What industry? I've never seen anything close to these averages for hard science research.

More than 80% of the data scientists I've worked with who were born before 1978 have physics phds and went through that trajectory. Data scientists younger than that have a wider variety of degrees, often computer science and/or applied math. But I don't know if most people count data science as a real scientific field.

I have friends in the bio/medical side (phds, not MDs) who are following that trajectory too.

Don't think that "data science" is a solid career trajectory for the next 20-40 years. It's a fad, driven by "big data" and the presumption that a vast an invasive dossier on individuals translates to value through marketing.

The (sorry) data on that is thin.

And it would hardly be the first time that a hugely promising career field has gone bust.

Over my lifetime, I've seen the technical "hot jobs" go from:

⚫ Highway and civil engineering (1960s - early 1970s)

⚫ Nuclear engineering (1970s to March 28, 1979).

⚫ Defense and aerospace engineering (1980s through 1992).

⚫ Doctor / medicine (through the mid 1980s and the rise of HMOs / "managed healthcare")

⚫ Petroleum engineering (1960s - 1980, 1999 - present, big empty hole 1980 - 1999)

⚫ Genetic engineering (mostly false starts: late 1970s / early 1980s, again early 1990s, again post dot-com bust -- but it's never really launched)

⚫ "Data Scientist" (2009 - present)

⚫ "Webmaster" (1997 - 2001)

⚫ "Mobile Apps Developer" (2007 - ~ nowish, starting to fade)

Just because you're getting your time in the sun now doesn't mean the glow won't fade.

Sure, the salaries may come down as more competent people enter the field (something that has been happening a lot more slowly than expected IMO), but calling data science a "fad" or saying it isn't a solid career trajectory is ridiculous. It's just a new name for something that has existed for decades. My first job was in a group that has been creating useful products using machine learning since the early 1990s. If that group was formed today it would be called the "data science" team. There are plenty of other examples, like "quants" at finance companies and actuaries at insurance companies. These sorts of jobs have existed for a long time and have paid well the whole time.

I'd also point out that most of the jobs on your list are specific roles in specific industries - data science as a concept will be more resilient because it's an evolving set of skills (as is programming/software engineering) that span basically the whole economy. The day people no longer have a reason to build systems using computers is the day these jobs will go away.

> The day people no longer have a reason to build systems using computers is the day these jobs will go away.

Sooo, not too long after some clever person figures out how to automate 80% of the grunt work of building an analytics pipeline and their colleagues dumb down the 20% left so that the people inhabiting the C-suite can work it on their iPads...?

I know at least three startups working that space, right now. And there are probably another 300 on the way.

This is like saying that all the programming jobs are going to go away because of some visual programming language just over the horizon. The fact is we are generating more and more data every day, and there are infinite ways to formulate and look at it. The tools that C-suite can use will never be powerful enough to do what a data scientist does because of the variety of data that exists. You can only dumb it down to the lowest common denominator, and the LCD will not be very useful unless the scope is extremely narrow.

>and there are infinite ways to formulate and look at it.

Of course there aren't. The best way is to know exactly the causal process generating the data, thus enabling you to predict your variable-of-interest perfectly from the limited data.

This isn't currently possible, of course, but there's one best way to interpret data, not an infinity.

Of course there are, because there are infinite forms of data. And to say that there is always one best way to interpret data, well, I don't even know where to begin with such a naive declaration.

Philosophically, there is only one best way to interpret data - if you know the underlying causes then that provides the only explanatory power you need. A similar argument could be made to our understanding of multiple physical phenoma prior to Newton deriving His equations - your statement is equivalent to saying that there are multiple valid interpretations of how the planets revolve around the sun and apples fall from trees.

The data we care about are not the direct result of physical laws, they are the result of chaotic systems both natural (eg. weather) and human (eg. stock markets).

For your tortured analogy to bear any fruit you have to assume that we're just waiting to find a dead simple set of equations that explains all human endeavor, and after that finite memory and computation power won't be an issue because, hey, cause and effect.

