Do cybersecurity salaries vary by location?

Cybersecurity pay varies meaningfully by geography even with the rise of remote work. The Bureau of Labor Statistics (Occupational Employment and Wage Statistics, May 2024) lists the highest-paying U.S. metropolitan areas for information security analysts as San Jose-Sunnyvale-Santa Clara CA (mean $168,250), New York-Newark-Jersey City (mean $145,320), and Washington-Arlington-Alexandria DC-VA-MD (mean $139,890). The national mean across all metros is $124,910. The spread between top and median metros is roughly $20,000 to $40,000 for the same job title.

The Washington D.C. metro corridor has the highest concentration of cybersecurity jobs by count. CyberSeek (October 2024) reports the D.C./Northern Virginia/Maryland region as the densest market in the country because of federal agencies, the intelligence community, and the defense contractor base. Federal civilian positions use the OPM General Schedule (GS) pay scale with locality adjustments that add 25% to 35% to base pay in the D.C., San Francisco, and New York locality areas per OPM 2024 pay tables.

Cost of living changes the calculus. A $130,000 base in San Francisco has roughly the same purchasing power as $95,000 to $105,000 in Dallas-Fort Worth or Tampa per the Bureau of Economic Analysis (Regional Price Parities, 2023). Several metros offer competitive cybersecurity markets with significantly lower costs: Dallas, Atlanta, Denver, Tampa, Raleigh, and Phoenix all run strong on-site hiring with compensation closer to the national median and housing costs 40% to 60% below San Francisco.

Concrete metro examples. A Security Engineer with five years of experience earns roughly $145,000 to $180,000 in San Francisco or Seattle, $125,000 to $160,000 in Washington D.C. metro, $110,000 to $140,000 in Atlanta or Dallas, and $95,000 to $125,000 in mid-tier metros like Pittsburgh or Indianapolis. A Tier 1 SOC Analyst with Security+ and one year of helpdesk opens at roughly $80,000 to $95,000 in D.C. metro, $58,000 to $72,000 in Atlanta, and $52,000 to $65,000 in lower-cost metros.

Remote work has narrowed but not eliminated geographic spread. Many employers now hire nationally for SOC analyst, GRC analyst, and security engineer roles. Some pay flat national rates. Others use location-tiered bands (typically three to five tiers, with the highest tier reserved for top-five U.S. metros). The post-2024 trend at large enterprises has been toward hybrid work with two to three on-site days, which partially restores geographic pay differentials.

Decision logic on where to locate. Pick D.C./Northern Virginia if you want federal contractor density, security clearance opportunities, and the highest job count per square mile. Pick San Francisco/Seattle if you want top-tier compensation, vendor-side roles, and tolerance for high cost of living. Pick Atlanta, Dallas, Denver, Tampa, or Raleigh if you want strong cybersecurity hiring with reasonable housing costs and a growing tech base. Pick a low-density market only if you have a remote-friendly employer locked in.

Tradeoffs to acknowledge. Higher-pay metros also mean higher housing, higher state and city taxes (in California and New York), and longer commutes. A $145,000 salary in San Francisco often produces less savings than a $115,000 salary in Dallas after taxes and rent. The arithmetic favors mid-cost metros for most cybersecurity professionals who are not specifically targeting vendor headquarters work.

For role and location-specific compensation context, see the related career entries for soc-analyst and security-engineer, the certification entry for comptia-security-plus, and the glossary entry for security-operations-center.