Hiring and pay signals

Security hiring posts are pointing to a split market: senior engineering roles in Austin are clearing well above $150,000, while governance tracks still pay into six figures. (monster.com) One Austin listing for a Senior Security Engineer focused on threat modeling showed a pay band of $157,675 to $265,000. A separate Austin posting for a Principal Information Security Engineer at Self Financial listed $180,000 to $210,000. (monster.com, job-boards.greenhouse.io) Those jobs are not narrow compliance seats. The Self Financial role combines incident response, cloud security, vendor reviews, and SOC 2 and PCI audit work with engineering teams. (job-boards.greenhouse.io) Marketwide pay data in Austin is lower than those top postings but still elevated. Built In showed an average Austin cybersecurity engineer base salary of $185,000, while ZipRecruiter put the March 2026 average for cyber security engineers in Austin at $121,809, with the 90th percentile at $161,071. (builtin.com, ziprecruiter.com) Governance, risk, and compliance work — usually shortened to GRC — pays less on average than senior engineering, but current postings show it is not low-wage back-office work. Salary.com listed the U.S. average for a governance, risk, and compliance analyst at $100,927 as of April 1, 2026. (salary.com) Remote listings stretch that range upward for senior specialists. Indeed showed remote GRC openings in April 2026 from $70,000 to $80,000 for one analyst role, $76,000 to $134,000 for a senior technical GRC analyst role, and $151,000 to $259,000 for Mozilla’s Senior Staff Analyst, GRC. (indeed.com) The pay gap tracks the skill mix employers are advertising. Higher bands cluster around roles that combine architecture reviews, threat modeling, secure software delivery, and compliance evidence rather than pure policy writing or pure coding. (monster.com, job-boards.greenhouse.io, job-boards.greenhouse.io) That same pattern shows up in application security hiring tied to artificial intelligence systems. xAI’s Application Security Engineer posting called for code review, CI/CD pipeline security, software supply chain controls, and familiarity with the OWASP large language model Top 10. (job-boards.greenhouse.io) The result is a market where “security engineer” can mean anything from a $120,000 Austin benchmark role to a $200,000-plus architecture and product-security seat, and where non-coding governance work can still move into senior six-figure territory when it sits close to infrastructure, audits, and product decisions. (ziprecruiter.com, monster.com, indeed.com)