Security Engineer Salary in Chicago — 2026 BLS Data
Salary distribution
Percentile breakdown of Security Engineer base salaries in Chicago.
The $116,520 median base salary for a Security Engineer in Chicago comes straight from BLS OEWS May 2024 data for the Chicago-Naperville-Elgin metropolitan statistical area (SOC 15-1212, Information Security Analysts). It is the single most defensible data point for this role in this city — mandatory employer reporting covering tens of thousands of workers — but it is also a blunt instrument. That one number folds together a junior analyst at a mid-market insurance company and a staff cloud security engineer at a global trading firm whose RSUs alone exceed the median’s total comp. Understanding what sits on either side of $116,520 is the actual work.
What the median hides
The P25-to-P90 spread in Chicago runs from $85,300 to $171,100 — a 2x range inside a single metropolitan area and a single broad occupation code. That spread is not noise. It reflects three structurally different labor markets that happen to share a zip code:
Legacy enterprise and mid-market. Chicago’s economy is dominated by non-tech corporations — insurance (Allstate, Aon, Zurich North America), healthcare (Advocate, Northwestern Memorial), logistics (United, Kraft Heinz, Abbott). Security roles at these employers tend to cluster in the P25-to-P50 band: $85K-$120K base with predictable annual raises and defined benefit structures. The work is heavy on compliance frameworks (SOC 2, HIPAA, PCI-DSS) and GRC tooling. Titles read “Information Security Analyst” or “Security Compliance Engineer.” Stock is rare or non-existent; pension and total-benefits packages are strong relative to startups.
Financial services and trading. This is Chicago’s highest-paying security segment and what pushes the P90 up to $171K+ in the BLS data. CME Group, the Chicago Mercantile Exchange operator, reports median cyber security engineer compensation in the $155K-$160K range with top earners clearing $245K. Citadel, Jump Trading, DRW, and Optiver treat security as critical infrastructure — their cloud security, platform security, and red-team engineers are compensated close to software engineering bands. A security engineer at a top-tier Chicago HFT firm can reach $200K-$250K base at the senior level, with cash bonuses of $50K-$150K on top.
Tech and SaaS. Chicago’s tech scene — Salesforce, Morningstar, Motorola Solutions, a growing startup cluster around 1871 — occupies the middle ground. Security engineers at VC-backed growth companies typically earn $130K-$160K base with equity packages of $80K-$200K over four years depending on stage.
The BLS median of $116,520 represents a real “typical” Chicago security engineer — likely mid-level, likely at a large non-tech employer. It is not a ceiling.
Chicago vs. other major security hubs
Geography still matters in security, though remote work has compressed some differentials. Here is how Chicago stacks up against peer markets using BLS OEWS May 2024 MSA data:
San Francisco / Bay Area sits far ahead on base for pure tech roles — national BLS data puts the 50th percentile for the same occupation around $150K-$165K in that MSA — but Chicago’s finance-sector security roles increasingly close the gap at senior levels. A staff security engineer at a Chicago trading firm routinely outearns a peer at a mid-tier SF SaaS company when base plus bonus is factored in.
New York City is Chicago’s closest competitor. Both cities have dense financial services sectors that pay security engineers above the national median. NYC median runs roughly $135K-$145K for the same SOC code, about $18K-$28K ahead of Chicago. NYC’s P90 is also higher (around $190K-$210K), reflecting the concentration of Wall Street banks. The gap largely disappears on a COL-adjusted basis — more on that below.
Austin and Dallas post lower medians ($105K-$115K range) but attract Chicago-headquartered employers setting up satellite offices that pay Chicago-equivalent bands. A Chicago-resident remote engineer at a Dallas-headquartered tech company sometimes negotiates to a local Chicago band rather than an Austin benchmark — worth asking about explicitly.
Washington, D.C. is its own market, boosted by federal contracts and defense/intelligence security clearance premiums. BLS puts the DC-area median in the $130K-$140K range. Cleared security roles (TS/SCI eligible) add $20K-$40K to base anywhere they appear; Chicago has a modest cleared-role pipeline through defense contractors but nothing approaching the DC footprint.
What drives the spread: company tier, level, and specialty
Three variables explain most of the P25-to-P90 variance in Chicago security compensation.
