Security Engineer Salary in Boston — 2026 BLS Data
Salary distribution
Percentile breakdown of Security Engineer base salaries in Boston.
The BLS OEWS May 2024 median for information security analysts (SOC 15-1212) in the Boston-Cambridge-Newton metropolitan area sits at approximately $136,550 — call it $137K — which is nearly 9% above the national median of $124,910 for the same occupational code. That headline is useful as an anchor, but it obscures a 2.1x spread from P25 to P90, three distinct employer tiers that pay very differently, and a specialty premium structure that makes your exact subfield matter as much as your years of experience. Here is what the number actually means, and how to use it.
What the median hides
The BLS lumps every security engineer title — SOC analyst, application security engineer, cloud security engineer, penetration tester, red team consultant, GRC specialist, incident responder — into a single occupation bucket. The result is a distribution that looks unified but is actually three overlapping populations stacked on top of each other.
At P25 ($107K), you are most likely looking at an early-career security analyst at a financial services firm doing mostly compliance work, a junior security engineer at a mid-market software company, or a government contractor role with a clearance requirement but a GS-equivalent pay ceiling. These roles are real and plentiful in Boston; they are simply not the ceiling.
At P50 ($137K), the median engineer is working in threat detection, vulnerability management, or cloud security at a company somewhere between 200 and 2,000 employees — think MathWorks, Rapid7, Tenable, or one of the dozens of biotech and medtech firms that maintain ISO 27001 or SOC 2 programs for regulatory reasons. Mid-market healthcare IT is a significant driver here; Boston’s density of hospitals and health systems (Mass General Brigham, Beth Israel Deaconess, Dana-Farber) creates steady demand for engineers who understand HIPAA security rules alongside technical controls.
At P75 ($181K) and P90 ($225K), you enter a different tier: senior and staff engineers at hypergrowth cloud companies with Boston offices (Akamai, CrowdStrike, Snyk, Veracode), financial technology firms managing payment security at scale, and the defense/intelligence contractor ecosystem anchored by Raytheon Technologies and MITRE — organizations where a TS/SCI clearance paired with zero-trust architecture experience produces offers well into the $180K–$220K base range.
How Boston compares to other major security hubs
Boston’s $137K median base is competitive for a non-California market, but the comparison depends heavily on which companies you are targeting.
San Francisco and the Bay Area remain the high-water mark for pure tech security roles, particularly at FAANG and AI-native companies. A mid-level application security engineer at Google, Meta, or a well-funded AI startup can clear $200K–$260K base in SF; the same profile in Boston lands $155K–$185K at a comparable employer tier. The delta is real, though SF’s cost of living index of 178.6 versus Boston’s 150.8 closes about half the gap in purchasing power terms.
New York City is the closest analog to Boston in terms of market structure. Both cities have a finance and fintech layer (Wall Street in NYC, State Street and Fidelity in Boston), a healthcare/biotech layer, and a government/defense layer. NYC median security engineer pay runs slightly higher, around $145K–$155K, driven by financial firms that pay software-engineering-level compensation for security roles supporting trading infrastructure and fraud systems.
Seattle, anchored by Amazon and Microsoft, runs $165K–$185K median for security engineers — above Boston on base, but competing against Amazon’s fairly rigid internal pay bands and a market that tilts heavily toward cloud security specifically. If your background is AWS or Azure security architecture, Seattle and remote roles at those companies may benchmark above Boston.
Washington DC and the Northern Virginia corridor deserve mention: the density of cleared contractor roles means compensation curves differently there. A cleared engineer (TS/SCI with a polygraph) in the DC area can command $170K–$210K base, but the ceiling flattens sharply without clearances compared to commercial markets.