Can you actually automate statistical analysis like that? I don't mean automating the actual math, I mean writing software to process raw data, decide what the meaningful statistical computations are, and then present the information output appropriately.

As far as I'm aware doing probability and statistics correctly is all about framing the problem correctly. You can, for example, accidentally assume that two events are independent when they're really dependent. Is it even possible to detect that kind of mis-framing automatically?

Yes .. it is possible. I may be getting the name wrong but I saw a demo from Ben Shneiderman's research group a few years ago where they did every possible statistical analysis on pairs of variables to look for high correlation. To their credit, they weren't selling the idea as automatic stats analysis. Their domain was health data and they were merely stating that their tool could give scientists an insight as to what factors to look at. Still ... it made me wonder where this could go.

Sometimes it's an arms race. The minute you automate away some analytics step, the smart analysts start building on top of that, raising the bar for the competition.

We mock MBAs because they think there is a skill called "business administration" which can be applied to any industry. The truth is "data science" is something that you do not are. Domain knowledge trumps all.

And throughout that time actuaries (the original data scientists) have had one of the best-paying and highest job satisfaction levels. Statisticians and data analysts have been in demand for a long time and likely will continue to be.

True. I've worked with and for several over the years. It's rather an underappreciated career path.

That said, the business model for actuarial work typically hasn't been mining every last shred of individual and personal information (caveats, below) for retail advertising. Instead it's been measuring, tracking, and modeling risks within insurance, and many of the business lines don't concern individuals. You've got business, shipping, and industrial insurance, though yes, also life, healthcare, auto, home, and fire.

In particular, insurance is a fairly regulated market with exemptions from anti-trust collusion for the specific purpose of facilitating underwriting boards -- these are multi-company associations which pool risk data. It tends to make for a slightly less cut-throat competitive environment than IT. Also that personal data isn't bandied about quite so casually.

Though as I said, that's changing. I've been informed by industry insiders that a common practice now in automobile insurance is to purchase "smog reports" from states. These include a tremendous amount of data (most of it specific to vehicle performance), of which the salient element is the miles driven since the previous check. Turns out that your auto mileage is a significant risk predictor.

Though the fact that data gathered for one stated purpose (clean air) is being used for another (rate adjustment and fraud detection) is troubling.

Yes. Though keep in mind that actuaries are protected by big regulatory moats. An actuary is not someone who practices actuarial science, but someone who has a piece of paper saying that he can.

Nooo. No.

An actuary is someone who does actuarial work. Most people join the profession right out of college. They have no piece of paper other than their degree. They are still actuaries.

A credentialed actuary is someone who has gone through the entire educational system, which are a series of exams that are typically taken while working as an actuary. Credentials and the practice rights that come with them permit an actuary to do exactly one new thing. Only a credentialed actuary can opine on the adequacy of an insurance company's loss reserves (to make sure that the company has set aside enough money for all of the claims it will eventually have to pay).

Not many actuaries issue formal statements of actuarial opinion. All of the other work that we do can be legally done by anyone. There is nothing stopping an insurance company from hiring a large number of statisticians or whatever to do the day-to-day work, only bringing in a credentialed actuary to do the reserve opinion once a year. Companies generally don't do this because actuaries are more than just statisticians; they're business professionals with very deep domain knowledge. Credentialed actuaries command a premium in the marketplace not because of any "regulatory moats", but because the specialized education itself is very valuable. If that ever stops being the case then nothing is stopping the market from correcting itself.

Yes, the truth is more nuanced than my flippant comment portrayed it. I considered becoming an actuary once, but decided against.

It really is hilarious that you actually have to have a certification to practice statistics. Think about how absurd that is. People write code that controls airplanes, medical devices, emi emissions...which are of course certified/regulated on a product basis. But to just apply stats...you need a certification. Something is wrong here.

I practice statistics all the time without a certificate. What are you talking about?

OK, so you just worded what you said above poorly. You implied that any practice of stats required certification. My comment covered both statisticians, and actuaries, but just used actuaries as an example.

Why does it matter that actuaries are certified? It's a professional role which requires dealing with some pretty heavy concepts. Employers presumably want to be sure that candidates meet some level of capabilities.

