Negotiating your cybersecurity salary without selling short

Many security professionals spend weeks preparing for a technical interview, then improvise the pay conversation in ten minutes. That is often where they lose the most, not for lack of value but for lack of method. Here is how to position yourself, choose the right moment, answer the awkward questions and compare an offer as a whole, without selling yourself short or damaging the relationship.

Why negotiation often goes wrong in security

Technical people tend to assume their work will speak for itself. It does during the hiring process, much less when the offer is being priced. Three mistakes come up again and again:

• Giving a number too early, on the first call, before you know the real scope of the role.
• Anchoring on your current salary, when a move is precisely the chance to correct a gap.
• Looking only at base pay, and forgetting on-call duties, variable pay, remote work or the training budget.

There is also a persistent fear that negotiating makes a bad impression. In practice, an employer hiring a pentester, a SOC analyst or an architect expects a discussion. What puts people off is not the request, it is a request with no justification or one framed as an ultimatum.

Know your range before talking numbers

Before any discussion, you need to know what the role is worth, not just what you earn today. Security pay varies widely with several factors, and two roles with the same title can have almost nothing in common.

To build your range, cross-check several sources: job ads that show pay, conversations with peers you trust, feedback from the recruiters you meet, and studies published by recognised bodies. Be wary of a single number read on a forum: it tells you nothing about the scope or the constraints behind it.

Then set three levels for yourself:

1. Your floor: below it, you say no, whatever happens.
2. Your target: the realistic, justified figure you aim for.
3. Your stretch: a higher level you can defend if the role turns out broader than expected.

The right moment to discuss pay

Pay should be raised early but negotiated late. It is healthy to check on the first call that the company's range matches your expectations: it spares everyone a pointless process. The actual negotiation happens once the employer has decided they want you, that is after the interviews and the practical test.

In between, your leverage grows with every stage you pass. A candidate who has just delivered an excellent test report, as described in our guide to preparing for a cybersecurity practical test, is not in the same position as on the first call.

Worth knowing: EU Directive 2023/970 on pay transparency, available on eur-lex.europa.eu, provides among other things that candidates be told the starting pay or its range before the interview, and bars employers from asking about pay history. The exact rules depend on how it is transposed into French law, so check what applies when you are looking.

Handling the awkward questions

Some questions catch you out if you have not prepared them. These answers protect your position without dodging.

"What do you earn today?" Bring it back to the role: "I'd rather talk about pay for this role, which has a different scope. For this position, I'm looking at a range between X and Y." You are not obliged to disclose your current salary.

"What are your expectations?" If you know little about the role, turn the question around: "What range is planned for this position? I'll tell you whether it works." If you must give a number, give a range whose bottom is your target, not your floor.

"That's above our budget." Don't give in straight away. Ask where the budget sits, then explore other levers: variable pay, a signing bonus, an early salary review, remote work, training.

"We need an answer quickly." A few days to think is normal. Thank them, confirm your interest and give a precise date.

Look at the offer beyond base pay

An offer is compared as a whole. Two offers with the same base salary can mean very different lives, especially in security where working hours weigh heavily.

Before you answer, check these points:

• Annual gross base pay, and the number of instalments.
• Variable pay: criteria, cap, and what was actually paid in previous years.
• On-call: frequency, allowance, pay for interventions, rest time afterwards.
• Remote work: the real rhythm and how stable the rule is.
• Training and certification budget, and the time allowed to prepare.
• Profit-sharing schemes, health and disability cover.
• The date and criteria of the first salary review.
• Commute time and what it costs you.

On-call deserves special attention. If it is vague in the offer, our advice to employers on remote work and on-call duties gives you the list of questions to ask.

Argue with facts, not needs

Your rent or your plan to buy a flat are not arguments for the employer. What counts is the value you bring to the role. Prepare three to five concrete points:

• Responsibilities you have already held that match the role.
• Measurable results you can cite without breaching confidentiality: an improved detection process, a certification you led, a team you trained.
• Rare skills you bring that the company named as priorities.
• How you performed during the process: practical test, technical interview, evaluator feedback.

If your CV already highlights these, the negotiation is simply the next step. Our guide to the cybersecurity CV helps you phrase them.

Mistakes that cost you

A few behaviours weaken your position, sometimes for good:

• Bluffing about another offer. The security world is small, and a bluff that comes out destroys trust.
• Accepting verbally, then renegotiating. Negotiate before you say yes.
• Negotiating in writing under pressure. Sensitive points are better settled by voice, then confirmed in writing.
• Using a counter-offer from your current employer as leverage with no intention of leaving. You lose on both sides.
• Forgetting to get everything into the written offer. What isn't written down doesn't exist.

The role of a recruitment firm

Going through a firm does not mean staying quiet about pay, quite the opposite. A recruiter who knows the role can tell you from the start whether your expectations are realistic, carry your arguments to the employer and defuse tension before it builds. At Cyber Recrut, our fees are paid by the company and our support is free for candidates.

In short

Negotiating your cybersecurity salary means first knowing your range from several sources, setting a floor and a target, raising the range early and negotiating late. It then means comparing the offer as a whole, arguing with facts and getting everything in writing. None of this is aggressive: it is the same rigour you apply to your job.

Planning your next move? The candidates we shortlist prove their skills on hands-on labs, which gives them solid arguments when pay comes up. Join the Cyber Recrut network for free and see how we work.