How much does a UK cybersecurity engineer earn in 2026/27?

UK cybersecurity pay is wide. A SOC Analyst in a regional Security Operations Centre earns £30,000 to £42,000 base; the same role at a London FinTech earns £42,000 to £58,000. A Senior Security Engineer or CHECK / CREST-certified penetration tester at a London consultancy earns £85,000 to £120,000 base. A Principal Security Architect at a FAANG London office reaches £170,000 to £230,000 base, with RSU vests and bonus pushing total compensation past £300,000. A FTSE 100 CISO commands £250,000 to £500,000 total compensation. Figures here are indicative ranges synthesised from the (ISC)2 Cybersecurity Workforce Study UK cut, the CREST UK Pay Survey, Hays UK IT, Robert Half UK Technology, ITJobsWatch and Glassdoor company postings.

Is cybersecurity pay better than software engineering or DevOps?

At the SOC Analyst entry level cybersecurity pay sits slightly below comparable Junior software or DevOps roles, because the SOC Analyst function is closer to a tier-1 operational role than an engineering build role. From Security Engineer (Year 2+) upwards, cybersecurity pay converges with software engineering and DevOps at the same firm and the same level - the bands at FAANG London for Senior Security Engineer (L5) and Senior Software Engineer (L5) are explicitly aligned. Specialist tracks earn a meaningful premium: penetration testing carries +15% to +25% over generalist security engineering, cleared (DV / SC) roles add +20% to +40%, and CISO / Head of Security commands a leadership premium of 30% to 80% over equivalent-level non-leadership engineering roles.

How much can a UK cybersecurity contractor earn on day rates?

Mid-level cybersecurity contractor day rates sit at £450 to £700; Senior CHECK / CREST penetration tester £650 to £950; Principal Security Architect £800 to £1,200+ for the rare outside-IR35 cleared niche-specialism roles. Assuming 200 billable days a year (lower than DevOps because of pre-engagement clearance vetting and CHECK / CREST scoping overhead), a £900 day rate generates £180,000 of revenue. Inside IR35 that flows through PAYE on roughly the full headline, with no Limited-company corporation-tax efficiency. Outside IR35 via a Personal Service Company, the same revenue can be split between modest director salary, dividends and pension contribution for materially better post-tax outcomes - subject to MSC and disguised-remuneration anti-avoidance rules. Outside-IR35 contracts remain available at boutique consultancies, smaller end-clients and cleared-defence engagements where a substantive employment-status test favours the contractor.

Should I go contractor or stay PAYE as a senior penetration tester?

After the 2021 private-sector off-payroll reform, most large UK clients now classify cybersecurity contracts as inside IR35 by default - particularly at FTSE 100 buyers, banks and the public sector. Where the role is inside IR35 the fee-payer (agency or client) deducts Income Tax and employee NI from the deemed payment, so the contractor effectively pays full PAYE on the gross day-rate revenue with limited expense relief. Compared with permanent base at a similar gross, the contractor route loses access to employer pension matching, paid holiday, sick pay, and any RSU / LTIP. Outside-IR35 contracts remain valuable but are now concentrated at smaller clients, niche CREST / CHECK-approved consultancies, and cleared-defence engagements with clear contractor-only delivery models. The strongest contractor-route economics in cyber today are: outside-IR35 DV-cleared penetration testing for the intelligence community, and outside-IR35 Cloud Security Architecture for early-stage FinTech where the engagement is genuinely project-bounded.

How are CISO and Head of Security roles paid in the UK?

CISO and Head of Security pay sits at the intersection of an engineering-leadership track and a board-facing operational risk role. At UK FTSE 250 buyers a CISO commands £200,000 to £350,000 total compensation, with 70% to 75% base and the balance in bonus plus modest LTIP. At FTSE 100 buyers, particularly in banking and energy / utilities (where operational resilience is regulated), CISO TC reaches £300,000 to £500,000+ with deferred LTIP share grants. CISO of a US-listed Big Tech UK subsidiary or a major FinTech scale-up can hit £400,000 to £600,000 TC inclusive of RSU. Below the CISO, the Head of Security / Director of Information Security role pays £170,000 to £280,000 base in London. The principal tax mechanic at this band is that base alone sits firmly in the 45% additional-rate band above £125,140, and bonus / LTIP vests are taxed as employment income at the same marginal rate through PAYE.

What is the 60% tax trap and how does it affect senior cybersecurity engineers?

Between £100,000 and £125,140 of adjusted net income the Personal Allowance tapers at £1 lost for every £2 over £100,000. Combined with the 40% higher rate and 2% NI above the Upper Earnings Limit, the effective marginal rate on that slice is roughly 62%. Most Senior Security Engineers and Senior Pen Testers in London cross into this band on base alone; RSU and LTIP vests push them deeper. Salary sacrifice into pension that takes adjusted net income below £100,000 is the standard mitigation. On £125,140 base, sacrificing the full £25,140 to land at £100,000 taxable saves roughly £15,000 in combined Income Tax and NI versus taking that slice as salary - the highest pre-tax-arbitrage return available to a UK PAYE earner.

What are the main UK cybersecurity specialisations and their pay deltas?