I guess I should add that the web world and modern data scientists kind of changed this but it was mostly because there were a bunch of smart PhDs who left academia and other companies to go work at rapidly growing startups, and their abilities helped grow the companies. Growing startups don't really care if their "Actuaries" don't have credentials other than beign able to monetize site data.

Anyone with the skills to be a webmaster in 1997 likely still has a promising career trajectory if they want it. However, I don't know of any webmasters from that period who pegged their career to the term "webmaster."

"Webmaster" in 1997 covered a wide range of sins, and part of the change has been that what used to be one job is now a raft of them -- design, front-end coding, markup, back-end, ops, database, and more. Smaller shops may combine several of these, but it's not unusual to see each as its own specialty.

That's part of what I was getting at.

But the other was that "Webmaster" was a really hot ticket for a few years. It's faded markedly.

I can't see my parent comment at the moment, but I saw a recent "ask HN" post where the question concerned where all the Ruby-on-Rails jobs had gone. What had been a really hot ticked for the past few years is starting to fade. A lot of kids are starting to learn their first talent-shift lessons.

This is a fantastic post. My career has only spanned 15-20 years so far, but what I've learned is that every "hot" career ebbs and flows. Law used to the be the place to go, now nobody wants to go, but it'll get to the point again where it's a "hot" career.

Lets hope not.

Yeah, I currently have some data sciency skills. Still in core software engineering. I think I will stick to what I am currently doing.

>But I don't know if most people count data science as a real scientific field.

If you're using it in the big data, industry buzzword sense, then I doubt the OP would consider it "hard science research."

Those salary numbers are also arguably bubbly..."data science" is so new and hype-driven that we might be looking back in a few years at the ridiculous salad days where someone who knew a bit of statistics and a bit of programming could pull down $100k a year.

It's starting to read like "webmaster" salaries in the late 90s...

I think that is a perfect analogy. Anyone with marginal skills who wants to get a job as a 'data scientist' would be well-advised to do so before the music stops.

In petroleum-related industries in Northern and Western Europe you can be looking at $70k a year after your MSc and almost 100 after your PhD. My starting salary was $68k after my MSc, worked 6 months before being given an offer I couldn't refuse to go get a PhD (unpaid leave from the company, getting a $50k/year scholarship from the government and paying zero tuition), expecting to make around $95k when I'm finished and go back to the company. This is on par with statistics I've seen for my industry. Social democracies and all that...

Oh, absolute -- petroleum has skyrocketed in the past decade (though what happens as petro cos start running into capex conflicts is open, and the current price crash is likely not playing well).

But there was a long dry spell from the late 1980s through the 1990s where those jobs, especially in the US, were very, very hard to come by.

That said, I'd love to check my statements against historical salary data for the field.

Norway?

Bingo. Though I have Danish friends (at DTU) who are not any worse off. Friends in the UK and France get less during their PhDs, but the engineering salaries before/after seem to be on par with what I said.

Maybe computer science may not be considered "hard science"? but that level of salary for CS PhDs is not uncommon in tech firms.

Or even just CS bachelors.

$250k without a degree? In what area of CS? Finance?

What about for people outside of SF/NY/Finance?

I know engineers without a degree who pull $250k a year.

Here's an example: you can become a principal consultant at the best and most well-known infosec firms in the world without a degree. By and large, they don't care. Even the ones that say CS degree on the job post - email a decisionmaker, tweet them, whatever - it's not true (some care, most don't).

The salary band for a principal consultant would be around $200-$250k, sometimes before bonuses and incentives to develop tools or do research. Fully realizable goal.

Now, that's my experience in that industry. But someone will also come along and tell you about software engineers who work at AmaGooBookSoft with no degree too. And if you're a top performer there - $250k is a fully realizable goal.

I mean, you're in NYC. Are you referring to someone outside that area?

I'm deeply interested in how someone outside of a hotspot like SF/NYC could achieve a $250k salary. I was under the impression that $120k was pretty good for someone joining an infosec firm.

