If you have 10 years of dev experience and you're a strong enough case to get a yes from an infosec firm, they're going to work with you on salary to get to your level. As 'tptacek has explained quite a bit on here, a good firm is receptive to negotiation and starts at their floor, not yours :)
But your title will still be Associate because you need to learn the ropes. They could also fast track you too so you're a consultant within a year if you're ready.
This is a one size fits all chart. For mid career switchers and new grads alike.
If you have any more questions, feel free to email me. I didn't anticipate this comment would be so popular!
We hired basically two kinds of "software developer" (ie. people who could code but didn't have experience with software security):
* Developers with minimal professional experience in software --- a year or two out of college, say, or someone who had graduated from devops to software.
* Senior developers with impactful specializations and/or a well-cultivated side interest in software security. Impactful specializations would have included kernel-level systems programming, compiler theory, maths, maybe some kinds of networking or finance. Really: it's kernel stuff that got our attention most of all.
The former kind of developer fits into the ladder the way you're writing here.
The latter kind is for all intents and purposes in the door as a senior consultant.
We weren't in the business of asking people to take pay cuts.
Yeah, everything you're saying here is obviously true.
I tried to make the salary bands encompass most of the consultancies that operate in NY and SF (Matasano, iSec, Accuvant, Cigital, Neohapsis, Include, and lots more). As such, it doesn't square exactly with what Matasano offers.
I also want to underscore what you said about pay cuts - good firms and good managers are going to be receptive to your needs. Once you get to 'Yes', they want you, and the value you will deliver as a consultant at one of these shops will eclipse your fully loaded cost.
Finally, I want to share another piece of advice for anyone looking to go into infosec - like anything else, there are good firms and not so good firms. I won't speak ill of any specific company, but firms like Accuvant, Matasano and iSec should usually be your first attempt to break in. They are receptive to developers with no security experience.
Pick up The Web Application Hacker's Handbook (showing its age a little now, but still the only book you need to start in web app security) and read through it.
Other firms sometimes have you do ridiculous amounts of travel (75%+) without informing you of this upfront, or they are firms without good hiring standards (or firing standards) and operate mostly as point and click vulnerability scanners where you won't learn much and you'll be underpaid.
It really, really helps to reach out to people directly and ask them how they like where they work and try to get a referral to interview through them.
They might also send / you'd want to read:
- Gray Hat Python (debugging and fuzzing with Python)
- The Tangled Web (web browser security and insecurity)
- The Art of Software Security Assessment - the bible, which you really want to read as it's a foundational text. Very dense, but you'll come out of it knowing how to attack memory very well.
We didn't get to salary negotiations but if I had seen the starting salaries posted above I would have coughed up my spleen. My assumption was that a junior security researcher is a senior developer and therefore the salary would have been at least (senior dev salary + σ).
Matasano didn't have an "associate" rung on its ladder. We talked for 10 years about having a "junior consultant" role, but never did. So you can discard those numbers entirely.
I could obviously be much more specific about how the numbers in the rest of the ladder don't square with that comment, but I'm not going to.
Are you absolutely sure about those salary bands? In particular, less than $100k minimum for a developer with ~ten years of experience seems extremely low. They could go get that much in a starting position at a trading firm, so why go infosec? If you can do anything, why do that?
Those salaries seem reasonable for ~2006, but not 2015. They say to reinvent yourself every ten years or so, but starting out at those salaries would be prohibitive.