Security Engineer Salary in Washington DC — 2026 BLS Data
Salary distribution
Percentile breakdown of Security Engineer base salaries in Washington DC.
The $127,760 BLS median for a security engineer in Washington DC is one of the most misleading salary figures in tech — not because it’s wrong, but because it flattens an unusually fractured market into a single number. DC’s security talent pool splits into two mostly separate economies: cleared defense contractors and federal agencies on one side, commercial tech companies and Big Four consultancies on the other. The credentials that maximize earnings in one track actively signal overspecialization to recruiters in the other. Understanding which side of that divide you’re targeting — or crossing — explains more about your salary trajectory than any benchmark table.
The figures below draw from BLS OEWS May 2024 data for SOC code 15-1212 (Information Security Analysts), the closest occupational match to “Security Engineer” in the BLS taxonomy, for the Washington-Arlington-Alexandria DC-VA-MD-WV metropolitan statistical area. It covers roughly 42,000 workers in one of the densest concentrations of cybersecurity employment anywhere in the world.
What the DC median actually hides
P25 of $109,680 to P90 of $173,840 is a $64,000 spread inside a single metro. That’s narrower than San Francisco’s software engineer range but represents a much sharper structural divide: the bottom of that band is mostly mid-level analysts at civilian agencies and smaller contractors, while the top is senior-level engineers at defense primes with active TS/SCI access.
A few structural features make DC’s security market behave differently from other tech hubs:
The GS-schedule floor. Roughly 30% of security roles in the metro are direct federal employment governed by the General Schedule pay table. A GS-13 Step 1 in the DC locality in 2024 starts at $107,413; GS-14 Step 1 is $127,018. These numbers almost perfectly track BLS’s P25 and P50, which is not a coincidence — the federal government employs such a large share of area security professionals that it anchors the lower end of the distribution. If you’re going direct federal, the OPM GS table tells you exactly where you land; negotiation room is minimal.
The contractor premium. Defense and intelligence contractors — Booz Allen Hamilton, Leidos, SAIC, CACI, Peraton, General Dynamics IT — pay a 15–25% premium over direct federal for the same clearance and seniority because they compete against each other for cleared talent. A cleared mid-level analyst who would be GS-12 in the agency is often paid $115K–$130K at a prime contractor for the same work. The premium exists to cover the overhead of cleared recruiting and the poaching risk from the agency itself.
The commercial outlier problem. A handful of commercial tech companies — Amazon Web Services (with its enormous federal cloud practice in Northern Virginia), Microsoft Azure Government, Palo Alto Networks, CrowdStrike, Mandiant/Google — pay closer to national tech-company norms. A senior security engineer at AWS in the DC area with no clearance requirement can clear $175K–$210K base, which puts them above the P90 of the BLS distribution. These roles skew the P90 upward without being representative of the broader market.
Hub comparison: DC versus other security markets
DC’s $127,760 median for security professionals places it well above the national median of $124,910, but the real premium comes when you compare total compensation and market depth, not just base salary.
San Francisco / Bay Area: Higher base salaries at private tech companies ($150K–$180K for mid-level at FAANG-tier), much larger equity packages, but almost no clearance-driven demand. A TS/SCI holder willing to stay in DC captures a premium that simply doesn’t exist in SF.
New York City: Strong in financial services security (Goldman Sachs, JPMorgan, Bloomberg pay $155K–$185K for comparable seniority), but a shallow pool of cleared roles and much higher cost of living than DC. The hedge fund and bank premium matches or exceeds DC on cash but offers less job stability and no clearance career path.
Austin / Denver: Lower absolute salaries ($110K–$135K median), but meaningfully lower cost of living. These markets have grown rapidly since 2020 as remote and hybrid work expanded, but they lack DC’s depth in cleared work — fewer than 10% of DC’s security job volume for cleared roles.
Seattle: Strong in cloud security (Amazon, Microsoft), competitive on base at $140K–$165K median. Better equity than DC but lacks the cleared market. The right choice if cloud-native security is your specialty and you don’t have or want a clearance.
For security professionals who hold or are willing to obtain a clearance, DC has no peer as a career market. The Department of Defense, NSA, CISA, DHS, and the intelligence community collectively employ and contract more security professionals than any other metro by a wide margin — estimates from CyberSeek put DC’s cleared cybersecurity workforce at over 85,000 roles as of 2024.