How would you go from an entry-level infosec position (an entry-level security consultant) to $250k/yr without switching companies? Also, what would be a reasonable salary for an experienced dev with no prior infosec experience who is joining an infosec firm? (Essentially someone who is switching fields to infosec, but who is still a very good programmer, and who rapidly picked up on the fundamentals of infosec and applies them in a valuable way.)

I agree with you. Outside of NY/SF, I highly doubt anyone is starting any software engineer/big data individual more than ~100kish. I've had friends work up to that level but certainly not starting as Software Engineer I or II.

(That reminds me, I should check into working in NY or SF.)

You don't need to move. There are plenty of companies hiring remote positions based in NY or SF that will pay you a local salary despite being remote.

Could you please give some examples?

Or at least working for people in highly-paying locations. Often you don't need to be there yourself.

Sorry about just getting back to this, I didn't think there'd be such an interest. I'll go in order.

1. >> I mean, you're in NYC. Are you referring to someone outside that area?

Yes I'm in NY (Westchester, actually). I'm thinking of people in NYC and San Francisco, so no, I suppose it doesn't answer your criteria of being outside those two areas. That said, I also know someone who makes this much and works remotely for a company in San Francisco, so he gets the best of both worlds.

2. >> How would you go from an entry-level infosec position to $250/yr?

For someone who decided to make a career of infosec and make that sort of salary (or the associated industry prestige/research you generally end up with at that level), it would take 6-10 years of exceptional work, original research and tool development. If you don't want to do all three, pick two, but you better make those two amazing.

Let me break down rough salary bands for you (keep in mind these will change based on a specific firm):

a. Associate - This is a bottom rung appsec engineer. If you join Matasano or a similar firm with promising intuitions about security and a background in development, you'll end up here. Great! $70-90k salary (there are outliers above this, and you'll see salaries for 50k - 60k, but if you know what you're doing with job searches and it's a good firm, that's the range). You usually stay here for a few years, training under the wing of mentors, until you competent in at least 3 different disciplines of information security (crypto, mobile, web app, network, incident response, reversing, malware analysis etc. etc. etc. and there are overlaps). You'll also stay here until you are ready to supervise someone else running a penetration test and can handle clients on your own.

70k - 90k

b. Consultant - You should be competent in 3 to 5 different disciplines of information security (or ridiculously stellar and potentially famous-in-the-future in 1-2). At this point, you probably haven't presented at a conference yet (and many go their entire careers without doing this), or done original technical research, but you're probably developing security tools or thinking about it. Any good firm is going to give a performance bonus for this. It's most likely taken you 1 - 2 years to reach this level, depending on innate talent, motivation and practice.

90k - 130k

c. Senior - Similar growth progression, now you have 5-7 disciplines under your belt, expert in 1-2. You're either doing original technical research or considering it, and you develop new tools are part of your research. You might present your research at conferences, you might not (most people who do meaningful research tend to submit). You now lead teams and projects for large engagements with "important clients" in the consultancy. Probably took you another 1 - 2 years to reach this, maybe 3.

130k - 180k

d. Principal - You're probably known in circles that know your consultancy, because you're one of the most important consultants at your firm now. You might even be industry-famous, if you have done particularly good research or released a tool that made pen testing easier for everyone. You're expert in 3-4 areas and it's no longer worthwhile counting how many disciplines you could technically operate in because the overlap is superfluous. It's likely taken you 1 - 2 years to reach this from Senior, if you are motivated and keep working.

180k - 250k

A few notes:

1. None of the definitions here are "hard" - don't take how many disciplines and similar such criteria as hard rules, it's just a rule of thumb.

2. These salaries are before bonuses such as for extra travel in a quarter, extra work in a quarter, tool development, research or conference presentation (you bonus for all those).

3. You'll notice salary ranges increase as you go up, because the higher you go the more nuanced the skill levels become.

4. There is a level or two above principal, generally "partner", "distinguished consultant/engineer" or something similar. You're basically at the top of your career as a consultant here and can found and manage consultancy firms. The salary here is $250k+.

