Low turnover leaves job-seeking CISOs with nowhere to go – Source: www.csoonline.com

CISO job turnover is continuing to drop, placing security leaders looking to gain a salary increase or leave an unfulfilling role in a difficult position.

Turnover in top security roles decreased from 21% in 2022 to 12% in 2023, and further to an annualized 11% in H1 2024, limiting opportunities for compensation growth through job changes, according to a recent study by IANS Research and Artico Search.

“We attribute slow turnover largely to macroeconomic conditions,” Nick Kakolowski, senior research director at IANS Research told CSO. “As we see early signs of momentum and 75% of CISOs open to job changes, we expect turnover to pick up in 2025.”

CISOs who have managed to change employers saw a 31% compensation boost, largely driven by equity-based packages, significantly outpacing standard merit increases, according to IANS Research. Security leaders with experience across multiple companies or industries earned 65% more than peers who stayed with one company or sector.

IANS Research analyzed detailed compensation data from more than 750 CISOs across various industries.

Despite slower hiring and tightened budgets, CISO compensation remains strong, with the average CISO compensation topping $500K, according to IANS data.

Workplace stress fueling desire to switch jobs — but where to go?

A separate study by Blackfrog found that nearly a quarter (24%) of cybersecurity leaders are actively looking to leave their organization.

For those considering leaving their role, almost all (93%) security leaders stated that stress, or the demands of their job, are impacting their decision to leave.

Charlee Ryman, co-founder and COO at specialist recruitment firm Trident Search, told CSO that although compensation packages remain high, the abundance of senior cybersecurity executives seeking new roles has stifled salary growth for CISOs compared to mid-senior level leadership roles.

Ryman explained that advancements in cybersecurity automation over the past two years has resulted in a surplus of highly skilled executives on the job market that’s outstripping demand.

“The upshot is that over their standard tenure of 18-24 months, some CISOs have unintentionally automated themselves out of roles by implementing tech that reduces the need for additional headcount, resulting in a leaner security function,” according to Ryman.

Businesses are streamlining operations, cutting roles that are deemed less critical, especially where new technologies could be leveraged instead. Compounding the issue is the current (somewhat moribund) economic climate.

“Many organizations are hesitant to increase security budgets, and hiring has slowed,” Ryman explains. “In a more buoyant market, we would expect to see a high turnover rate due to frustrations with the role; however a number of executives are gritting their teeth and choosing to stay put, awaiting year-end bonuses and more opportunities in [the] job market.”

While some CISO positions at large organizations still offer impressive salaries, these roles are scarce. “Those who haven’t been exposed to some of the latest technologies or digital transformation projects will find it harder to secure new positions; upskilling and networking is key, as many CISO roles are filled through referrals or headhunting,” Ryman advised.

Professional growth opportunities

Benson Varghese, founder and managing partner of US law firm Varghese Summersett, said that companies are increasingly valuing stability in their cybersecurity leadership.

“Many are offering retention bonuses and long-term incentives to keep these critical players on board,” according to Varghese. “Equity-based compensation packages are particularly appealing, as they align the interests of CISOs with the long-term success of the company — it’s like giving them a stake in the fortress they’re guarding.”

Factors that can encourage CISOs to look for a new role can include a desire for new challenges, opportunities for advancement, or a more dynamic role that allows them to make a significant impact.

“While financial incentives like retention bonuses and equity packages play a significant role in reducing turnover, it’s the intangible aspects — like professional growth opportunities and cultural fit — that truly keep CISOs committed,” Varghese concluded.

Comprehensive packages

Tharindu Fernando, a tech expert and a full-stack developer at Net Speed Canada,

argued the decline in job turnover isn’t just about retention bonuses, though they certainly play a role.

“In my work developing healthcare platforms, I’ve seen firsthand how vital stable, experienced security leadership is,” Fernando said. “Organizations are increasingly offering comprehensive packages that go beyond just salary — things like equity stakes, enhanced benefits, and even personal liability protection through D&O [directors and officers liability] insurance.”

Increased economic uncertainty means that both companies and CISOs are playing it safe. “Organizations are hesitant to start new CISO searches, and executives are thinking twice before jumping ship,” according to Fernando. “It’s a bit of a ‘better the devil you know’ situation.”