The headline numbers
In late September 2026 we analysed every live role on ProductSecurityJobs.com that published an annual salary range. 348 roles advertised a US dollar range that we could parse reliably. Across all of them, the median midpoint was $177,000, and half of all ranges had a midpoint between $150,000 and $216,000.
Roles with Product Security or Application Security in the title sat close to that overall figure: across 61 such roles, the median midpoint was $175,000, with a typical advertised range of $145,000 to $217,000. Seniority, location and the type of employer explain most of the variation, and the rest of this guide breaks those down.
| Measure (US, base salary) | Value |
|---|---|
| Roles with a published annual range | 348 |
| Median midpoint | $177,000 |
| Middle half of midpoints (25th–75th percentile) | $150,000 – $216,000 |
| Typical advertised range (median low – median high) | $139,000 – $225,000 |
| Product or application security titled roles: median midpoint | $175,000 (61 roles) |
Salary by seniority
Seniority is the biggest single driver of pay. We grouped roles by the level stated in the job title. The jump from senior to staff is the largest step in the ladder: staff-level roles advertised a median midpoint more than $50,000 higher than senior roles, reflecting the move from owning one area to setting direction across several.
Titles are inconsistent between companies, so treat these bands as a guide rather than a rule. A 'Lead' at one company may be a senior individual contributor, while at another it manages a small team. Read the responsibilities, not only the title.
| Level (from title) | Roles | Median midpoint | Middle half of midpoints | Typical range |
|---|---|---|---|---|
| Mid-level (no level in title) | 124 | $150,000 | $127,000 – $171,000 | $102,000 – $198,000 |
| Senior | 95 | $177,000 | $161,000 – $200,000 | $142,000 – $220,000 |
| Lead | 17 | $175,000 | $154,000 – $185,000 | $132,000 – $218,000 |
| Staff | 52 | $230,000 | $191,000 – $260,000 | $179,000 – $261,000 |
| Principal | 33 | $224,000 | $202,000 – $236,000 | $170,000 – $275,000 |
| Manager | 17 | $203,000 | $168,000 – $224,000 | $147,000 – $225,000 |
| Director / Head of | 7 | $225,000 | $174,000 – $288,000 | $165,000 – $250,000 |
Salary by location
Location still matters, even for remote roles. The San Francisco Bay Area led by a wide margin, with a median midpoint of $241,000, and its upper quartile was pulled up sharply by AI labs and large technology companies. Seattle and New York followed. US-remote roles paid more than the average on-site role outside the major hubs, largely because remote-first employers skew towards well-funded technology companies.
Many employers publish different ranges for different pay zones in the same listing. Where that happens, the advertised range often spans several zones, so ask which band applies to your location before comparing offers.
| US location | Roles | Median midpoint | Middle half of midpoints |
|---|---|---|---|
| San Francisco Bay Area | 58 | $241,000 | $204,000 – $363,000 |
| Seattle area | 10 | $221,000 | $190,000 – $242,000 |
| New York | 16 | $190,000 | $171,000 – $218,000 |
| US remote | 50 | $190,000 | $158,000 – $222,000 |
| Elsewhere in the US | 214 | $162,000 | $142,000 – $185,000 |
Salary by company tier
The type of employer makes almost as much difference as seniority. Big technology companies advertised a median midpoint of $215,000, around $50,000 more than large enterprises and banks. That gap widens further once equity is included, because technology companies usually pay a larger share of total compensation in stock.
Consulting roles had the lowest median in our sample. That figure is heavily influenced by Booz Allen Hamilton, which published ranges for 64 roles, many of them government-focused positions with broad salary bands. Consulting remains a common entry point into security careers, and the experience can be a stepping stone into higher-paying product security roles.
| Company tier | Roles | Median midpoint | Middle half of midpoints |
|---|---|---|---|
| Big Tech | 146 | $215,000 | $188,000 – $260,000 |
| Global enterprise | 48 | $167,000 | $150,000 – $178,000 |
| Security vendors | 24 | $166,000 | $150,000 – $195,000 |
| Fortune 500 banking | 28 | $161,000 | $141,000 – $161,000 |
| Consulting | 67 | $142,000 | $127,000 – $162,000 |
The top of the market
At the very top, AI labs are setting a new ceiling. Anthropic published ranges for 21 security roles with a median midpoint of $363,000, and several staff-plus security engineering and management roles advertised base salaries of $405,000 to $485,000. Adobe advertised a Vice President of Product and Software Security role at $244,000 to $521,000. These figures are base salary only; equity at these companies can be worth as much again or more.
