makes significant analytic judgments including attribution assessments. Authority over collection priorities and intelligence standards. Consulted on threat-informed defense strategy.	High autonomy with strategic alignment. Makes significant program and analytic decisions. Authority over intelligence standards and priorities. Trusted to represent organization on intelligence matters.	Near-complete autonomy over domain. Strategic influence on organizational direction. Shapes investment and capability priorities. Makes decisions with significant organizational impact.	Full autonomy over strategic domain. Executive-level decision authority. May have significant budget authority. Shapes organizational direction on threat matters.	Complete strategic autonomy. Executive-level authority. Shapes organizational strategy. Significant influence over industry and government threat understanding.
Communication & Stakeholders	Primarily internal communication with CTI team. Documents collection and findings. Limited direct interaction with intelligence consumers initially. May assist with indicator sharing.	Regular interaction with SOC and detection teams. Briefs technical audiences on threats. Participates in intelligence sharing. Documents analysis for internal consumption.	Regular communication with security and business leadership. Briefs executives on strategic threats. Primary CTI contact for stakeholder groups. Represents organization in intelligence sharing communities.	Executive-level communication on threat landscape. Board briefings on strategic threats. Represents organization in senior intelligence sharing forums. Media engagement on threat topics.	C-suite engagement on threat strategy. Industry-wide influence through publications and speaking. Government and law enforcement relationships. Media engagement on major threats.	Peer engagement with executives and CISOs. Industry-defining thought leadership. Government and international engagement. Media presence on major threats.	Global presence. Government and international engagement. Media thought leadership. Premier intelligence and national security venues.
Degree / Experience	Bachelor's degree in Intelligence Studies, International Relations, Computer Science, Cybersecurity, or related field, OR 1-2 years of SOC or security operations experience, OR military/IC intelligence background transitioning to private sector.	Bachelor's degree in relevant field, OR 2-4 years of CTI, SOC, or intelligence experience. Demonstrated ability to produce finished intelligence products.	Bachelor's degree in relevant field, OR 4-6 years of CTI or intelligence experience. Demonstrated track record of high-quality finished intelligence. May have Master's degree or IC background with less corporate experience.	Bachelor's or Master's degree in relevant field, OR 6-10 years of CTI or intelligence experience. Demonstrated program leadership and thought leadership. IC senior analyst background highly valued.	Advanced degree often expected, OR 10+ years of elite CTI or IC experience with demonstrated industry impact. Recognition is essential qualification.	Advanced degree often present, but industry recognition is primary qualification. 12+ years of elite experience with transformational impact.	Recognition is primary qualification. 15+ years with transformational impact. May be pioneers of threat intelligence discipline or major discoveries.
Certifications	CompTIA Security+ GIAC Cyber Threat Intelligence (GCTI) SANS FOR578 (CTI course) CompTIA CySA+	GCTI GREM (helpful for malware understanding) CTIA (Certified Threat Intelligence Analyst) FOR578	GCTI GREM CISSP (helpful) Industry recognition may substitute	Multiple GIAC certifications Industry recognition often substitutes Published research credentials CISSP or similar	Certifications secondary to demonstrated expertise Known by body of research and attribution work Industry awards and recognition May be methodology contributors	Certifications irrelevant at this level Known by reputation and body of work May have threat actors or methodologies associated with their name	Certifications irrelevant at this level Known by reputation and legacy May have threat actors named by their research
Salary: US Gov't	$55,000 - $75,000 (GS-7 to GS-9)	$70,000 - $95,000 (GS-9 to GS-11)	$90,000 - $120,000 (GS-11 to GS-13)	$115,000 - $150,000 (GS-13 to GS-14)	$140,000 - $175,000 (GS-15 / SES equivalent)	$165,000 - $210,000 (Senior SES equivalent)	$185,000 - $240,000+ (Senior SES / Technical fellow equivalent)
Salary: US Startup	$65,000 - $90,000	$85,000 - $115,000	$110,000 - $150,000	$145,000 - $195,000 + equity	$180,000 - $245,000 + significant equity	$220,000 - $300,000 + major equity	$270,000 - $380,000+ + founder-level equity
Salary: US Corporate	$60,000 - $85,000	$80,000 - $110,000	$105,000 - $140,000	$135,000 - $180,000	$170,000 - $230,000	$205,000 - $275,000	$250,000 - $340,000+

↑ Back to navigation

CTI Engineer

Technical professionals who build and maintain the infrastructure that enables threat intelligence operations. Focus on TIP deployment, feed integration, enrichment automation, MITRE ATT&CK operationalization, and detection content development. Bridge the gap between raw intelligence and defensive action by building systems that correlate internal telemetry with external threats. Skills overlap significantly with Detection Engineering; some organizations combine these functions.