Nine specialisations structure the UK cybersecurity market in 2026, each with a distinct pay envelope. Penetration Testing / Red Team (offensive, CREST CCT and OSCP credentialled) carries the largest practitioner premium at +15% to +25% over generalist security engineering. SOC / Detection Engineering / Blue Team (defensive, SIEM and detection rule development) pays close to the generalist median and progresses fastest into Threat Intelligence leadership roles. Cloud Security (AWS / Azure / GCP security posture management, IAM, key management, container runtime security) commands a +10% to +20% premium driven by the cloud build-out. DevSecOps and AppSec (SAST / DAST / IAC scanning, secure software development, SBOM and supply-chain hardening) pays near identical to senior DevOps. Identity and Access Management (IAM, PAM, Zero Trust architecture) is at the heart of every FinTech and Big Tech security org. GRC (Governance, Risk and Compliance, including FCA SS1/21 operational resilience, NIST CSF and ISO 27001 implementation) pays slightly below technical security engineering at the same grade. Digital Forensics and Incident Response (DFIR, GIAC GCFA / GREM credentialled) pays a +15% premium at top consultancies. Threat Intelligence and Threat Hunting commands a premium at financial-crime-heavy FinTechs. Security Architecture leads the leadership ladder above Principal toward Head of Security and CISO.

Do FinTechs and tier-1 banks pay competitive cybersecurity salaries in London?

Yes. JPMorgan, Goldman Sachs, Morgan Stanley, Bank of America, Citi and Barclays Investment Bank pay Senior Security Engineers £110,000 to £150,000 base, with 25% to 50% target bonuses paid in February of the following year. Total cash compensation typically sits below FAANG (when RSU is included) but well above UK-corporate in-house. Scale-up FinTechs (Wise, Revolut, Monzo, Starling, Tide, GoCardless, Plaid, Stripe) have priced cybersecurity pay against Big Tech - Senior Security Engineer / AppSec at a Series C / D FinTech commands £115,000 to £155,000 base plus equity / RSU. The equity component is more volatile than FAANG: pre-IPO grants are valued against an internal 409A valuation, with a meaningful chance of zero value at exit. Post-IPO FinTechs (Wise PLC, Monzo Bank) grant tradeable RSUs taxed via PAYE at vest plus CGT on subsequent sale.

How is RSU compensation taxed for UK cybersecurity engineers at FAANG?

Restricted Stock Units are taxed as employment income at the marginal Income Tax rate plus employee Class 1 National Insurance at the point they vest, not when granted or sold. The employer withholds the tax via PAYE - typically by selling enough shares at vest to cover the liability (sell-to-cover). When you later sell the retained shares, Capital Gains Tax applies only on the gain above the vest-date market value. The vest-date value becomes your CGT cost basis. See HMRC ERSM 20300 for the statutory treatment. For a Senior Security Engineer at a FAANG London office on £150,000 base plus £55,000 annualised RSU vest, every pound of the RSU is taxed at 47% (45% additional rate plus 2% NI above the Upper Earnings Limit) - so a £55,000 vest delivers roughly £29,000 of net new cash after PAYE.

Profession: 2026/27

UK Cybersecurity Engineer Salary 2026/27

Indicative pay bands from SOC Analyst to CISO, FinTech vs Defence vs Big 4 vs FAANG tier, CISSP / OSCP / CREST / GIAC certification premium, DV / SC clearance uplift, contractor PSC vs umbrella after IR35, salary sacrifice to clear the 60% trap, and engine-verified take-home for England.

Overview of UK cybersecurity and security engineering pay

Cybersecurity, Security Engineering and Information Security Leadership pay in the United Kingdom is not set on a single canonical scale. Each employer benchmarks pay independently against the (ISC)2 Cybersecurity Workforce Study UK cut, the CREST UK Pay Survey for member firms, recruiter salary surveys (Hays UK IT, Robert Half UK Technology) and self-reported total compensation data (Glassdoor, ITJobsWatch). The Office for National Statistics does not publish a dedicated SOC code for cybersecurity - most roles are coded into SOC 2136 (programmers and software development professionals) or SOC 2139 (information technology and telecommunications professionals not elsewhere classified), neither of which fully reflects the bifurcated 2026 market.

The career ladder runs SOC Analyst (Year 1 - 2 post-graduation or first cyber role, often via a Security Operations Centre) through Security Engineer (Year 2 - 5, with specialisation into AppSec, Cloud Security, IAM, DevSecOps or detection engineering), Senior Security Engineer or Penetration Tester (Year 5 - 8, typically CISSP-credentialled or OSCP-credentialled), Principal Security Architect (Year 8 - 12, often with a chartered or master degree credential alongside), Director or Head of Security (Year 12 - 18, leading multi-team security programmes), and CISO (board-facing, accountable to the Audit and Risk Committee or directly to the CEO). Pay at every level is dominated by employer type and specialisation, not seniority alone.

Six employer tiers structure the market: FAANG and Big Tech (Meta, Google, Amazon, Apple, Microsoft, Stripe, Cloudflare, Datadog) with top pay and heavy RSU; FinTech scale-ups (Wise, Revolut, Monzo, Starling, Tide, GoCardless, Plaid, Stripe) with high base plus equity at internal 409A valuation; defence and cleared employers (BAE Systems, Raytheon UK, Leonardo, QinetiQ, NCC Group, Roke, Capgemini Public Sector) with a DV / SC clearance premium baked into base; Big 4 cyber practices (Deloitte, EY, KPMG, PwC) with structured progression from Senior Consultant through Partner; boutique consultancies (NCC Group, F-Secure Consulting, PortSwigger, Bishop Fox UK, WithSecure UK, Context Information Security) commanding CHECK / CREST partner rates; and UK FTSE / mid-market in-house security teams paying below the global market but offering job stability and traditional matched-contribution pension structures. All figures on this page are indicative ranges, not a single source of truth like an NHS Agenda for Change pay band.