5. You can skip, and the years are basic averages at best.

Thanks so much for the stellar comment. It's truly great, and I really appreciate it.

Are you absolutely sure about those salary bands? In particular, less than $100k minimum for a developer with ~ten years of experience seems extremely low. They could go get that much in a starting position at a trading firm, so why go infosec? If you can do anything, why do that?

Those salaries seem reasonable for ~2006, but not 2015. They say to reinvent yourself every ten years or so, but starting out at those salaries would be prohibitive.

The salary bands are the sort of thing you'd see listed on a page devoid of context. They're minimums and flexible.

If you have 10 years of dev experience and you're a strong enough case to get a yes from an infosec firm, they're going to work with you on salary to get to your level. As 'tptacek has explained quite a bit on here, a good firm is receptive to negotiation and starts at their floor, not yours :)

But your title will still be Associate because you need to learn the ropes. They could also fast track you too so you're a consultant within a year if you're ready.

This is a one size fits all chart. For mid career switchers and new grads alike.

If you have any more questions, feel free to email me. I didn't anticipate this comment would be so popular!

First: that was a really impressive comment. I ran hiring at Matasano for several years until I left. I would definitely quibble with the numbers (both on the low and the high side) but they may themselves be dead-on for other firms.

We hired basically two kinds of "software developer" (ie. people who could code but didn't have experience with software security):

* Developers with minimal professional experience in software --- a year or two out of college, say, or someone who had graduated from devops to software.

* Senior developers with impactful specializations and/or a well-cultivated side interest in software security. Impactful specializations would have included kernel-level systems programming, compiler theory, maths, maybe some kinds of networking or finance. Really: it's kernel stuff that got our attention most of all.

The former kind of developer fits into the ladder the way you're writing here.

The latter kind is for all intents and purposes in the door as a senior consultant.

We weren't in the business of asking people to take pay cuts.

Hey Thomas!

Yeah, everything you're saying here is obviously true.

I tried to make the salary bands encompass most of the consultancies that operate in NY and SF (Matasano, iSec, Accuvant, Cigital, Neohapsis, Include, and lots more). As such, it doesn't square exactly with what Matasano offers.

I also want to underscore what you said about pay cuts - good firms and good managers are going to be receptive to your needs. Once you get to 'Yes', they want you, and the value you will deliver as a consultant at one of these shops will eclipse your fully loaded cost.

Finally, I want to share another piece of advice for anyone looking to go into infosec - like anything else, there are good firms and not so good firms. I won't speak ill of any specific company, but firms like Accuvant, Matasano and iSec should usually be your first attempt to break in. They are receptive to developers with no security experience.

Pick up The Web Application Hacker's Handbook (showing its age a little now, but still the only book you need to start in web app security) and read through it.

Other firms sometimes have you do ridiculous amounts of travel (75%+) without informing you of this upfront, or they are firms without good hiring standards (or firing standards) and operate mostly as point and click vulnerability scanners where you won't learn much and you'll be underpaid.

It really, really helps to reach out to people directly and ask them how they like where they work and try to get a referral to interview through them.

Pro-tip: If you call Matasano interested in a job, they'll send you the WAHH book and a couple others. You shouldn't even need to ask; at the end of the call, they should just ask you for your shipping address.

^^ Exhibit A: One of the firms you'd want to try your hand at working for first :)

They might also send / you'd want to read:

- Gray Hat Python (debugging and fuzzing with Python)

- The Tangled Web (web browser security and insecurity)

- The Art of Software Security Assessment - the bible, which you really want to read as it's a foundational text. Very dense, but you'll come out of it knowing how to attack memory very well.

That's actually kind of awesome.

I interviewed at Matasano a few years back. I figured doing pen testing might be a good way to climb the value chain beyond my maxed-out career in webdev.

We didn't get to salary negotiations but if I had seen the starting salaries posted above I would have coughed up my spleen. My assumption was that a junior security researcher is a senior developer and therefore the salary would have been at least (senior dev salary + σ).

