CISO salary in Canada: what the role costs
A Canadian CISO base salary runs about $180,000 to $300,000 CAD, and the fully loaded first-year cost of the hire runs about $300,000 to $450,000 CAD once bonus, employer burden and recruiting are counted. The gap between those two numbers is why the salary figure alone is a bad basis for a budget.
Base salary for a chief information security officer in Canada sits between $180,000 and $300,000 CAD for most of the market, with a smaller band above that at large regulated institutions. Add a target bonus, statutory employer costs, benefits and the recruiting fee and the first year lands between $300,000 and $450,000 CAD. Equity is excluded from every figure on this page, because it is not comparable across a private company, a public company and a Crown corporation.
If you are a founder at a 40 person startup working out what to budget: under 50 people you are not hiring one of these. The numbers below are what you are avoiding, not what you are buying. Security leadership at your size is bought fractionally at $3,000 to $12,000 CAD a month, and your question is answered on vCISO against a full-time CISO and whether your first security person should be a hire at all. Use this page as a benchmark, not a plan.
$180k to $300k Base salary band, CAD
$300k to $450k First year, fully loaded, CAD
4 to 7 months Typical time to fill the role
Where these numbers come from, and what they are not
There is no large published Canadian salary survey for this role. The bands below are assembled from posted Canadian job advertisements that state a range, from public sector and broader public sector disclosure where compensation is published by law, and from what Canadian search firms quote when scoping a mandate. They are ranges on purpose. Anyone publishing a Canadian CISO salary to the dollar is either quoting one data point or converting an American survey and not saying so.
What does a CISO earn by company size in Canada?
Company size predicts the number better than industry does. It predicts scope: how many people report in, how much budget is owned, and whether the role sits on the executive team or two levels below it.
| Company size | Base salary | Target bonus | What the role actually is |
|---|---|---|---|
| Under 50 staff | Rarely hired | n/a | The work exists, the full-time job does not. This is the honest case for a retainer |
| 50 to 200 | $160,000 to $210,000 | 10 to 15% | A hands-on head of security with no team, often titled director rather than CISO |
| 200 to 750 | $190,000 to $260,000 | 15 to 20% | Two to six people reporting in, owning a real budget and an audit cycle |
| 750 to 3,000 | $240,000 to $310,000 | 20 to 30% | A function with sub-teams, board reporting, and regulatory exposure |
| Large bank, insurer or telecom | $300,000 to $500,000 | 30 to 60% | An executive officer with a large team and a named regulator |
The first row is the one that changes decisions. Below about fifty people the market barely offers this job. Companies that try to create it hire a strong security engineer, give them a CISO title, and discover eighteen months later that they bought neither an executive nor an engineer. The argument is on CISO versus vCISO versus security manager.
What the salary leaves out
Base is roughly 60 per cent of what the hire costs you in year one. The table below is the working for a mid-market hire at a $210,000 base.
| Line | Low | High | Note |
|---|---|---|---|
| Base salary | $210,000 | $210,000 | Mid-market band |
| Target bonus | $21,000 | $42,000 | 10 to 20 per cent, often prorated in year one |
| Employer statutory cost | $9,000 | $12,000 | CPP and EI are capped, so they shrink as a share at this salary |
| Benefits, pension or matching | $16,000 | $34,000 | Health, dental, disability, group RRSP match |
| Recruiting | $42,000 | $63,000 | 20 to 30 per cent of base on a retained search |
| Equipment, training, certification, conferences | $6,000 | $14,000 | Ongoing, not one-time |
| First year, all in | $304,000 | $375,000 | Excludes equity and severance risk |
Two costs are not on that table. The first is the vacancy: four to seven months of search during which nobody owns the program, which on a company with an audit date is the expensive part. The second is the hire not working out, which for an executive role in Canada means notice or severance that can run to several months of pay. Neither belongs in a spreadsheet cell, and both belong in the decision. The comparison against a retainer is on vCISO versus a full-time CISO, and you can run your own numbers with the vCISO ROI calculator.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
Does a CISO salary change across Canadian cities?