Base salary bands by level and employer tier

Indicative base salary only. Excludes bonus, RSU / LTIP, sign-on, on-call / incident-response allowance and benefits. Regional applies to roles outside the M25 at UK-headquartered employers (Manchester, Edinburgh, Bristol, Leeds, Cambridge, Cheltenham, Birmingham). London covers UK-corporate, mid-market scale-ups and consultancies in London. FinTech and Big Tech bands are London-dominated. Defence covers BAE Systems, Raytheon UK, Leonardo, QinetiQ and similar cleared-engineering employers with DV / SC clearance premium baked in. Big 4 covers Deloitte, EY, KPMG and PwC cyber practices.

Level	Regional	London	FinTech	Big Tech	Defence	Big 4
SOC Analyst (Y1-2)	£30,000 - £42,000	£38,000 - £55,000	£42,000 - £58,000	£55,000 - £75,000	£32,000 - £48,000	£38,000 - £52,000
Security Engineer (2-5 yrs)	£45,000 - £65,000	£60,000 - £85,000	£70,000 - £95,000	£85,000 - £115,000	£50,000 - £72,000	£55,000 - £80,000
Senior / Pen Tester (5-8 yrs)	£65,000 - £95,000	£85,000 - £120,000	£95,000 - £135,000	£125,000 - £170,000	£70,000 - £100,000	£80,000 - £115,000
Principal (8-12 yrs)	£95,000 - £130,000	£125,000 - £170,000	£135,000 - £180,000	£170,000 - £230,000	£100,000 - £140,000	£115,000 - £160,000
Director / Head of Security	£130,000 - £200,000	£170,000 - £280,000	£180,000 - £300,000	£230,000 - £340,000+	£140,000 - £210,000	£160,000 - £260,000
CISO	£150,000 - £260,000	£200,000 - £400,000+	£220,000 - £450,000+	£280,000 - £500,000+	£170,000 - £280,000	£200,000 - £350,000

Source: synthesised from the (ISC)2 Cybersecurity Workforce Study UK cut, the CREST UK Pay Survey, Hays UK Salary Guide (IT), Robert Half UK Technology Salary Guide, ITJobsWatch (security engineer), ITJobsWatch (penetration tester) and Glassdoor company-level postings. Cross-checked against ONS ASHE Table 14 for SOC 2136 and SOC 2139. Retrieved 2026-06-04. Indicative ranges, not a canonical pay scale.

Total compensation: base, bonus, RSU / LTIP, on-call

Headline base salary captures only one component of cybersecurity total compensation (TC), particularly at Big Tech, FinTech and CISO-level FTSE roles. The five TC components are base salary, annual cash bonus, equity grants (Restricted Stock Units at FAANG, options or RSUs at scale-up FinTechs, Long-Term Incentive Plan share grants at FTSE 100 CISO level), sign-on bonus paid in years one and sometimes two, on-call or Incident Response allowance (a fixed monthly stipend or per-incident fee for SOC and DFIR rota duty), and benefits (private medical, employer pension match, life cover). For tax purposes, base, bonus, RSU / LTIP vest and on-call cash are all taxed as employment income at the marginal PAYE rate; sign-on is also employment income. Most benefits are taxable as Benefits in Kind via P11D unless payrolled.

Bonus targets vary sharply by employer tier. Big Tech UK offices set targets at 10% to 25% of base with payouts in the 75% to 125% range of target depending on company and individual performance. FinTech scale-ups set 10% to 20% targets, often pooled across the security team rather than individual. Tier-1 banks pay 25% to 50% target bonus to senior security staff, paid in February of the following year (subject to FCA-aligned clawback / deferral arrangements where the role is within the SMCR scope). UK-corporate and FTSE in-house teams pay 5% to 15% modest bonuses with limited variability. On-call allowance is a structural feature of SOC and Incident Response roles - typically £150 to £500 a week of standby pay plus a per-incident callout fee on top, all taxable as employment income through PAYE. Defence and cleared employers pay a flat clearance-retention allowance on top of base (£3,000 to £8,000 a year for DV holders) which is also taxed as employment income.

LTIP and RSU annualised value is a significant TC component at FTSE CISO level and FAANG Senior Security Engineer level. A FTSE 250 CISO might receive a three-year LTIP share grant worth £120,000 vesting in equal instalments, contributing £40,000 a year before any refresh grants. A FAANG Senior Security Engineer at L5 in London might receive a four-year initial RSU grant worth £220,000 vesting on the standard 25/25/25/25 schedule, contributing £55,000 a year before refresh grants. Worked example: a London FTSE 250 CISO on £225,000 base plus 30% target bonus (£67,500) plus £40,000 annualised LTIP vest. Total compensation is £332,500. All three components flow through PAYE in the year received. With no pension contribution and no student loan, take-home on this gross is £188,011 (£15,668 per month). The effective combined Income Tax plus NI rate is 43.5%, because the marginal pound at this TC level is taxed at 47% (45% additional rate plus 2% NI above the Upper Earnings Limit).