Again: I'm only vouching for the ladder, not the numbers. We (a) didn't lose a lot of people to salary negotiation (I think, in the last 2 years I was there, we lost 2) and (b) as a rule didn't want people to take pay cuts.

Matasano didn't have an "associate" rung on its ladder. We talked for 10 years about having a "junior consultant" role, but never did. So you can discard those numbers entirely.

I could obviously be much more specific about how the numbers in the rest of the ladder don't square with that comment, but I'm not going to.

That's consulting though, which is a typically pays quite well whatever you specialize in.

You could get a PhD in a hard science, work for McKinsey and if you make it to partner be pulling in $1M+. Even if you don't make it to partner it's not hard to make >$250K after 2-3 years.

Technical consulting is nothing like McKinsey consulting. McKinsey is an up-or-out market environment where associates "sell" their services to partners and partners make bank by themselves owning a book of business. It's far more entrepreneurial than software consulting.

If you want to do technical work that has the compensation dynamics of McKinsey, you need to (a) hyper-specialize in something valuable and (b) own your own practice.

> I know engineers without a degree who pull $250k a year.

Call them specialists, experts, consultants, contractors, or whatever you want, but not engineers without an actual engineering degree.

An engineer is defined as a practitioner of engineering, not a person with an engineering degree.

> An engineer is defined as a practitioner of engineering, not a person with an engineering degree.

It goes further than that actually. The term 'engineer' is often legally-protected, and often a degree is a pre-requisite, but isn't the only one. This becomes important when e.g. you're building bridges.

http://en.wikipedia.org/wiki/Regulation_and_licensure_in_eng...

for example http://en.wikipedia.org/wiki/Chartered_Engineer_(UK)

Engineering is a profession for which you need appropriate credentials, just like in any other profession (e.g. scientist). Without credentials, you are not an engineer.

Unless you are talking about 'engineer' in the same way some people talk about 'architect' as in software architect.

Chemists can make a bit of money in industry depending on the specialization. Organic Chem can go into medical/pharma research. Then there is lots of research/work/money in materials (diamonds, carbon fiber, other composites, lots of stuff I don't know).

I don't know the specific pay in these fields, but it is definitely higher than you would get staying in academics.

US pharma hires few if any organic chemists any more. That work got offshored a decade ago.

This is true. It's not only outsourcing, but also the shift from small molecules to large molecules (proteins, antibodies). Pharma companies have shed thousands of chemists over the past 10 years. I know a few who have been able to hold onto their jobs, but it hasn't been pretty.

Just to add more context, I used to work as a chemistry researcher and when I first started job hunting in the early 2000's pharma was desperate for organic chemists. You could apply to 5 openings and get 5 offers.

Most of the folks I knew who were chemists have moved onto other roles/industries.

This is a HUGE point. It was once thought that being a chemistry PhD was a shoe-in for industry work, and you could skip being a postdoc entirely.

I met a very respected chemist at AACR last year who said all of his postdocs were scrambling for work, and that some were being realistic and considering moving to China for the opportunities.

I know lots of biochem phds from my grad program. The median jncome is around $50k. Many had to apply to hundreds of places to land a job.

The ACS publishes salary information every year. Google for "ACS salary survey" if you want to check out what chemists make at each degree level vs. experience. In pharma, the take-home's pretty good although there's been a slow, steady loss of jobs over the years. Or, more correctly, both a loss and geographic shift of jobs.

I've seen it happen in Consulting/Defense Contracting it's pretty common to have well paid PHD's around as subject matter experts for certain topics. Not to mention having PHD resumes on proposals can mean a lot to prospective clients, so even than can be worth it for that industries to have well educated peeps on the payroll. Overall, in the DC area at least (what I know), having a PHD can pay. Hard sciences, engineering, even social sciences. They have to usually be socially competent too, not all PHDs' possess this trait...

In the biotech / pharmaceutical sciences, a starting salary is always greater than GP's "professorial" range: easily $75-$125K. Though these jobs are very competitive.

And, as the article states:

> If Margaret had left science entirely…for, say, a consulting job…she’d have earned about $100,000 a year or more...but she stayed in science.

I was referring to the biotech/medical field.