Less than people expect, and less than it did before the role went remote. Toronto still pays the most because the financial sector is there and it sets the ceiling. The differential to a smaller market is roughly 10 to 20 per cent at the same scope, not the double you would see between American coastal and inland markets.
| Market | Base salary band | What moves it |
|---|---|---|
| Toronto | $210,000 to $290,000 | Banking, insurance and OSFI-regulated demand sets the ceiling |
| Vancouver | $195,000 to $265,000 | Technology and gaming, plus competition from US remote roles |
| Montreal | $185,000 to $250,000 | Law 25 work is a genuine skill premium, French is often required |
| Calgary and Edmonton | $185,000 to $255,000 | Energy and utilities, operational technology experience pays |
| Ottawa | $180,000 to $245,000 | Federal and defence adjacency, clearance requirements narrow the pool |
| Atlantic and Prairie centres | $165,000 to $225,000 | Thin local pool, so remote hiring is common and compresses the discount |
So a company in Halifax or Saskatoon is competing on national terms. The candidate can take a Toronto salary without moving. Regional pages such as vCISO services in Halifax and vCISO services across Canada cover what the local buyer pressure looks like.
How the salary compares against a retainer
A Canadian vCISO retainer runs $3,000 to $12,000 CAD a month, which is $36,000 to $144,000 a year. Against a $304,000 to $375,000 first-year hire that looks like an obvious answer. It is not the same purchase. The retainer buys four to eight days a month of senior judgement. The hire buys twenty days a month of judgement plus availability, plus someone who will do work that is beneath a $300 an hour rate.
| Annual spend on leadership | What it buys | Right when |
|---|---|---|
| $36,000 to $72,000 | Advisory retainer, 8 to 16 hours a month | A program exists and needs an owner and a board voice |
| $72,000 to $144,000 | Program leadership, 20 to 40 hours a month | A certification or remediation plan has a date on it |
| $144,000 to $300,000 | Embedded vCISO, or a director-level hire with no team | Presence matters, or the work is continuous |
| $300,000 and up | Full-time CISO, first year loaded | Security is a named part of how the company makes money |
There is a counter-case. A twelve-person fintech with a signed enterprise contract, an OSFI-regulated customer and a regulator on the other side of it needs a full-time person sooner than headcount suggests, and the band that applies is the 200 to 750 row rather than the 50 to 200 row. Size is a proxy. When the proxy and the obligations disagree, the obligations win.
Get vCISO quotes before you post the job
Most companies price the hire and never price the alternative. Tell us the trigger and the timeline and we will put the same scope in front of Canadian providers.
Get matchedCommon questions
How much does a CISO make in Canada?
Base salary of $180,000 to $300,000 CAD covers most of the Canadian market, with large banks, insurers and telecoms paying $300,000 to $500,000 plus a bonus of 30 to 60 per cent. A first security leadership hire at a company of 50 to 200 people is usually titled director and paid $160,000 to $210,000. Fully loaded, a mid-market CISO hire costs $300,000 to $450,000 CAD in year one.
Is a Canadian CISO paid less than an American one?
Yes, materially, and the gap is wider than the currency conversion. American surveys for equivalent scope commonly report base figures that convert to well above the Canadian bands here, driven by the size of the US financial and technology employers. That gap is why Canadian employers lose candidates to US remote roles, and why a Canadian offer that looks competitive against local postings can still lose.
What does a vCISO cost compared with a CISO salary?
A Canadian vCISO retainer is $3,000 to $12,000 CAD a month, so $36,000 to $144,000 a year against $300,000 to $450,000 for the first year of a hire. The retainer is not a cheaper version of the same thing. It buys four to eight days a month rather than twenty, and it does not buy availability. The comparison is worked properly on vCISO versus a full-time CISO.
Should the salary band change if we are OSFI regulated?
Yes. Federally regulated financial institutions work under OSFI Guideline B-13 and the operational risk guideline, which expect clear senior accountability for technology and cyber risk. That raises the seniority required, narrows the candidate pool to people who have been examined before, and adds roughly 15 to 25 per cent to the band at the same headcount. See vCISO work for OSFI regulated institutions.
What title should we post, CISO or director of security?
Post the title that matches the reporting line you are actually offering. Advertising a CISO title for a role that reports to the head of IT and owns no budget attracts senior candidates who leave within a year. If the role has no team and reports below the executive table, director of security is the honest title and it will not cost you candidates who were ever going to stay. Reporting lines are covered on who a CISO should report to.