Pebio editorial team · Last updated: 31 October 2026
Chief Information Security Officer (CISO)
What is on your mind?
Salary: what employees earn
Actual salary (BA Entgeltatlas), not a pay scale. Median pay of full-time employees subject to social insurance; part-time is not included. The salary in your contract may differ.
Median per month (gross)
€7,850
- Region: Germany
- Applies to the occupational group KldB 43394 This occupational group covers several occupations, not only this one.
- Data import: October 2026
- Reference period of the figure: not stated in the dataset
- The source states the number of cases and the publication threshold.
Source: BA-Entgeltatlas
More about this figure
Minimum rates are not actual salaries and are listed in the pay scale section.
Your own calculation: hourly rate
Convert your monthly gross pay into an hourly rate. This is a calculation from your own input, not a comparison with the median. Nothing is stored.
Pay scales and minimum rates
These are minimums if the stated scope applies to your employment. This is not legal advice.
There is no verified statement on statutory pay under the BGB for this occupation yet.
Statutory minimum wage
Statutory
€13.90 per hour
valid from 2026-01-01, until 2026-12-31
§ 1 Nr. 1 MiLoV5: „ab 1. Januar 2026 13,90 Euro brutto je Zeitstunde“
Source: Fifth Minimum Wage Adjustment Ordinance (MiLoV5), Federal Law Gazette 2025 I No. 268 · As of 2026-10-27
Upcoming rates (1)
Statutory
€14.60 per hour
valid from 2027-01-01 · upcoming
§ 1 Nr. 2 MiLoV5: „ab 1. Januar 2027 14,60 Euro brutto je Zeitstunde“
Source: Fifth Minimum Wage Adjustment Ordinance (MiLoV5), Federal Law Gazette 2025 I No. 268 · As of 2026-10-27
Terms explained
- Generally binding collective agreement (AVE)
- A collective agreement that the labour ministry has declared binding for all employers in a sector – even without union membership.
- Framework agreement (Manteltarifvertrag)
- Sets general working conditions such as working hours, leave and notice periods, not the level of pay.
- Pay agreement (Entgelttarifvertrag)
- Sets how much is paid per pay grade.
- Pay grade (Entgeltgruppe)
- The classification by task and qualification. It decides which amount in the pay table applies to you.
Which pay scale might apply to you?
We show no sector pay scale for this occupation. Check step by step: region, employer and sector, bargaining parties, scope and period, then the original text. A match means “possibly relevant, please check”, not “applies to you”.
BMAS collective agreement registerWhere else you can go
Routes many people do not think of straight away. Every statement names source and date; what is missing reads “not documented yet”.
Head of Information Security at a Group (Group CISO)
You own the security strategy across several companies or countries. You manage budget, board reporting and crisis response.
Why you fit
You already have governance, risk and reporting experience from the CISO role. At group level the scope grows, not the skill profile.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Talk to management about a larger remit or look at open group roles.
Head of IT / CIO
You lead the whole IT organisation including operations, development and security. You link technology to company strategy.
Why you fit
As CISO you know IT risks, suppliers and projects across the company. Usually you lack only operations and budget ownership.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Take on an operations or architecture topic as an extra responsibility.
Head of Risk Management and Compliance (GRC)
You steer risks, policies and audits for the whole company. You work with internal audit, legal and management.
Why you fit
You already assess risks, implement standards and report to leadership. That is the core of GRC.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Offer risk management to feed IT risks into the overall risk assessment.
Show more routes (5)
Cyber security consulting (principal or partner)
You advise several clients on security strategy, audits and crisis preparation. You sell and lead projects.
Why you fit
You know the client side and what boards expect from advisers.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Talk to consultancies about roles with an industry focus that fits your experience.
External CISO / interim CISO
You take over the CISO role temporarily for several mid-sized firms or during transitions. You build structures and hand them over.
Why you fit
You have built a security management system yourself and can transfer it quickly to other organisations.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Check your contract for whether side activities are allowed and whether a non-compete for the time after you leave has been agreed (see rights).
Managing director or board member
You carry overall responsibility for a company or division. Security is one of several tasks.
Why you fit
You have experience with board papers, budgets and liability. That helps the step into general management.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Look for tasks with results responsibility, such as a business unit or a stake.
Executive master or MBA with a cyber security focus
You study management and security part-time. You deepen strategy, law and leadership.
Why you fit
If you had no management training on the job, this closes gaps in strategy, law and leadership and helps you connect to board-level roles.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Compare part-time programmes and ask your employer about support.
Information security auditor
You audit organisations against standards such as ISO 27001 or IT-Grundschutz. You write audit reports and give recommendations.
Why you fit
You know the requirements from the audited side and can judge evidence well.
The route there
- Further training and exam
- not documented yet
- Duration
- not documented yet
- Cost
- not documented yet
- Funding
- not documented yet
- Salary
- not documented yet
Your next step: Ask certification bodies about the requirements for auditors.
What matters to you
Choose what matters to you, if you like. We then show the matching facts about this job. There is no weighting, no rating and no overall score.
Without a selection you get a general orientation: salary, collective agreements, skills, career and knowledge are in the sections of this page. Choose above what matters to you and we will point you to the matching places.
How we assign facts
- Financial situation: Salary, Pay scales
- Security & predictability: Pay scales, Job market
- Work environment & belonging: No data
- Recognition & competence: Skills
- Growth & self-determination: Career, Skills
Job market: what job ads ask for
There is no expert-reviewed dataset for this occupation yet.
Quick check with this target job
The quick check reads your CV with this job as the target. What it shows and where its limits are is explained on the result page.
Start the quick checkNext step: Deep Check
If you want to apply for a specific position, the Deep Check is our service for that. Price: €49.
Go to the Deep Check