Certification and clearance premium

Cybersecurity certifications materially shorten the hiring funnel for SOC Analyst to Senior Security Engineer roles and continue to register at consultancies, Big 4 and large-corporate buyers throughout the career ladder. The headline credentials by track: CISSP (Certified Information Systems Security Professional from (ISC)2) is the dominant credential for security engineering, architecture and management roles - typically adds £5,000 to £12,000 on Mid-level base offers. CISM (Certified Information Security Manager from ISACA) plays a similar role on the governance and leadership track and is often required for Head of Security positions. OSCP (Offensive Security Certified Professional) is the practitioner credential for offensive / penetration testing roles - adds £8,000 to £18,000 at consultancies and is treated as the minimum technical signal for senior pen test work. CREST CPSA (Practitioner Security Analyst), CRT (Registered Tester) and CCT (Certified Tester) form the UK regulator-aligned ladder for CHECK-scheme penetration testing engagements with government and Critical National Infrastructure clients. GIAC credentials (SANS GSEC, GCIH, GPEN, GXPN, GCFA, GREM) are expensive (£5,000 to £8,000 a cert via SANS training) but materially shorten the hiring funnel at large-corporate buyers and US-tech UK offices.

Penetration testing specialists earn a +15% to +25% premium over generalist security engineering at the same nominal level. The premium is driven by the CHECK / CREST regulatory framework (which requires accredited individuals on every CHECK engagement at the IT Health Check Service intermediate level and above), the OSCP / CREST CCT credentialling barrier, and the limited supply of testers fluent across web, network, mobile, Active Directory and cloud-native attack chains. Cleared (DV / SC) penetration testers commanding outside-IR35 day rates from the intelligence community routinely hit £900 to £1,200, materially above commercial-sector cyber day rates.

UK government security clearance adds a structural pay premium because the cleared candidate pool is small and the contracts that require clearance are well-funded. Security Check (SC) clearance, valid for roles touching SECRET-level material, adds roughly +20% to +25% over equivalent-level commercial roles at defence primes (BAE Systems, Raytheon UK, Leonardo, Lockheed Martin UK, QinetiQ) and cleared consultancies (NCC Group, BAE Systems Digital Intelligence, Roke, Capgemini Public Sector). Developed Vetting (DV) clearance, required for TOP SECRET material at GCHQ, NCSC, MoD strategic systems and intelligence community work, adds +30% to +40% with a small premium on top for the rarer combined DV plus technical-cyber skill profile. The vetting process itself takes 6 to 18 months and is not portable to commercial sponsors - candidates who have already passed are at a structural advantage. Defence employers commonly pay a separate flat clearance-retention allowance (£3,000 to £8,000 a year for DV holders) on top of base, taxable as employment income through PAYE.

Take-home matrix: five cybersecurity scenarios

Engine-verified take-home for five representative scenarios spanning the career ladder, using 2026/27 HMRC rates. 0% pension contribution to show the gross PAYE effect honestly - the salary sacrifice section below shows how the 60% trap is mitigated in practice. No student loan, no benefits, no further bonus or RSU added on top of the stated gross. England rates.

Scenario	Gross	Income Tax	NI	Annual take-home	Monthly	Effective rate
SOC Analyst (regional)	£40,000	£5,486	£2,194	£32,320	£2,693	19.2%
Security Engineer (London)	£75,000	£17,432	£3,511	£54,057	£4,505	27.9%
Senior Pen Tester (60% trap)	£105,000	£30,432	£4,111	£70,457	£5,871	32.9%
Principal (additional rate)	£160,000	£58,203	£5,211	£96,586	£8,049	39.6%
CISO TC (additional rate)	£300,000	£121,203	£8,011	£170,786	£14,232	43.1%

The effective rate climbs from 19.2% at the SOC Analyst scenario to 43.1% at the CISO TC scenario. The Senior Pen Tester £105,000 row sits squarely inside the 60% PA-taper band: every pound between £100,000 and £125,140 attracts 40% Income Tax plus an extra 20% effective hit from the disappearing Personal Allowance. The Principal £160,000 and CISO £300,000 rows are entirely above £125,140, so the marginal rate steadies at 47% (45% additional rate plus 2% NI). The gap in take-home between Principal (£160k) and CISO TC (£300k) is £74,200, despite a £140,000 gross gap - the additional-rate band absorbs 47p of every additional pound.

Salary sacrifice optimisation for the 60% trap

The single most effective tax optimisation for a UK cybersecurity engineer earning between £100,000 and £125,140 is salary sacrifice into pension. Sacrificing the slice between £100,000 and your base reduces taxable income below the Personal Allowance taper threshold, recovers the full £12,570 PA, and avoids the 60% effective marginal rate. The contribution also escapes employee NI (2% above the Upper Earnings Limit), and depending on employer policy may attract some or all of the saved employer NI (15% in 2026/27) as additional pension contribution. The scenario below uses a Senior Pen Tester sitting at the top of the taper band (£125,140) sacrificing the full £25,140 down to £100,000 taxable.

Scenario	Gross	Pension sacrifice	Income Tax	NI	Take-home	Pension built
Senior, no sacrifice	£125,140	£0	£42,516	£4,513	£78,111	£0
Senior, sacrifice £25,140 to £100k taxable	£125,140	£25,140	£27,432	£4,011	£68,557	£25,140

The £25,140 sacrifice costs only £9,553 in take-home (the foregone net pay after Income Tax and NI on that slice), yet builds £25,140 of pension. The implicit return on net cash sacrificed is roughly 163% before any employer NI top-up - the highest pre-tax-arbitrage return available to a UK PAYE earner. Cross-check the optimisation with our salary sacrifice calculator and pension contribution calculator.

