CISO Salary 2026
What a Chief Information Security Officer Earns in the US, UK, UAE and Saudi Arabia

The key insight:

The title tells you very little about what a CISO earns. Who they report to, and whether they can take bad news straight to the board, tells you most of it.

A CISO, or chief information security officer, earns somewhere between a function director and a Chief Information Officer, and where you sit in that range depends mostly on one thing: who you report to. A CISO who reports into the CIO is paid like a strong director. A group CISO with a direct line to the chief executive or the board, in a bank or a critical infrastructure business, is paid like a member of the executive team.

This guide sets out JOH Partners benchmarks for the CISO role in 2026 across the US, UK, UAE and Saudi Arabia, explains why the reporting line moves the number so much, covers the regulated sectors where pay runs highest and shows how the package is built. It is about the security line only. For the technology leaders around the CISO, see our guides to Chief Information Officer pay and IT director pay.

What a CISO earns, market by market

There is no single CISO band in our data, because there is no single CISO job. We price the role against two bands we already publish, chosen by the reporting line. These are JOH Partners benchmarks for 2026, total annual package, meaning base plus bonus plus the cash value of benefits.

The first column is the function or divisional director band from our director and executive salary guide. The second is the same band we publish for a Chief Information Officer. Above both sits the operational Chief Technology Officer at USD 350,000 to 650,000, GBP 200,000 to 380,000 and AED 1.4m to 2.8m.

Saudi Arabia does not have a published SAR figure for this tier in our data, so we have not given one. What we can say is what our CEO and C-suite benchmarks for the Gulf already set out: senior pay in the Kingdom has risen sharply, and for the right leader it now matches or exceeds the UAE.

If you want your own package placed against these bands, Your market value compares it on scope, sector and reporting line rather than on title alone.

Who the CISO reports to, and why it changes pay

Most of the spread in CISO pay comes from the reporting line. It decides three things at once: how much risk you personally carry, how close you are to the board and how independent your view is.

Reporting into the CIO. This is still the most common set-up. You own the security programme, but your findings travel through the person whose systems you are testing. The role is serious and often hard, but it is priced as a function head because, structurally, that is what it is.

Reporting to the chief executive, the chief risk officer or another executive outside technology. Your view reaches the top without being filtered by the technology line. You sit closer to the risk and audit committees, and you are more likely to be named in front of a regulator when something goes wrong. Boards pay for that exposure, and the package moves into the CIO band.

Dotted line to the audit or risk committee. Many regulated businesses give the CISO direct access to a committee chair, even where the solid line runs elsewhere. In our mandates that access is a strong signal of how seriously the business treats the role, and it usually moves the offer towards the top of whichever band applies.

JOH Partners' view on who tells the board the truth about security makes the same point from the board side. A security head who reports to the CIO is, in effect, grading their own manager's work, and findings tend to be softened on the way up even when nobody intends it. When you weigh an offer, ask how bad news has reached the board in the past year, and who carried it.

Regulated sectors: banking and critical infrastructure

Sector moves the number almost as much as the reporting line. Banking, insurance, payments, energy, utilities, telecoms and government-related entities pay most, because the cost of a failure there is highest and regulators hold named people to account for it.

Disclosure rules have made that accountability public. In the United States, the SEC's 2023 rule requires listed companies to describe management's role and expertise in assessing and managing cybersecurity risk in their annual report, and to disclose a material cyber incident generally within four business days of deciding it is material. That puts the CISO's experience in front of investors in a way most function heads never face.

In the UK, the National Cyber Security Centre's Board Toolkit states plainly that board members have a critical role in keeping their organisations resilient and secure. Once a board accepts that responsibility, it needs someone it trusts to report to it directly, and that is the CISO role that prices in the higher band.

Within a sector, four further things move the package:

• Size and criticality of what you protect. Core banking, payment rails, operational technology in a plant or grid, and national-scale data price above a standard corporate estate.
• Incident history. A CISO who has led a real incident response, with the regulator and the board involved, carries evidence the market pays for.
• Scope beyond cyber. Some CISOs also own fraud, physical security, resilience or data privacy. Each adds risk and adds pay.
• Team and budget. Running a security operation of a few people is a different job from running a global function with its own managers.