What drives the spread in Boston
Three variables explain most of the distance between P25 and P90:
Employer tier and industry vertical. Defense contractors (Raytheon Intelligence & Space, MITRE, Draper Laboratory) and government agencies pay within structured bands that top out in the $150K–$175K range for non-management roles, regardless of skill level, unless a polygraph-level clearance is involved. Mid-market commercial companies — particularly Boston’s deep bench of SaaS, fintech, and biotech — pay $120K–$175K for mid-to-senior engineers. Publicly traded tech companies with mature security programs or hypergrowth startups with recent funding rounds are where the P75–P90 numbers come from: Akamai’s security division, CrowdStrike’s Boston engineering presence, Snyk (founded in Boston, now global), and Rapid7 (headquartered in Boston) all post senior security engineer ranges of $170K–$220K in recent job filings.
Specialty and technical stack. Application security and cloud security engineers consistently earn the highest premiums in the current market. Cloud security specialists with AWS Security Specialty or Azure AZ-500 certifications command $18K–$25K above the generalist median, a premium that has grown as companies migrate workloads and need engineers who can design IAM policies, secure Kubernetes clusters, and manage CSPM tooling. AppSec engineers with strong software development backgrounds (ideally writing production code in Python, Go, or Java while doing security reviews) command roughly 15%–20% above generalist incident-response or GRC roles at the same experience level. Red team and offensive security roles at senior levels pay well — the national average for a red team security engineer sits around $200K — but Boston has fewer pure offensive security positions than the Beltway or SF; most red team work here is embedded within larger security organizations at defense contractors.
Level and scope of ownership. The difference between a security engineer handling tickets and a security engineer designing the architecture is often $40K–$60K in base, even at the same employer. Engineers who can demonstrate that they reduced the mean time to detect (MTTD) a specific threat class, or who shipped a security feature that unblocked a SOC 2 Type II certification, have a concrete story that moves leveling conversations. Engineers who describe their work primarily in terms of tools operated (SIEM, EDR, SOAR) without outcome data are harder to differentiate in compensation negotiations.
Total compensation breakdown
For a typical mid-level security engineer in Boston (P50 base, commercial employer, not defense contractor), the full package looks approximately like this:
- Base salary: $137,000. This is what BLS tracks, what lenders use for mortgage qualification, and what determines most bonus calculations.
- Annual cash bonus: $12,000. Most commercial companies pay a target bonus of 8%–12% of base for individual contributors. At financial services firms (Fidelity, State Street, Wellington), bonuses run higher — 15%–25% — but base is often lower. Defense contractors frequently pay minimal bonuses.
- Equity / RSUs: $15,000 annualized. Public companies with Boston engineering offices typically grant RSUs worth $40K–$80K over a four-year vesting schedule for a new mid-level hire, which pencils out to $10K–$20K per year. Pre-IPO startups will quote larger paper values; assume conservatively until an exit is visible. Defense contractors and nonprofits (MITRE is a nonprofit) have no equity component.
Total cash compensation (base + bonus) for a P50 engineer: approximately $149,000. Total comp including equity: $164,000.
At P75 ($181K base), the picture shifts meaningfully. Engineers at this tier are typically senior ICs at funded security companies or established tech firms, and the equity component grows substantially — $30K–$60K annualized RSUs is common. Total comp at P75 runs $210K–$250K for the full package.
At P90 ($225K base), you are looking at staff security engineers or principal engineers at companies where security is a product or core competency, not a cost center. Total comp here — including refreshes — can reach $280K–$350K at public companies with strong stock performance.
Cost-of-living adjusted purchasing power
Boston’s composite cost of living index of 150.8 (C2ER methodology, US average = 100) means that $137K in Boston has the same purchasing power as roughly $91K at the national average — or $111K compared to Austin (COL index ~120). The largest driver is housing: a one-bedroom apartment in Boston proper runs $2,800–$3,400 per month in 2026, versus $1,600–$2,000 in Austin and $1,400–$1,800 in Denver.