What drives the spread: company tier, clearance level, and specialty
Three variables explain most of the P25-to-P90 gap in Washington DC:
Clearance level. This is the dominant salary driver in DC in a way that has no parallel in other tech markets. A Secret clearance adds roughly $10K–$20K over uncleared equivalents. Top Secret bumps that to $25K–$35K. TS/SCI with a full-scope (lifestyle) polygraph — the credential required for many NSA and intelligence community roles — commands $35K–$60K above uncleared market rates at comparable seniority. Major contractors have implemented formal “clearance retention bonuses” of $25K–$50K for professionals holding TS/SCI with poly because supply is genuinely constrained: the government’s adjudicative backlog means a new TS/SCI takes 18–36 months to obtain, and existing holders are therefore scarce.
Seniority and track. Entry-level security analysts in the DC metro earn $75K–$90K (below the BLS P10 of $83,730 for direct federal hires, somewhat higher at contractors). Mid-level, 3–7 years experience, sits in the $110K–$145K band. Senior engineers and architects with 8+ years land $145K–$175K in the contractor/commercial market, with cleared senior roles often clearing $180K–$200K total cash. Principal/fellow-level roles at a handful of organizations (NSA, DARPA, elite red teams) reach $200K+ base.
Technical specialty. Not all security disciplines pay equally in DC:
- Cloud security architecture (AWS GovCloud, Azure Government): commands a 15–20% premium over general security analyst roles because demand is outrunning supply of engineers who know both cloud infrastructure and FedRAMP authorization frameworks.
- Offensive security / red team: specialized roles at cleared research organizations pay $160K–$190K at mid-senior levels, more than almost any other specialty.
- OT/ICS security (industrial control systems for critical infrastructure): significant demand growth post-Colonial Pipeline; relatively few qualified engineers means 10–15% market premium over IT security.
- GRC / compliance (RMF, FISMA, FedRAMP authorization officers): high volume of openings, lower pay ceiling — mostly $95K–$130K. Important work, but if maximizing compensation is the goal, this track tops out earlier than engineering tracks.
Total compensation breakdown
Unlike San Francisco or New York, equity is not a significant component of DC security compensation outside of a narrow slice of commercial tech companies. The market is structured around W-2 base salary, annual bonuses, and benefits — particularly for contractor roles.
For a mid-to-senior security engineer at a DC-area contractor or commercial employer, a typical 2024 package looks like:
- Base salary: $127,760. The BLS median. This is cash, fully predictable, and what you’ll negotiate hardest.
- Annual bonus: ~$18,000. Most contractors pay performance bonuses of 5–15% of base. Large defense primes (Booz Allen, Leidos) target 8–12%. Commercial tech companies in the area (AWS, Microsoft) run 10–20%.
- Equity/RSUs: ~$12,000 annualized. Meaningful only at commercial tech employers. At AWS or Microsoft in DC, RSU grants for senior engineers typically run $80K–$150K over four years (annualized $20K–$37K). At defense contractors, equity is effectively zero — most are employee-owned or publicly traded with minimal grant programs for non-executives.
- Benefits premium. One component that BLS doesn’t capture but matters a great deal in DC: federal contractor benefits packages are often superior to commercial tech — fully-paid health insurance, defined-contribution 401(k) matches of 4–6%, and 15–25 days of paid leave as standard. When monetized, this can add $15K–$25K in annual value over a startup or small-company package.
Total cash comp at median for a cleared mid-senior engineer: approximately $145K–$165K. For TS/SCI holders at top-tier contractors or commercial employers: $175K–$210K total cash.
Cost-of-living adjusted reality
Washington DC’s cost-of-living index of approximately 154 (US average = 100) means everyday expenses run 54% above the national average. Housing is the dominant driver — median 2-bedroom apartment rents in DC proper run $3,200–$3,800/month; Northern Virginia suburbs (Arlington, McLean, Reston) trend slightly lower at $2,400–$3,000 but still 60–70% above a mid-sized US city.
What the COL math means for your salary:
A $127,760 DC base has the equivalent purchasing power of roughly $83,000 at the national average. Flip that calculation: to match DC’s lifestyle on your actual dollars, a city at the US average needs to offer you $83K for the same outcome. Denver ($127 COL index) at $107K in equivalent pay would feel similar to DC at $127K. Austin ($119 COL index) at $100K matches DC’s $127K in purchasing power.
