Computer systems security

Answer 1

Depends on the job requirements,

In the USA some broad numbers are anywhere from $45K annually for a relatively unskilled worker.

$250,000 annually for a skilled practioner with experience as a penetration tester, Chief Security Officer who has developed and implemented security policy as strategy and versed with privacy laws and regulations in the USA and international venues.

This same individual will likely have a resume which resembles a master tradesman like a master electrician who started out as systems administrator of Win32, UNIX/LINUX and network operating systems such as Cisco IOS/CatOS who leveraged their extensive system knowledge to approach and design systems from the security perspective while maintaining functionality and with little impact on the end user experience.

The best security practioners are skilled sys admins at the core since this fundamental knowledge is crucial to understanding risk proposition and determining real level of effort when designing security implementations and practices of common technologies.

NASA doesn't train pilots, NASA recruits top military pilots and trains them to fly spacecraft, a top security practioner is the same example.

Certifications make a huge difference, the most common is the Certified Information Systems Security Professional, however the actual exam itself is banal and less challenging then picking your nose with your left hand. More organizations are recognizing the lack of value of the CISSP since too many of them have joined companies and ruined their security and had to be fired because they talked their way into $90K jobs when they were really more like $45k people.

The majority of CISSP's are IT auditors, and the great majority of IT auditors are just financial auditors and Accountants "who are good with computers" and have a less than adequate understanding of how to efficiently design systems and the security protecting those systems. These are the kinds of people that find the CISSP exam challenging and have to study for weeks or months since they're really trying to learn the tradecraft for the first time as they're about to take a certification exam which claims to require 10 years of computer/InfoSec experience (but never really verified).

ISC2 who administers the CISSP designed the test around 10 domains, one including ethics which is laughable since the same organization plagiarized a law journal for the Legal domain. Rather sad for a "non-profit" group that charges $500 for a test and they couldn't afford to license or develop original content.