Skills that make the work valuable
- Security risk assessment
- Threat modeling
- Control gap analysis
- Security roadmap communication
Build proof, not just a list
Create a security review for a fictional small organization, covering access, backups, vendors, and incident preparation. Rank findings by business impact and effort, and assign owners without claiming certification or complete protection.
How to price this work as a freelancer
Scope the business units, systems, interviews, evidence review, and final decision materials before quoting an assessment. Separate advice from control implementation and recurring governance. Stakeholder availability, document collection, liability coverage, and scope expansion can consume substantial time even when technical testing is not part of the work.
Start with the income you need to replace
Required hourly rate = (target salary + benefits budget + annual business expenses) ÷ (annual billable hours × share of revenue retained after fees).
For illustration, $100/hour × 25 billable hours/week × 48 working weeks = $120,000 revenue. After $20,000 in business expenses, that leaves $100,000 profit before personal taxes. Replacing a $100,000 salary plus $15,000 in benefits under those assumptions takes $112.50/hour, with no percentage fees.
These are editable planning assumptions, not rates surveyed for security consultant work. Your personal taxes, location, contract terms, and workload still affect the comparison.
Employee or freelancer?
Working as an employee
An internal advisory role can follow recommendations through implementation and learn organizational constraints. Priorities may depend on budget and executive support, so clarify whether the role can influence the controls it recommends.
Running a freelance business
Consulting can offer varied problems and a clear assessment deliverable. Trust, references, and follow-through matter, while lengthy sales cycles and professional responsibility affect the annual time available for paid reviews.
Where this career could take you
- 01Security Analyst
- 02Security Consultant
- 03Principal Security Consultant
An example path, with room for lateral moves or specialization. Progression depends on opportunities and demonstrated work; these steps do not imply a timetable or salary increase.
Try one small next step
Write a short threat model for a fictional organization and prioritize three realistic improvements. Explain each recommendation to a nontechnical reader and revise language they find unclear.