Yeah, everything you're saying here is obviously true.

I tried to make the salary bands encompass most of the consultancies that operate in NY and SF (Matasano, iSec, Accuvant, Cigital, Neohapsis, Include, and lots more). As such, it doesn't square exactly with what Matasano offers.

I also want to underscore what you said about pay cuts - good firms and good managers are going to be receptive to your needs. Once you get to 'Yes', they want you, and the value you will deliver as a consultant at one of these shops will eclipse your fully loaded cost.

Finally, I want to share another piece of advice for anyone looking to go into infosec - like anything else, there are good firms and not so good firms. I won't speak ill of any specific company, but firms like Accuvant, Matasano and iSec should usually be your first attempt to break in. They are receptive to developers with no security experience.

Pick up The Web Application Hacker's Handbook (showing its age a little now, but still the only book you need to start in web app security) and read through it.

Other firms sometimes have you do ridiculous amounts of travel (75%+) without informing you of this upfront, or they are firms without good hiring standards (or firing standards) and operate mostly as point and click vulnerability scanners where you won't learn much and you'll be underpaid.

It really, really helps to reach out to people directly and ask them how they like where they work and try to get a referral to interview through them.