Caveats. The Annual Allowance (£60,000 in 2026/27, with a taper from £200,000 adjusted income down to £10,000 for the highest earners) caps total pension input. Carry-forward of the previous three tax years' unused allowance is available. For a Head of Security or CISO with total comp above £260,000 (where the tapered Annual Allowance may have already bitten), bespoke pension scheme arrangements via a personal financial planner are essential. The 60% trap mitigation arithmetic at the £100k to £125,140 boundary applies even more sharply when RSU vests push base into the band - timing the sacrifice election against the vest schedule materially improves the after-tax outcome.

Contractor PSC vs umbrella after IR35

Day-rate contracting was historically the standard route for senior cybersecurity engineers and penetration testers in the UK, particularly for cleared engagements with defence and intelligence-community buyers. The 2017 public-sector and 2021 private-sector off-payroll working reforms transferred the IR35 status determination from the contractor to the end-client, and where the role is determined inside IR35 the fee-payer (typically the agency) deducts Income Tax and employee Class 1 NI from the deemed payment, plus a deduction for employer NI and Apprenticeship Levy from the contract rate. The practical effect is that an inside-IR35 contractor pays roughly PAYE rates on the contract revenue net of those statutory deductions, with no access to the Limited-company tax efficiencies that defined the pre-reform contracting model.

Worked example: a Senior cyber contractor on a £900/day rate billing 200 days in the year generates £180,000 of revenue (utilisation is structurally lower than DevOps because of pre-engagement clearance vetting gaps and CHECK / CREST scoping overhead). Inside IR35, that flows through PAYE on roughly the full headline, with take-home of £107,186 after Income Tax and NI - similar to a permanent salaried role at the same gross, but without paid holiday, sick pay, employer pension matching or RSU. Via an FCSA-accredited umbrella company, the assignment rate is reduced for employer NI (15% above the secondary threshold in 2026/27), Apprenticeship Levy (0.5%), umbrella margin (typically £15 to £30 a week) and Holiday Pay accrual, leaving the worker an effective taxable gross of roughly 86% of the headline contract value - on this scenario £154,800, producing take-home of £93,830.

Outside-IR35 contracts via a Personal Service Company (PSC) remain available but are now concentrated at boutique CREST / CHECK-approved consultancies, smaller end-clients and cleared-defence engagements with a clear contractor-only delivery model rather than the FTSE / banking / public-sector buyer base that historically anchored the market. Where outside IR35 applies, the contractor route can split the revenue between a modest director salary, dividends (taxed at 8.75% / 33.75% / 39.35%), and pension contribution made directly from the company (escaping Corporation Tax, employer NI and personal Income Tax) - subject to the Managed Service Company (MSC) anti-avoidance rules, the disguised-remuneration rules, and the broader requirement that the contract genuinely sit outside IR35 on a substantive employment-status assessment (mutuality of obligation, control, substitution, financial risk). The strongest contractor-route economics in cyber today: outside-IR35 DV-cleared penetration testing for the intelligence community, and outside-IR35 Cloud Security Architecture for early-stage FinTech where the engagement is genuinely project-bounded. Cross-check the arithmetic with our contractor tax calculator and dividend tax calculator.

Sector comparison: FAANG vs FinTech vs Defence vs Big 4

Senior-level comparison at six representative employer types. All figures use base salary only for an apples-to-apples PAYE comparison; the RSU / LTIP and bonus components on top materially shift the total compensation picture at FAANG (RSU-heavy), FinTech (pre-IPO equity-heavy) and FTSE 100 CISO roles (LTIP-heavy). England, 0% pension, no student loan.

Sector	Base gross	Income Tax	NI	Annual take-home	Monthly	Notes
UK FTSE / mid-market in-house cyber	£95,000	£25,432	£3,911	£65,657	£5,471	Stable; matched DC pension common
Big 4 cyber (Deloitte, EY, KPMG, PwC)	£110,000	£33,432	£4,211	£72,357	£6,030	Senior Manager grade; partnership track
Defence / cleared (BAE, Raytheon, Leonardo, NCC)	£105,000	£30,432	£4,111	£70,457	£5,871	DV / SC clearance premium baked in
Boutique consulting (NCC, F-Secure, PortSwigger)	£120,000	£39,432	£4,411	£76,157	£6,346	CHECK / CREST partner; specialist rates
FinTech scale-up (Wise, Revolut, Monzo)	£140,000	£49,203	£4,811	£85,986	£7,166	High base plus equity / RSU; AppSec focus
FAANG / Big Tech London Sec Eng	£165,000	£60,453	£5,311	£99,236	£8,270	Base plus 15-25% bonus plus £55-90k RSU

The FAANG Big Tech Senior at £165,000 base takes home £33,579 more per year than the UK FTSE in-house Senior at £95,000, despite a £70,000 gross gap - the additional-rate band claws back 47p of every pound above £125,140. The FAANG Senior at £165,000 and the FinTech Senior at £140,000 both sit firmly in the 45% additional-rate band on base alone, but the headline TC differentiation comes from RSU / equity vests not shown in this base-only comparison. The Defence Senior at £105,000 sits at the bottom of the 60% PA-taper band on base alone, with a separate clearance-retention allowance (£3,000 to £8,000 a year for DV holders) on top.