Attribute	Eng 1 / Entry	Eng 2 / Junior	Eng 3 / Mid	Eng 4 / Senior / Lead	Eng 5 / Staff	Eng 6 / Senior Staff	Eng 7 / Principal
General Description	Entry-level CTI engineer learning intelligence platform operations and automation fundamentals. Assists with feed integration, indicator processing, and basic platform administration. Develops foundational understanding of TIPs, indicator formats, and how intelligence flows into defensive systems.	Junior CTI engineer capable of independently managing feed integrations and developing basic automation. Demonstrates proficiency with TIP administration and can build enrichment workflows. Begins developing detection content from intelligence and understands the connection between intel and defensive action.	Experienced CTI engineer who independently designs and implements intelligence infrastructure and automation. Expert at building systems that correlate internal organizational data with external threat intelligence. Strong detection engineering capabilities—can translate threat actor TTPs into high-fidelity detections. Mentors junior engineers and shapes platform strategy.	Senior CTI engineer and team leader who defines intelligence infrastructure strategy. Expert at building systems that transform intelligence into defensive action—from automated enrichment to detection deployment to threat hunting enablement. Bridges intelligence and detection engineering to maximize defensive value of threat intelligence. Champions internal threat correlation that identifies organization-specific risk.	Distinguished CTI engineer who shapes organizational and industry approaches to intelligence infrastructure and operationalization. Recognized externally for technical innovation in threat intelligence platforms, detection engineering from intel, or threat correlation systems. Drives next-generation capabilities.	Elite CTI engineer with industry-defining influence in intelligence infrastructure and threat operationalization. Operates at the intersection of deep technical expertise and organizational strategy. Shapes how the industry builds and operates intelligence platforms.	Legendary practitioner at the pinnacle of intelligence engineering expertise. Globally recognized authority who defines how the industry builds threat intelligence infrastructure and operationalizes intelligence for defense. May have created foundational tools or platforms used industry-wide.
Primary Responsibilities	Assist with threat intelligence platform administration Process and normalize indicator feeds Learn STIX/TAXII and indicator formats Support feed integration and troubleshooting Document platform configurations and procedures Assist with indicator enrichment workflows Learn MITRE ATT&CK framework structure Shadow senior engineers on platform development Monitor platform health and data quality	Manage threat feed integrations and normalization Develop indicator enrichment automation Build basic detection rules from intelligence Administer threat intelligence platforms Create MITRE ATT&CK mappings for threats Develop intelligence sharing workflows (STIX/TAXII) Build dashboards and intelligence visualizations Support internal threat correlation data pipelines Troubleshoot integration issues Document technical procedures and architectures	Design intelligence platform architectures Build advanced internal-external threat correlation systems Develop detection content from threat intelligence Create sophisticated enrichment and automation pipelines Lead MITRE ATT&CK coverage mapping initiatives Mentor junior CTI engineers Evaluate and integrate new intelligence sources Build threat hunting data pipelines Develop intelligence sharing capabilities Create intelligence operationalization frameworks	Define CTI engineering strategy and roadmap Lead enterprise intelligence platform architecture Build organization-specific threat correlation capabilities Develop detection engineering programs from intelligence Mentor and develop CTI engineering team Present engineering strategy to leadership Evaluate and select intelligence platforms Build strategic vendor relationships Lead intelligence infrastructure for major initiatives Drive MITRE ATT&CK coverage maturity Contribute to open-source intelligence tooling	Define multi-year intelligence engineering vision Lead industry-impacting tool and platform development Build strategic technology partnerships Develop next-generation threat correlation capabilities Represent organization at highest technical levels Guide organizational investments in intelligence infrastructure Shape industry standards and tools Advise leadership on intelligence technology strategy	Set multi-year vision for enterprise intelligence infrastructure Lead transformational platform development Build strategic alliances with vendors and industry Influence industry standards and frameworks Develop next-generation operationalization approaches Guide organizational strategy alongside leadership Represent organization as premier technical authority	Define industry direction for intelligence engineering Lead transformational multi-year initiatives Serve as ultimate technical authority Shape how intelligence infrastructure is built globally Build generational capabilities and platforms Guide organizational transformation Represent organization at highest levels globally
Required Skills	Basic understanding of threat intelligence platforms Familiarity with indicator formats (STIX, OpenIOC) Basic scripting ability (Python) Understanding of APIs and data integration Knowledge of SIEM and security tools basics Documentation skills Troubleshooting and problem-solving	TIP administration and configuration Feed integration and normalization Python scripting for automation STIX/TAXII implementation Basic detection rule development API integration development MITRE ATT&CK operationalization Data pipeline basics	Intelligence platform architecture Advanced Python development Detection engineering (SIEM, EDR rules) Internal data correlation and analysis Data pipeline engineering MITRE ATT&CK coverage analysis Intelligence sharing standards mastery Cross-team technical leadership	Intelligence infrastructure strategy Enterprise platform architecture Detection engineering program development Internal threat correlation at scale Team leadership and development Executive communication Vendor evaluation and management Cross-functional program leadership	World-class intelligence engineering expertise Strategic technical leadership Executive presence and influence Industry-wide recognition Innovation and platform development Cross-functional technical leadership	Elite intelligence engineering expertise Transformational technical leadership Executive and board-level communication Industry-shaping influence Strategic technology vision Innovation leadership	Globally recognized technical expertise Transformational strategic vision Executive and government-level influence Industry-defining thought leadership Strategic technology development
Preferred Skills	Experience with specific TIPs (MISP, OpenCTI, ThreatConnect) SOC or detection engineering exposure Database basics MITRE ATT&CK familiarity Network security fundamentals	SIEM query and detection development Multiple TIP platform experience Malware analysis basics Cloud platform experience Data engineering fundamentals	Data engineering and analytics platforms Machine learning basics for threat detection Malware analysis and reverse engineering Cloud-native security tooling Published tools or detection content	Published intelligence tools Conference speaking Open-source project leadership Detection content frameworks Data engineering at scale	Major open-source intelligence tool author Published research or frameworks Vendor advisory roles Industry working group leadership	Founded major intelligence tools or platforms Vendor advisory board leadership Published books or major frameworks Academic appointments	Founded significant intelligence platforms or tools Government advisory Major industry awards Academic distinguished appointments