The catch that simple COL math misses: DC’s cleared security market has no real geographic substitute. The jobs that pay $160K–$180K for TS/SCI holders in Northern Virginia largely don’t exist in Austin or Denver at any salary. If you hold a clearance, you’re choosing between DC’s compensation plus its COL drag, or substantially lower absolute pay elsewhere. The break-even analysis typically favors DC for most security professionals until they reach senior-principal level and can command remote-eligible rates.
For uncleared commercial security roles, the COL calculus is starker. An uncleared security engineer earning DC’s P50 of $127K is taking a meaningful purchasing-power haircut compared to the same person earning $130K in Dallas or $120K in Columbus. Remote work or a lateral move to a lower-COL metro can represent a real net raise without a title change.
Three-lever negotiation playbook
DC’s security market has some structural features that change how negotiation works compared to the broader tech market:
Lever 1: Compete the clearance, not just the role. If you hold an active TS/SCI, you’re a perishable asset to your current employer — re-investigating you when you leave costs them nothing; losing your clearance access costs the contract. Before any offer conversation, quantify what replacing your clearance tenure is worth to a contractor: the average new hire with a TS/SCI investigation costs $18,000–$30,000 in investigative and onboarding expenses and takes 12–18 months to reach full productivity. Framing a $15K–$20K raise as “cheaper than the alternative” is accurate, not aggressive. This argument works especially well for retention conversations — use it at year 2, not year 5 when they’ve already hedged.
Lever 2: Anchor to the FedRAMP/GovCloud premium. If you have cloud security experience with AWS GovCloud, Azure Government, or FedRAMP authorization experience, you are in a narrower and higher-paid subset of the DC market than the BLS median reflects. Before accepting any offer, search USAJobs and contractor postings for your specific skills plus “FedRAMP” or “GovCloud.” If your current or prospective employer is posting for your skill set at $20K–$30K above the number they’re offering you, you have leverage — and a concrete data point to bring to the table. Print the posting, literally.
Lever 3: Target the right moment at contractors — contract re-compete time. Defense IT contracts typically run 5 years with two option years. When a prime contractor is re-competing (bidding a follow-on or competing a rebid), they need to hold their team together to win — attrition is the single largest risk to a successful re-compete. The 6–9 months before a known contract re-compete is when your leverage is highest and a retention bonus or off-cycle raise is most accessible. Ask your program manager directly: “What’s the re-compete timeline, and what’s the plan to retain the team through the transition?” The answer tells you whether now is the moment to push.
Data caveats
BLS OEWS is the most rigorous public dataset for salary benchmarking — mandatory employer reporting across tens of millions of workers — but it has real limitations in the DC security market:
- Clearance premiums are invisible. BLS does not ask employers to report whether a role requires a security clearance. The TS/SCI premium of $30K–$60K over uncleared equivalents is real but not captured in the percentile distribution. The BLS P75 of $150,920 for DC security analysts almost certainly includes a higher share of cleared roles than the national average; uncleared DC roles probably cluster closer to P50–P60.
- Federal employment caps distort the lower percentiles. Because the GS pay table has hard step maximums and supervisory differentiation limits, P25 and P50 in DC are partly administrative artifacts of federal pay policy, not just market clearing prices.
- BLS uses a broad SOC code. SOC 15-1212 covers information security analysts across all industries — a compliance-focused FISMA analyst and a principal red team engineer are both counted. The occupation code contains enormous skill heterogeneity. If your skills are specialized (cloud security, OT/ICS, offensive security), your realistic market range differs substantially from the headline median.
- Data lag. May 2024 OEWS covers wages paid in May 2024. Compensation at commercial employers (AWS, Microsoft, Palo Alto Networks) has moved since then — likely 5–10% upward for cleared technical roles given demand. Direct federal and contractor base pay tied to the GS schedule adjusts on a federal calendar and is available from OPM directly.
For a fuller picture, triangulate BLS with ClearanceJobs salary surveys (specifically for cleared compensation), levels.fyi for commercial tech roles in DC, and the actual salary bands on USAJOBS postings, which began including pay ranges. The combination gets you within 8–12% of where any specific offer should land.