That math is relevant for two reasons. First, if you are evaluating a remote role that uses geographic pay banding and the employer sets Boston as “Tier 1” alongside NYC and SF, you should negotiate on that basis — you face genuinely high housing costs that justify top-tier compensation. Second, if you are comparing a Boston P50 offer ($137K) against a national remote offer at $120K, the remote option may feel like a step back but is roughly equivalent in purchasing power if the employer does not apply geographic discounts.
The COL adjustment also matters when comparing against DC contractor roles. A $170K DC base (COL index ~152, similar to Boston) is not materially better than a $165K Boston base; the real differentiator is whether you want the work and career trajectory of cleared contractor roles versus commercial product engineering.
One offset: Massachusetts has a flat state income tax rate of 5% for most income (plus a 4% surtax on income over $1M). For a $137K engineer, effective state tax burden is straightforward. Combined with federal effective rates, a $137K Boston gross produces roughly $95K–$100K take-home — less margin than the raw number suggests.
Negotiation playbook: three levers that move offers
1. Anchor to P75, not to the median. Many job seekers treat the median as the target. The better frame is to use P75 as the ask for a candidate with three or more years of relevant experience, because the median includes early-career and compliance-heavy roles that naturally pay less. If a recruiter asks for your salary expectation, “I’m targeting $175,000–$185,000 base, which is consistent with senior security engineer roles in the Boston market” is a defensible position backed by BLS data. You have not asked for the moon; you have asked for P75.
2. Separate base from total comp in every conversation. Recruiters at commercial companies, especially those with equity programs, often respond to pushback on base by shifting the conversation to equity or signing bonus. That is legitimate if the equity is at a public company with transparent stock performance; it is worth less if the equity is illiquid startup shares or options with a strike price set at a high recent valuation. Ask for the total comp figure at each level explicitly: “Can you share what P50 total comp looks like for this level, including base, target bonus, and expected annual equity value?” Getting that number gives you a real comparison point.
3. Use competing offers precisely, not vaguely. “I have another offer” is weak. “I have an offer at $165,000 base with a 10% target bonus and $60,000 in RSUs vesting over four years, and I need to decide by [date]” is actionable. Employers respond to specific numbers and deadlines because they reveal your actual market value and create a real decision point. If you do not have a competing offer, a current job with a specific compensation figure and a stated alternative — “I’m currently at $138K and would need a meaningful step up to justify the transition” — serves a similar anchoring function. The specificity matters; vague pressure creates resentment, specific data creates negotiation.
Caveats and data limitations
The BLS OEWS May 2024 data is the most rigorous source available for occupational wages — it is based on mandatory employer reporting covering hundreds of thousands of workers — but it has structural limitations for security engineering specifically:
SOC 15-1212 is a broad bucket. Information Security Analysts is the closest BLS category to “security engineer” but it covers roles from junior SOC analysts to principal cloud security architects at the same time. The 2.1x spread from P25 to P90 reflects this breadth; your specific subfield narrows the relevant range considerably.
Equity is excluded. BLS tracks wages paid — W-2 income — and does not capture RSU vesting, stock option exercises, or pre-IPO equity. For roles at well-funded commercial companies, BLS understates total comp by 15%–30%. For defense contractor and government roles, BLS is largely complete.
The data is lagged. May 2024 survey data reflects wages paid in spring 2024. Compensation at commercial tech companies has continued to move; for the most current benchmarks at specific companies, supplement BLS with current job postings (Massachusetts requires salary ranges on many postings as of 2024) and platforms like Levels.fyi for roles at tech companies that report there.
Boston metro includes NH suburbs. The BLS Boston-Cambridge-Newton MSA extends into southern New Hampshire, including Manchester-Nashua. Wages in the NH portion of the metro are somewhat lower than inner Boston and Cambridge; if your role is located in downtown Boston, Cambridge, or the Route 128 corridor, the P50 and P75 figures are likely conservative for your specific market.
For tracking live security engineer job openings in Boston — especially when you are running multiple applications across defense, fintech, and commercial tech employers simultaneously — a structured job tracker helps prevent the common failure mode of losing track of where you are in each process and missing response windows.