Mentorship Requirements	Receives direct mentorship from Senior CTI engineers. Shadows on platform development and integration work. Expected to achieve platform certifications within first year. Learns how intelligence operationalization works.	Receives guidance from Senior engineers on complex integrations. Expected to begin mentoring Entry-level engineers informally. Contributes to platform documentation. Should be developing expertise in specific platforms or detection development.	Primary mentor for Junior and Entry engineers. Leads training on platform development and detection engineering. Expected to develop team standards and best practices. Establishes reputation as expert in specific platforms or detection domains.	Primary mentor for Mid and Junior engineers. Responsible for team career development. Creates engineering training programs. Industry mentorship through community engagement. Shapes organizational CTI engineering practices.	Mentors Senior engineers and emerging leaders. Shapes organizational CTI engineering talent strategy. Industry-level mentorship. Develops thought leaders in intelligence engineering.	Develops organizational technical leadership pipeline. Mentors future industry leaders. Legacy-building through lasting contributions to intelligence engineering.	Develops organizational and industry leadership. Mentors future industry leaders. Legacy-building through generational impact. May fund or sponsor tool development.
Impact Scope	Individual contributor on assigned platform tasks. Impact limited to supporting engineering activities. Work is reviewed before deployment. Supports overall intelligence infrastructure.	Directly contributes to intelligence platform capabilities. Responsible for reliable feed integration and data quality. Automation work improves analyst efficiency. Detection content protects the organization.	Shapes intelligence platform capabilities. Detection content directly protects organization. Internal correlation systems identify organizational risk. Automation enables analyst focus on high-value work.	Defines intelligence engineering capabilities. Platform decisions impact long-term intelligence effectiveness. Detection program improves organizational security posture. Team development impacts security maturity.	Industry and organizational transformation. Shapes how intelligence infrastructure is built. Multi-year strategic outcomes. Influences vendor roadmaps and industry tools.	Industry-defining impact. Organizational differentiation through intelligence capabilities. Multi-year strategic transformation. Shapes how intelligence systems are built globally.	Global industry impact. Defines how intelligence systems are built. Organizational transformation. Creates lasting contributions to the field.
Autonomy & Decision Authority	Works under close supervision. Follows established procedures for platform operations. Limited authority to make configuration changes independently. Escalates issues to senior engineers.	Works with moderate supervision. Can make routine platform decisions. Authority to implement standard integrations. Escalates architectural changes and complex development.	Works independently with strategic guidance. Makes significant architecture and development decisions. Authority over platform standards and detection strategies. Consulted on intelligence infrastructure investment.	High autonomy with strategic alignment. Makes significant platform and investment decisions. Authority over engineering standards and detection strategies. Trusted to represent organization on technical intelligence matters.	Near-complete autonomy over domain. Strategic influence on organizational direction. Shapes investment priorities. Makes decisions with significant organizational impact.	Full autonomy over strategic domain. Executive-level decision authority. Significant investment authority. Shapes organizational direction.	Complete strategic autonomy. Executive-level authority. Shapes organizational strategy. Significant influence over industry direction.
Communication & Stakeholders	Primarily internal communication with CTI team. Documents configurations and procedures. Limited direct interaction with consumers of intelligence systems.	Regular interaction with CTI analysts and SOC teams. Participates in platform planning discussions. Documents technical decisions. Coordinates with security tool teams.	Regular communication with CTI and security leadership. Presents technical strategies. Primary engineering contact for intelligence platform decisions. Coordinates across security teams.	Executive-level communication on intelligence infrastructure. Represents engineering in strategic planning. Builds industry relationships with vendors and peers. May speak at conferences.	C-suite engagement on intelligence technology. Industry-wide influence. Vendor and standards relationships. Media engagement on technical topics.	Peer engagement with executives. Industry-defining thought leadership. Media and public presence. Vendor and standards leadership.	Global presence. Government and international engagement. Media thought leadership. Premier technical venues.
Degree / Experience	Bachelor's degree in Computer Science, IT, Cybersecurity, or related field, OR 1-2 years of security operations or IT experience, OR SOC background with interest in automation.	Bachelor's degree in relevant field, OR 2-4 years of CTI engineering, detection engineering, or security automation experience. Demonstrated ability to build integrations and automation.	Bachelor's degree in relevant field, OR 4-6 years of CTI engineering, detection engineering, or security automation experience. Demonstrated track record of complex platform development. May have Master's degree with less experience.	Bachelor's or Master's degree in relevant field, OR 6-10 years of CTI engineering, detection engineering, or security platform experience. Demonstrated program leadership and technical innovation.	Advanced degree often expected, OR 10+ years of elite CTI engineering experience with demonstrated industry impact. Recognition is essential qualification.	Advanced degree often present, but recognition is primary qualification. 12+ years of elite experience with transformational impact.	Recognition is primary qualification. 15+ years with transformational impact. May be pioneers of intelligence platforms or operationalization approaches.
Certifications	CompTIA Security+ Platform-specific certifications Python basics GCTI (helpful)	Platform certifications (MISP, OpenCTI, etc.) GCTI Cloud certifications helpful GCIA or detection-focused certs	GCTI, GCIA Cloud architecture certifications Platform expert certifications Detection engineering credentials	Multiple advanced certifications Industry recognition often substitutes Platform expert status Published tools or frameworks	Certifications secondary to demonstrated expertise Known by tools and contributions Industry awards and recognition	Certifications irrelevant at this level Known by reputation and contributions May have platforms named after them	Certifications irrelevant at this level Known by reputation and legacy Tools or platforms named after them
Salary: US Gov't	$60,000 - $80,000 (GS-9 to GS-11)	$75,000 - $100,000 (GS-11 to GS-12)	$95,000 - $125,000 (GS-12 to GS-13)	$120,000 - $155,000 (GS-13 to GS-14)	$145,000 - $180,000 (GS-15 / SES equivalent)	$170,000 - $215,000 (Senior SES equivalent)	$190,000 - $250,000+ (Senior SES / Technical fellow equivalent)
Salary: US Startup	$70,000 - $95,000	$90,000 - $125,000	$120,000 - $160,000	$155,000 - $205,000 + equity	$190,000 - $260,000 + significant equity	$235,000 - $320,000 + major equity	$280,000 - $400,000+ + founder-level equity
Salary: US Corporate	$65,000 - $90,000	$85,000 - $115,000	$115,000 - $150,000	$145,000 - $190,000	$180,000 - $245,000	$220,000 - $290,000	$265,000 - $360,000+