Base, bonus and long-term incentive

A CISO package is built the same way as other senior packages, with a few details worth checking.

The last row is specific to this role. A CISO can be named personally after a breach, so ask whether the company's insurance and indemnity cover you, and on what terms, before you sign. It costs the employer little to confirm and can matter a great deal later.

Notice periods and restrictions also tend to be longer in security roles, because a CISO leaving for a competitor takes knowledge of every weakness with them. If an employer asks you to spend your notice at home, our guide to garden leave explains how that works and what to negotiate. For how the bonus, long-term incentive and benefits combine, our guide to total reward sets out the full sequence.

CISO pay in the UAE and Saudi Arabia

In the Gulf, demand for security leaders comes mainly from banking, national digital programmes and large government-related groups.

UAE. JOH Partners places a CISO reporting into technology at AED 700,000 to 1.6m, and a group CISO with a board line in a bank or a major government-related entity at AED 1.2m to 2.4m. The UAE government portal confirms that the UAE does not levy income tax on individuals, so gross sits close to net. Packages commonly add housing, schooling and annual flights. Compare a UAE offer with a home-market one on net value including benefits, which our guide to total compensation beyond base salary in the GCC shows how to do.

Saudi Arabia. The National Cybersecurity Authority publishes the Essential Cybersecurity Controls that apply to national entities. As the JOH insight above sets out, the authority expects the cybersecurity function to be independent of IT, with its head reporting to the head of the organisation or a delegate. That has pushed many Saudi entities towards the higher-band version of the role, and with Vision 2030 demand on top, senior security packages have risen. For the right profile they compete with, and sometimes exceed, the UAE.

A practical point for Gulf candidates: the reporting line on the organisation chart and the reporting line in practice are not always the same. Ask who you will actually brief each month, and whether you will meet the audit committee chair without the CIO in the room.

How the CISO role differs from the CIO

The two roles sit close together and are often confused, so it is worth being clear.

A CIO owns the internal technology estate: the systems, the data and the technology that runs the business. Their job is to build and run it well, on budget.

A CISO owns the security of that estate: the risk register, the controls, the testing, the response when something goes wrong and the honest report to the board about where the business is exposed. Their job is to test and challenge.

That difference is why the reporting line matters so much. When the CISO reports to the CIO, the person who challenges the estate reports to the person who runs it. Some businesses manage that well. Many regulators and boards prefer not to rely on it. Where there is no separate CISO, the CIO carries the security accountability directly, which is one of the reasons our CIO guide prices that version of the role higher.

The route into the role also differs. Many CISOs come up through security engineering, audit or risk rather than general technology leadership. If you are a security director looking at your first CISO role, the gap is usually less technical than you expect. It is about briefing a board in plain language, holding your ground with senior peers and staying steady when an incident is live. You can take the free Leadership Psychometric, a 50-question leadership profile built by executive recruiters, to see how you score on Influencing Power and Composure before a board tests them for you. For engineering leaders weighing a move across, this week's guide to director of engineering salary covers the parallel track.

More benchmarks for senior technology and executive roles are in our Salary & Market Data collection.

Key takeaways

• A CISO, or chief information security officer, earns between a function director and a CIO, depending mainly on the reporting line.
• JOH Partners places a CISO reporting into technology at USD 165,000 to 300,000, GBP 95,000 to 150,000 and AED 700,000 to 1.6m in total package.
• A group CISO with a chief executive or board line prices in the CIO band: USD 300,000 to 550,000, GBP 170,000 to 300,000 and AED 1.2m to 2.4m.
• Banking, payments, energy, utilities and government-related entities pay most, because regulators and disclosure rules hold named people to account.
• In Saudi Arabia, the cybersecurity regulator's expectation of independence from IT has pushed many entities towards the higher-band role, and senior pay has risen under Vision 2030.
• Check how the bonus is measured, whether long-term awards carry deferral or clawback, and whether insurance and indemnity cover you personally after an incident.

JOH Partners Intelligence

Get the fortnightly brief on GCC careers, salaries, and market moves.

No spam. Unsubscribe any time.