Career progression: worked example

A realistic UK cybersecurity career trajectory. Times-in-grade are typical for a high-performing trajectory at a London consultancy or FinTech with one or two moves between firms to accelerate level progression. UK-corporate, FTSE in-house and defence ladder progression is slower, with internal-promotion-only ladders frequently adding 2 to 3 years to each step. Take-home uses England 2026/27 rates, 0% pension and no student loan to show the gross tax effect of each promotion.

Stage	Typical timing	Gross	Income Tax	NI	Annual take-home	Monthly
SOC Analyst (regional)	Year 0 - 2	£38,000	£5,086	£2,034	£30,880	£2,573
Security Engineer (London)	Year 3 - 5	£80,000	£19,432	£3,611	£56,957	£4,746
Senior Pen Tester (London)	Year 6 - 8	£115,000	£36,432	£4,311	£74,257	£6,188
Principal Security Architect (London)	Year 9 - 12	£160,000	£58,203	£5,211	£96,586	£8,049
Head of Security / Deputy CISO	Year 13 - 16+	£210,000	£80,703	£6,211	£123,086	£10,257

SOC Analyst to Security Engineer adds £42,000 gross / £26,078 take-home, crossing into the 40% Income Tax band at £50,270. Security Engineer to Senior Pen Tester adds £35,000 gross / £17,300 take-home - the smaller-than-expected take-home delta reflects the 60% PA taper biting between £100,000 and £125,140. Senior to Principal adds £45,000 gross / £22,329 take-home at the 47% additional rate-plus-NI band, and Principal to Head of Security adds another £50,000 gross / £26,500 take-home. The implication: above Senior, base-salary negotiation alone has rapidly diminishing returns and salary sacrifice plus carry-forward pension optimisation become the dominant levers for marginal-after-tax-pound improvement.

Comparison vs Senior SWE, Senior DevOps, Senior Pen Tester

Senior Cybersecurity / Security Engineer FAANG pay (£165,000 base) is identical to Senior Software Engineer and Senior DevOps / SRE at the same firm (L5 grade) - the bands are explicitly aligned. Senior Pen Tester at a top London consultancy sits one band below on base, although outside-IR35 day-rate contracting can close that gap meaningfully where the engagement model permits. All four roles attract candidates from broadly the same applicant pool of London-based STEM graduates and mid-career tech moves. Base salaries only - excluding bonus, RSU and partnership / Director track, which materially shift total compensation.

Role	Gross	Annual take-home	Monthly	Notes
Senior Cybersecurity / Security Eng FAANG (London)	£165,000	£99,236	£8,270	Base only, mid of band
Senior Software Engineer FAANG (London)	£165,000	£99,236	£8,270	L5 base, like-for-like seniority
Senior DevOps / SRE FAANG (London)	£165,000	£99,236	£8,270	Parallel ladder at the same firm
Senior Pen Tester (London consultancy)	£110,000	£72,357	£6,030	CREST CRT / OSCP credentialled

Senior Security Engineer, Senior Software Engineer and Senior DevOps / SRE FAANG sit at identical base scales at Google, Meta and Amazon - the bands are explicitly aligned across the three engineering tracks. The Senior Pen Tester at £110,000 at a top London consultancy sits at the lower end of the 60% PA-taper band on base alone; outside-IR35 day-rate engagements at £900 to £1,200 (where the engagement still permits) materially close the gap. All four roles sit at or above the 40% higher-rate band on base alone, so take-home differentials shrink relative to gross differentials - the progressive tax system absorbs roughly 47p of every gross pound above £125,140.

UK software engineer pay - parallel ladder at FAANG and across tech employers.
UK DevOps engineer pay - SRE / Platform Engineering ladder at the same firm.
UK data scientist pay - Big Tech, HFT, Bank tier and scale-up comparison.
UK UX / Product Designer pay - Lead and Director ladder at scale-ups and agencies.
Investment banker pay - IB Associate base and bonus structure at the City bank tier.
All UK professions - browse the full directory.

