Cybersecurity engineer salary in Canada

What Canadian companies post as base pay for security engineers, by city and level.

Key findings

• Senior cybersecurity engineer base salary, Canada: $127K to $187K, median $139K
• Senior cybersecurity engineer base salary, Toronto: $120K to $183K, median $142K
• Staff / lead cybersecurity engineer base salary, Canada: $158K to $197K, median $176K

Salary ranges by city and level

A cell without enough postings shows "Not enough posted ranges yet" and how many postings it has.

Level	Canada	Toronto	Vancouver	Montreal	Calgary	Ottawa	Winnipeg	Remote (Canada)
Junior (0 to 1 years)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=0)	Not enough posted ranges yet (n=0)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=0)	Not enough posted ranges yet (n=0)
Intermediate (2 to 4 years)	$113K to $150K, median $136K, n=18	$110K to $146K, median $136K, n=11	Not enough posted ranges yet (n=2)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=2)	Not enough posted ranges yet (n=2)	Not enough posted ranges yet (n=0)	Not enough posted ranges yet (n=7)
Senior (5 to 7 years)	$127K to $187K, median $139K, n=31	$120K to $183K, median $142K, n=15	Not enough posted ranges yet (n=7)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=5)	Not enough posted ranges yet (n=0)	Not enough posted ranges yet (n=7)
Staff / Lead (8+ years)	$158K to $197K, median $176K, n=19	$139K to $190K, median $176K, n=12	Not enough posted ranges yet (n=5)	Not enough posted ranges yet (n=2)	Not enough posted ranges yet (n=1)	Not enough posted ranges yet (n=3)	Not enough posted ranges yet (n=0)	Not enough posted ranges yet (n=5)

Cite: Phil Mosher, Canadian tech salary data, baselinetalent.xyz, data as of November 2, 2026. CC BY 4.0.

All figures in CAD base salary.

Government survey figures

For security engineers across Canada, the government figures are: Job Bank median $103K, StatCan average offered wage $100K (Table 14-10-0444-01) for cybersecurity specialists (NOC 21220). All levels, survey data, not job postings. They cover every level, so they sit below a senior posted range.

Skills that come up in hiring

There's no public pay data by security specialty yet, so read this section as hiring notes, not numbers. Security is too broad to hire for as one job. What you've built and run at scale is what companies look at.

Application security (AppSec)

AppSec is hard to hire for. Engineers who can build security into the development cycle, do secure code reviews and set up security testing pipelines are scarce.

Cloud security (AWS, Azure, GCP)

Companies moving to the cloud need people who know cloud-native security: IAM policies, network security, secrets management and compliance at scale. Senior security roles expect it. Deep multi-cloud experience still stands out.

Compliance and governance (SOC 2, HIPAA, ISO 27001)

B2B SaaS companies win and lose deals on their security posture. People who can build and run a compliance program, manage audits and set controls that work for both security and the business help close those deals. The work is dull and it matters.

Incident response and threat detection

People who have handled real security incidents are rare. Building detection systems, running incident response playbooks and briefing executives during a crisis is what keeps an incident from turning into a breach that ends the company.

What I'd do

Security hiring has changed a lot in the past few years. Companies used to hire one "security person" to cover pen testing, compliance, incident response and security architecture. That model doesn't work anymore. Security teams are specialized, and so are the people on them. Many companies haven't updated what they hire for.

If you're hiring, decide whether you need AppSec, cloud security, compliance or incident response, and pick one for your first security hire. Generalist security engineers exist, but they cost more and you'll use a fraction of what they know. Hire a specialist for the problem in front of you and build from there.

If you're job hunting, specialize. The security engineers getting multiple offers can say something like "I'm an AppSec engineer who builds security testing pipelines," not "I do security." Communication counts too. The strongest security engineers I talk to can explain security tradeoffs to product teams in a way that changes what those teams do.

Methodology

How every number here is built, tested and checked against government data: how the salary data is built.