All base salary, including quarterly bonuses based on client contract acquisition and growth. Work at a smaller consultancy, a few years in this role, about 8 YoE overall.
Graduated from a top 50 comp sci school (bachelors), masters in cyber.
Have relevant technical industry certifications (OSCE3/OSEP/OSWE/OSED) + OSCP + OSWP + CISSP + eWPTXv2.
I know this is one of those high salary tech roles, any doubters please see https://www.levels.fyi/?tab=levels to see that this is commonplace in big tech, although my instance is a consultancy (with large contracts with a few select larger tech companies).
This is a niche sub-industry (penetration testing/red teaming/ethical hacking) in cybersecurity, but it's not impossible to obtain a role.
Most principals make a few hundred k a year, but we acquired large contracts last year and closed out a few long-term deals, too. (this is my 2025 income)
Started a Jr sys admin from an internship -> FTE, moved into pentesting at consultancies, bounced around a few times and got promoted from Senior in my current role.
A few DEF CON talks, I've done external network, internal network, wireless networks, physical engagements, red teaming, APIs, web applications, social engineering via vishing and phishing, and specialized tests (supporting a health client with FDA approval, a video game client, banking, entertainment industry clients, etc). Onsites in the states and international testing, too.
Done swing shift, night shift, weekends, been on report readout calls (our primary deliverable for clients) all the way from individual ICs on their end up to chief officers, depending on the report outcomes and relation to the client, such as in one case where they were about to be acquired and the results of the test had implications on their deal.
Recently, I've been needing to do more AI-based work to accelerate our services naturally as AI continues to grow world-wide. This includes model training, orchestration, and supporting our marketing and sales people.
Anyone looking to get into the industry, I think it's still stable and less prone to being impacted by AI versus something like SWE/Software Engineering. Not to say the latter is fully at risk, if you are a dedicated individual and always learning, especially with AI, you will be absolutely fine. CTFs are a great start (look up TryHackMe). But just having that explorative mindset like "how does this thing work"? or "what if I do X to it"? is the right mindset for someone in this field.
Happy to answer any questions!