Among employers that published several ranges, Databricks, Robinhood, Palo Alto Networks, Workday, Salesforce, Adobe and GitLab all advertised median midpoints of roughly $200,000 or more for their security roles. You can browse current roles at these companies and filter by disclosed salary.
Product security salaries in the UK and Europe
UK and European employers publish salary ranges far less often than US employers, where pay transparency laws in states such as California, New York, Colorado and Washington require them. In our September 2026 sample, only eight UK roles and three euro-denominated roles published a usable annual range, which is too few to report reliable medians. We would rather say that plainly than publish misleading numbers.
What the UK data does show is a very wide spread. Mid-level roles at large enterprises published ranges in the mid-£40,000s to mid-£50,000s, while product security roles at US technology companies hiring in London typically pay considerably more, and often include equity. When comparing a UK offer, anchor on the scope of the role, ask the recruiter for the band early, and compare total compensation rather than base salary alone. The EU Pay Transparency Directive, which member states must implement by June 2026, should make European ranges much easier to compare over the coming year.
Compare the whole package, not just base salary
Every figure in this guide is base salary, because that is what job listings publish. For senior roles at technology companies, base salary can be half or less of total compensation. Before accepting an offer, make sure you are comparing like with like.
- Base salary and any guaranteed cash, such as a sign-on bonus
- Annual bonus: target percentage, and how much of it is discretionary
- Equity: grant value, vesting schedule, refresher policy and whether the shares are liquid
- Pension or 401(k) match and other retirement contributions
- On-call expectations and whether on-call is paid separately
- Location-based pay adjustments if you move or work remotely
- Review cadence and how promotions affect pay bands
How to negotiate a product security offer
Product security engineers are hard to hire, and that gives candidates more leverage than they often realise. Use it carefully.
Ask for the salary band early, before investing in a long interview process. In US states with pay transparency laws it will usually be in the listing already. Use the level and location tables above to check whether the band is competitive for the scope described. If the role spans several product areas or includes people leadership, it is reasonable to argue for the upper half of the band.
Negotiate on level as well as number. Being hired at staff rather than senior level changes not just your starting pay but every future raise and equity refresh. Evidence of cross-team impact, such as a vulnerability class you eliminated or a secure-by-default platform you built, is the strongest argument for a higher level.
Methodology
We collected every live role on ProductSecurityJobs.com on 28 September 2026: 1,303 roles, of which 361 disclosed a salary. We kept ranges that were stated as annual amounts in a clear currency, between $30,000 and $1.5 million, and where the top of the range was no more than three times the bottom. That left 348 US dollar ranges, 8 sterling ranges and 3 euro ranges. The midpoint of each range is the average of its low and high ends.
Levels come from job titles; location groups come from the listed work location; company tiers are the groupings we use across the site. Listings are drawn directly from employer career sites, so the sample reflects the employers we track rather than the whole market, and it over-represents US employers because US listings are far more likely to include pay. We will refresh these figures as new roles are published. To see what you could earn, browse all current product security jobs or start with how to get into product security.
Frequently asked questions
- How much does a product security engineer make?
- In US job listings we analysed in September 2026, the median advertised base salary midpoint for security engineering roles was $177,000. Roles with Product Security or Application Security in the title had a median midpoint of $175,000. Staff and principal engineers typically advertised $220,000 to $230,000, and more at top technology companies.
- How much does a product security engineer make in the UK?
- UK employers rarely publish salary ranges, so reliable medians are hard to produce. Ranges we saw ran from the mid-£40,000s for mid-level enterprise roles to considerably more at US technology companies hiring in London, where equity is often a significant part of pay.
- Which companies pay product security engineers the most?
- AI labs and large technology companies pay the most. In our September 2026 data, Anthropic advertised the highest security salaries, with several roles between $405,000 and $485,000 base. Databricks, Robinhood, Palo Alto Networks, Workday, Salesforce, Adobe and GitLab also advertised medians around $200,000 or more.
- Is product security paid more than application security?
- Not meaningfully, based on advertised salaries. The titles overlap heavily, and pay is driven far more by seniority, location and company type than by which of the two terms appears in the job title.
- Do these figures include equity and bonus?
- No. They are advertised base salaries. At technology companies, equity and bonus can add a large amount on top, so always compare total compensation.