Company tier
At a Fortune 500 insurance company, a mid-level security analyst might earn $95K-$110K base with a 5-10% annual bonus and no equity. At CME Group, the same seniority level earns $145K-$165K with a 15-20% bonus. At a late-stage startup or trading firm, the same person might be at $160K-$180K base with meaningful equity upside. The tier gap is not purely about prestige — it reflects how central security is to the core business model. A trading firm that gets breached loses clients and regulatory standing overnight; an insurance company faces a slower, more manageable exposure. That difference in existential risk is priced into compensation.
Level
BLS lumps L1 through L6 into one occupation code, which mechanically inflates the percentile spread. In practice:
- Entry-level / analyst (0-3 years): $75K-$95K base. Mostly compliance monitoring, SIEM alert triage, vulnerability scanning.
- Mid-level security engineer (3-6 years): $105K-$135K base. Threat modeling, cloud security architecture, incident response.
- Senior security engineer (6-10 years): $140K-$175K base at tech/finance employers; $120K-$145K at legacy enterprise.
- Staff / principal security engineer (10+ years): $175K-$220K+ base at top employers, often with substantial cash bonus. These roles sit at the P90 ceiling and above.
Specialty
Not all security specialties pay alike. In Chicago’s 2024-2025 market, the highest premiums attach to:
- Cloud security / AWS/Azure/GCP security architecture: $15K-$30K above generalist peers at the same level. Chicago’s financial services and healthcare sectors have accelerated cloud migration, and qualified cloud security engineers are scarce.
- Application security (AppSec): $10K-$25K premium. Any company with a software development pipeline needs AppSec; demand consistently outpaces supply.
- Red team / offensive security: Narrow market but top-paying — senior red teamers at Chicago trading firms or large banks earn $165K-$200K base.
- GRC / compliance: More supply than demand at the mid-level. Median pay is closer to the P25-P50 band ($85K-$115K). The premium route here is a CISO track at a smaller company, not staff engineering at a large one.
- Security clearance (TS/SCI): Adds roughly $20K-$35K at any level for roles requiring clearance. Rare in Chicago relative to DC, but Motorola Solutions and several defense contractors maintain cleared security pipelines.
Total compensation breakdown
The BLS $116,520 median covers base salary only. For a mid-level security engineer at a typical Chicago employer, the full picture looks like this:
- Base salary: $116,520. This is the BLS-tracked figure. At legacy enterprise employers it may be slightly lower; at finance and tech employers slightly higher.
- Annual bonus: ~$14,000. Chicago security roles at non-startup employers typically carry a 10-15% bonus target. At financial services firms, realized bonuses often exceed target in good years; at non-profits and healthcare, they may be 3-5% or zero.
- Equity / stock: ~$8,000 annualized. For publicly traded employers (Morningstar, CME, Motorola Solutions), annual RSU grants for mid-level security engineers typically run $25K-$50K over a four-year vest — roughly $6K-$12K annualized. Startups vary wildly. Pure GRC roles at private companies often have no equity at all.
Total at median: ~$138,520. The blended total is meaningfully above the base-only number because Chicago’s financial services bonus culture bleeds into adjacent sectors.
For a senior security engineer (P75, $143,540 base) at a financial firm: add $25K-$35K bonus and $15K-$25K annualized equity and total comp reaches $180K-$200K. At the P90 ($171,100 base) inside a trading firm or top-tier bank, total comp including bonus lands $220K-$280K — significantly above what the BLS base-only number suggests.
Cost-of-living adjusted view
Chicago’s cost of living index sits at approximately 112 on the standard US-average-equals-100 scale — driven primarily by housing costs that run 20-25% above national average, with groceries and healthcare adding moderate premiums. This positions Chicago as a moderately expensive city, not an extreme one.
The practical math: a $116,520 Chicago base has roughly $104,000 of purchasing power at the US average. Flip it: to match Chicago’s $116,520 purchasing power, a job in a US-average-cost city only needs to pay you $104K. That gap is real but not dramatic.
Where it gets interesting is the comparison with coastal markets. San Francisco’s COL index runs around 178. A $165,000 SF base — which is what a BLS-median security engineer earns there — has purchasing power of about $92,600 at the US average. Chicago’s $116,520 median buys more in real terms than SF’s $165K median. NYC’s COL index runs around 130-135; an NYC median of $140K buys roughly $105K of purchasing power — roughly on par with Chicago’s $116,520.