Frequently asked questions

How much does a UK cybersecurity engineer earn in 2026/27?: UK cybersecurity pay is wide. A SOC Analyst in a regional Security Operations Centre earns £30,000 to £42,000 base; the same role at a London FinTech earns £42,000 to £58,000. A Senior Security Engineer or CHECK / CREST-certified penetration tester at a London consultancy earns £85,000 to £120,000 base. A Principal Security Architect at a FAANG London office reaches £170,000 to £230,000 base, with RSU vests and bonus pushing total compensation past £300,000. A FTSE 100 CISO commands £250,000 to £500,000 total compensation. Figures here are indicative ranges synthesised from the (ISC)2 Cybersecurity Workforce Study UK cut, the CREST UK Pay Survey, Hays UK IT, Robert Half UK Technology, ITJobsWatch and Glassdoor company postings.
Is cybersecurity pay better than software engineering or DevOps?: At the SOC Analyst entry level cybersecurity pay sits slightly below comparable Junior software or DevOps roles, because the SOC Analyst function is closer to a tier-1 operational role than an engineering build role. From Security Engineer (Year 2+) upwards, cybersecurity pay converges with software engineering and DevOps at the same firm and the same level - the bands at FAANG London for Senior Security Engineer (L5) and Senior Software Engineer (L5) are explicitly aligned. Specialist tracks earn a meaningful premium: penetration testing carries +15% to +25% over generalist security engineering, cleared (DV / SC) roles add +20% to +40%, and CISO / Head of Security commands a leadership premium of 30% to 80% over equivalent-level non-leadership engineering roles.
What is the salary premium for CISSP, OSCP, CREST and GIAC certifications?: The big four UK cybersecurity certifications carry different premiums by track. CISSP (Certified Information Systems Security Professional from (ISC)2) is the headline credential for security engineering / architecture / management roles - typically adds £5,000 to £12,000 on Mid-level base offers and is a hard hiring filter at consultancies, Big 4 and large-corporate buyers. CISM (Certified Information Security Manager from ISACA) plays a similar role on the governance / leadership track and is often required for Head of Security positions. OSCP (Offensive Security Certified Professional) is the dominant practitioner credential for offensive / penetration testing roles - adds £8,000 to £18,000 at consultancies. CREST CPSA / CRT / CCT is the UK regulator-aligned penetration testing ladder, mandatory for CHECK-scheme work and adds a further premium on top of OSCP for cleared engagements. GIAC (SANS GSEC, GCIH, GPEN, GXPN, GCFA, GREM) credentials are expensive (£5,000 to £8,000 a cert) but materially shorten the hiring funnel and add the SANS-trained signal at large-corporate buyers and US-tech UK offices.
What is the security clearance (DV / SC) pay premium in the UK?: UK government security clearance adds a structural pay premium because the cleared candidate pool is small and the contracts that require clearance are well-funded. Security Check (SC) clearance, valid for roles touching SECRET-level material, adds roughly +20% to +25% over equivalent-level commercial roles at defence primes (BAE Systems, Raytheon UK, Leonardo, Lockheed Martin UK, QinetiQ) and cleared consultancies (NCC Group, BAE Systems Digital Intelligence, Roke, Capgemini Public Sector). Developed Vetting (DV) clearance, required for TOP SECRET material at GCHQ, NCSC, MoD strategic systems and intelligence community work, adds +30% to +40% with a small premium on top for the rarer combined DV + technical-cyber skill profile. The vetting process itself takes 6 to 18 months and is not portable to commercial sponsors - candidates who have already passed are at a structural advantage. Day-rate contractor work for cleared cyber engagements regularly hits £900 to £1,200 outside IR35 where the engagement model still permits it.
How much can a UK cybersecurity contractor earn on day rates?: Mid-level cybersecurity contractor day rates sit at £450 to £700; Senior CHECK / CREST penetration tester £650 to £950; Principal Security Architect £800 to £1,200+ for the rare outside-IR35 cleared niche-specialism roles. Assuming 200 billable days a year (lower than DevOps because of pre-engagement clearance vetting and CHECK / CREST scoping overhead), a £900 day rate generates £180,000 of revenue. Inside IR35 that flows through PAYE on roughly the full headline, with no Limited-company corporation-tax efficiency. Outside IR35 via a Personal Service Company, the same revenue can be split between modest director salary, dividends and pension contribution for materially better post-tax outcomes - subject to MSC and disguised-remuneration anti-avoidance rules. Outside-IR35 contracts remain available at boutique consultancies, smaller end-clients and cleared-defence engagements where a substantive employment-status test favours the contractor.
Should I go contractor or stay PAYE as a senior penetration tester?: After the 2021 private-sector off-payroll reform, most large UK clients now classify cybersecurity contracts as inside IR35 by default - particularly at FTSE 100 buyers, banks and the public sector. Where the role is inside IR35 the fee-payer (agency or client) deducts Income Tax and employee NI from the deemed payment, so the contractor effectively pays full PAYE on the gross day-rate revenue with limited expense relief. Compared with permanent base at a similar gross, the contractor route loses access to employer pension matching, paid holiday, sick pay, and any RSU / LTIP. Outside-IR35 contracts remain valuable but are now concentrated at smaller clients, niche CREST / CHECK-approved consultancies, and cleared-defence engagements with clear contractor-only delivery models. The strongest contractor-route economics in cyber today are: outside-IR35 DV-cleared penetration testing for the intelligence community, and outside-IR35 Cloud Security Architecture for early-stage FinTech where the engagement is genuinely project-bounded.
How are CISO and Head of Security roles paid in the UK?: CISO and Head of Security pay sits at the intersection of an engineering-leadership track and a board-facing operational risk role. At UK FTSE 250 buyers a CISO commands £200,000 to £350,000 total compensation, with 70% to 75% base and the balance in bonus plus modest LTIP. At FTSE 100 buyers, particularly in banking and energy / utilities (where operational resilience is regulated), CISO TC reaches £300,000 to £500,000+ with deferred LTIP share grants. CISO of a US-listed Big Tech UK subsidiary or a major FinTech scale-up can hit £400,000 to £600,000 TC inclusive of RSU. Below the CISO, the Head of Security / Director of Information Security role pays £170,000 to £280,000 base in London. The principal tax mechanic at this band is that base alone sits firmly in the 45% additional-rate band above £125,140, and bonus / LTIP vests are taxed as employment income at the same marginal rate through PAYE.
What is the 60% tax trap and how does it affect senior cybersecurity engineers?: Between £100,000 and £125,140 of adjusted net income the Personal Allowance tapers at £1 lost for every £2 over £100,000. Combined with the 40% higher rate and 2% NI above the Upper Earnings Limit, the effective marginal rate on that slice is roughly 62%. Most Senior Security Engineers and Senior Pen Testers in London cross into this band on base alone; RSU and LTIP vests push them deeper. Salary sacrifice into pension that takes adjusted net income below £100,000 is the standard mitigation. On £125,140 base, sacrificing the full £25,140 to land at £100,000 taxable saves roughly £15,000 in combined Income Tax and NI versus taking that slice as salary - the highest pre-tax-arbitrage return available to a UK PAYE earner.
What are the main UK cybersecurity specialisations and their pay deltas?: Nine specialisations structure the UK cybersecurity market in 2026, each with a distinct pay envelope. Penetration Testing / Red Team (offensive, CREST CCT and OSCP credentialled) carries the largest practitioner premium at +15% to +25% over generalist security engineering. SOC / Detection Engineering / Blue Team (defensive, SIEM and detection rule development) pays close to the generalist median and progresses fastest into Threat Intelligence leadership roles. Cloud Security (AWS / Azure / GCP security posture management, IAM, key management, container runtime security) commands a +10% to +20% premium driven by the cloud build-out. DevSecOps and AppSec (SAST / DAST / IAC scanning, secure software development, SBOM and supply-chain hardening) pays near identical to senior DevOps. Identity and Access Management (IAM, PAM, Zero Trust architecture) is at the heart of every FinTech and Big Tech security org. GRC (Governance, Risk and Compliance, including FCA SS1/21 operational resilience, NIST CSF and ISO 27001 implementation) pays slightly below technical security engineering at the same grade. Digital Forensics and Incident Response (DFIR, GIAC GCFA / GREM credentialled) pays a +15% premium at top consultancies. Threat Intelligence and Threat Hunting commands a premium at financial-crime-heavy FinTechs. Security Architecture leads the leadership ladder above Principal toward Head of Security and CISO.
Do FinTechs and tier-1 banks pay competitive cybersecurity salaries in London?: Yes. JPMorgan, Goldman Sachs, Morgan Stanley, Bank of America, Citi and Barclays Investment Bank pay Senior Security Engineers £110,000 to £150,000 base, with 25% to 50% target bonuses paid in February of the following year. Total cash compensation typically sits below FAANG (when RSU is included) but well above UK-corporate in-house. Scale-up FinTechs (Wise, Revolut, Monzo, Starling, Tide, GoCardless, Plaid, Stripe) have priced cybersecurity pay against Big Tech - Senior Security Engineer / AppSec at a Series C / D FinTech commands £115,000 to £155,000 base plus equity / RSU. The equity component is more volatile than FAANG: pre-IPO grants are valued against an internal 409A valuation, with a meaningful chance of zero value at exit. Post-IPO FinTechs (Wise PLC, Monzo Bank) grant tradeable RSUs taxed via PAYE at vest plus CGT on subsequent sale.
How is RSU compensation taxed for UK cybersecurity engineers at FAANG?: Restricted Stock Units are taxed as employment income at the marginal Income Tax rate plus employee Class 1 National Insurance at the point they vest, not when granted or sold. The employer withholds the tax via PAYE - typically by selling enough shares at vest to cover the liability (sell-to-cover). When you later sell the retained shares, Capital Gains Tax applies only on the gain above the vest-date market value. The vest-date value becomes your CGT cost basis. See HMRC ERSM 20300 for the statutory treatment. For a Senior Security Engineer at a FAANG London office on £150,000 base plus £55,000 annualised RSU vest, every pound of the RSU is taxed at 47% (45% additional rate plus 2% NI above the Upper Earnings Limit) - so a £55,000 vest delivers roughly £29,000 of net new cash after PAYE.