↑ Back to navigation

Domain	Focus	Relationship
EVM	Infrastructure vulnerabilities, scanning platforms, risk prioritization	Partners with AppSec on application vulns found via DAST
AppSec	Application code, SSDLC, secure design, developer enablement	Partners with EVM on remediation tracking
Cloud Security	Cloud infrastructure, platform security, IAM	AppSec focuses on app logic; CloudSec on platform
Digital Forensics	Evidence acquisition, artifact analysis, legal support	Supports IR with deep-dive analysis; coordinates with legal
CTI	Threat actors, organization-specific risk, intel-driven defense	Feeds detection engineering; correlates internal data with external threats

Sector	Notes
US Government	Based on General Schedule (GS) and Senior Executive Service (SES) pay scales. Actual compensation varies by locality pay area.
US Startup	Reflects venture-backed companies. Equity compensation can significantly increase total compensation.
US Corporate	Reflects Fortune 500 and large enterprise compensation. May include bonus structures of 10-30%+.

🔐 Security Titles

Specialized Security Professional Titles

🔍 Enterprise Vulnerability Management (EVM)

EVM Analyst

EVM Engineer

🔐 Application Security (AppSec / Product Security)

AppSec Engineer

AppSec Architect

☁️ Cloud Security (CloudSec)

Cloud Security Engineer

Cloud Security Architect

🔬 Digital Forensics

Forensic Analyst

🎯 Cyber Threat Intelligence (CTI)

CTI Analyst

CTI Engineer

About This Framework

Specialized Role Relationships

Salary Notes

Coming Soon

Contributing