This is the argument for staying in Chicago rather than chasing coastal numbers: you are closer to cost-parity with NYC than the headline salary gap suggests, you keep access to Chicago’s deep finance sector bonus culture, and you avoid the rent drag that erodes SF compensation at every level below $200K base.
Remote roles are the wild card. A security engineer working remotely for a San Francisco or Seattle company at a “national” pay band of $130K-$150K brings home more purchasing power in Chicago than a locally-employed peer at $116K — before factoring in any equity upside. That arbitrage is real and worth pursuing, particularly for cloud security and AppSec specialists whose work is fully location-agnostic.
Three-lever negotiation playbook
BLS projects 29% employment growth for Information Security Analysts from 2024 to 2034 — the fastest-growing major tech occupation. Employer demand is outpacing talent supply, which means security engineers in Chicago have genuine negotiating leverage at every level. Three levers that work in this market:
Lever 1: Anchor to the role’s security tier, not the occupation-code median.
The BLS $116,520 median is a blended average across the entire occupation from compliance analyst to cloud security architect. If you are interviewing for a cloud security or AppSec role at a financial services firm, the relevant market comp is $140K-$165K for mid-level, not $116K. Come in armed with CME Group’s published compensation ranges, Glassdoor’s finance-sector data ($155K-$165K median for cyber security engineers), and any Levels.fyi data points for the specific employer. Framing the negotiation around the right peer group — not the broad BLS bucket — shifts the anchor immediately.
Lever 2: Push hardest on signing bonus at offers below your target base.
Chicago employers in regulated industries (insurance, healthcare, banking) have rigid internal compensation bands tied to job grades. Moving the base often requires an HR exception and VP sign-off. Signing bonuses operate outside the band system and are typically within recruiter authority up to a stated cap. If a company offers $120K base when you need $130K, asking for a $15K-$20K signing bonus to bridge the gap is frequently approved where a base increase is not. Signing bonuses also help offset unvested equity you leave behind at a prior employer — frame it that way.
Lever 3: Negotiate certification and training budget as comp.
This lever is underused in security specifically. Chicago’s financial services and healthcare employers routinely approve $5K-$15K annual certification and training budgets for security engineers — CISSP exam fees alone run $750, OSCP costs $1,499 for a standard package, cloud certification exams add up fast. A $10K annual cert budget you negotiated at the offer stage is effectively $10K of tax-advantaged compensation. More importantly, the certifications compound your value for the next offer. Ask for it explicitly, in writing, in the offer letter or offer email — not in a verbal side conversation.
A note on competing offers. Chicago is a one-degree-of-separation market in financial services security — everyone knows the CISO at the next firm. Fabricating or inflating a competing offer is a reputational risk that follows you. Bring real competing offers when you have them; they are the single most reliable mechanism for moving a base salary above the internal band. If you do not have one, say so, and negotiate on market data instead.
Data caveats
BLS OEWS is the most rigorous public salary source available — mandatory employer reporting covering millions of workers annually — but it has limitations worth knowing:
Equity is excluded entirely. For roles at public companies, BLS understates true total compensation by 10-30% depending on level and employer type. For trading firm roles, it can understate by 50% or more once bonus is included.
The data is lagged. May 2024 survey results reflect wages paid in May 2024. By mid-2026, base salary bands at top employers have moved 5-10% higher. Use BLS figures as a floor for “what was normal 18 months ago,” then triangulate with more current sources.
SOC 15-1212 is a wide bucket. It includes everyone from a hospital IT security analyst checking firewall logs to a principal threat intelligence engineer at a hedge fund. The occupation code does not distinguish specialty, clearance, or seniority. The P25-P90 spread exists precisely because these are structurally different jobs that happen to share an O*NET code.
What to use alongside BLS: Glassdoor’s Chicago-specific security engineer data (regularly updated; shows $155K-$165K average for finance-sector security engineers), Built In Chicago’s reported salary ranges for posted roles, and salary bands that Illinois employers are beginning to disclose voluntarily on postings. Triangulating across all three gets you within 8-12% of what any specific offer should look like for a given specialty and employer type.
The BLS number is your baseline. The financial services premium, the specialty differential, and the total-comp stack are where the real negotiation lives.