Sources

Cybersecurity pay in the UK is not published by a single primary authority. Figures on this page are synthesised from the industry-standard cybersecurity workforce, recruiter, self-reported and statistical references listed below, with tax mechanics and contractor status drawn from HMRC technical manuals.

(ISC)2 Cybersecurity Workforce Study - UK cut Retrieved 2026-06-04. Industry-standard reference for cybersecurity workforce size and salary distribution.
CREST UK Pay Survey and Member Firm Directory Retrieved 2026-06-04. CHECK / CREST-aligned penetration testing market data.
Hays UK Salary Guide - IT and Technology chapter Retrieved 2026-06-04. Recruiter-published; broadly cited in trade press.
Robert Half UK Technology Salary Guide Retrieved 2026-06-04. Recruiter-published; covers security engineering, AppSec, GRC and incident response.
ITJobsWatch - security engineer median pay and day rate Retrieved 2026-06-04. Job-posting aggregation; primary day-rate trend source.
ITJobsWatch - penetration tester median pay and day rate Retrieved 2026-06-04. Job-posting aggregation; primary day-rate trend source for offensive cyber.
Glassdoor UK - company-level cybersecurity salary postings Retrieved 2026-06-04. Self-reported by employees and job-posting aggregation.
ONS ASHE Table 14 - SOC 2136 and SOC 2139 medians Retrieved 2026-06-04. UK occupational medians; primary statistical authority for the closest SOC buckets.
HMRC Employment Status Manual ESM8000 (IR35 / off-payroll) Retrieved 2026-06-04. Statutory guidance for the 2017 and 2021 off-payroll working reforms.
HMRC - Rates and thresholds for employers 2026/27 Retrieved 2026-06-04. PAYE bands, NI thresholds and PA taper.
Our full methodology & calculation sources →