From the community

Reports, surveys, and hard-won knowledge.

Materials created through our surveys, events, and community discussions, shared back with the Colorado security community. Free to use.

Salary surveys

Colorado security compensation.

Since 2019, we've produced an anonymous compensation survey from the Colorado information security community. Participants receive the full report.

Median total compensation
$222,700
Base plus bonus, all respondents, 2025
Entry-level base pay
+20.7%
$105,400 → $127,163 in one year
Security leader total comp
−6.0%
$286,318 → $269,107 over the same year
Colorado professionals surveyed
143
Self-reported, in the 2025 survey
Average base salary by career stage

Six surveys, 2019 to 2025. The gap between entry level and security leader has narrowed sharply in the last two years.

Entry level Security professional Security leader
$0 $60k $120k $180k $240k 2019 2020 2021/22 2023 2024 2025 $127,163 $168,402 $209,303

Entry level is defined as three or fewer years of experience and rests on a small sample each year (4 to 17 responses), so read that line as a signal, not a precise figure. Hover any year for the underlying counts.

Salary Survey2025Colorado Security Salary SurveyDownload → Salary Survey2024Colorado Security Salary SurveyDownload → Salary Survey2023Colorado Security Salary SurveyDownload → Salary Survey2021/22Colorado Security Salary SurveyDownload → Salary Survey2020Colorado Security Salary SurveyDownload → Salary Survey2019Leaders editionDownload → Salary Survey2019Individual Contributors editionDownload →
White papers

From the Summit floor.

At each Summit, small groups of security leaders take a topic apart together and write up what they concluded. Here is what came out, and the sharpest thing each one says.

Summit 1
White paper Preventing Burnout Security leaders on spotting burnout early, running fewer meetings, and treating resilience as a team responsibility rather than a personal failing.
From the paper“The only people that will remember you worked until 9pm every night are your family.”
In the room for this one
  • Chris AbbeyManager, Information Security, Children’s Hospital Colorado
  • Craig BuesingCISO, Gates Corporation
  • Tim CooganCISO, Denver RTD
  • Benjamin EdelenCISO, Boulder County
  • Tony GagliardiTrust & Security Program Manager, Pax8
  • Dennis HahnSenior Cyber Security Manager, Verses
  • Michael LyborgCISO, Swimlane
  • Chris MartinezSVP, Sr Cloud BISO, Bank of America
  • Joe McCallisterSenior Manager, Cybersecurity Operations, Trade Desk
  • Taylor SchmidtNetwork Security Engineer, ANB Bank
Download → White paper Making the Case for Budget Ten factors for justifying security spend, split between risk reduction and revenue growth, plus how to put it to a board.
What the group foundSecurity budgets run about 10% of the IT budget, and the companies that raised theirs most were the ones that had suffered an incident.
Download → White paper The SEC Cybersecurity Rule How the four-day disclosure rule changes board engagement, materiality calls, and a CISO’s personal exposure.
The useful bitYou control when the clock starts. The four-day window is tight, but the assessment that triggers it is yours to run properly.
Download → White paper Harnessing AI in Cybersecurity Four categories of enterprise AI use and how to govern each, from unmanaged chatbots to AI baked into vendor products.
The useful bitYou can never really block unmanaged use, you can only lose visibility into how employees are using it.
Download →
Summit 2
White paper Handling SaaS Sprawl & Shadow IT Why business units buy software without IT, and how to win visibility back without becoming the gatekeeper.
The idea to stealThe Amnesty Box. A no-blame channel for staff to declare the SaaS they are already using, because the barrier is fear of reprisal, not ignorance.
Download → White paper Integrating Security into OT Environments A step-by-step approach to industrial control systems: asset inventory, business context, and IT/OT collaboration.
The useful bitSafety and availability outrank confidentiality. On the plant floor the usual security priorities invert.
Download → White paper Leveraging Startups in Your Program The upside and the real risk of betting on early-stage vendors, with four member stories of how it actually went.
The useful bitThe supply chain is, in fact, a chain. Your customers expect your downstream vendors to hold the same posture you do.
Download → White paper Detection Engineering Moving a SOC from reacting to alerts toward engineering its own detections, with a seven-step adoption plan.
The useful bitVendor tools cover about 80% of security needs. The other 20% is customization for the threats specific to your organization, and that is the work nobody can sell you.
Download →