Written by Jaiz Anuar

Your Employer Manages Your Increment. You Manage Your Career.

Annual increments are managed by employers. Career trajectory is built through deliberate choices about learning, responsibility, leadership and mobility.

Most professionals understand how annual salary reviews work.

Perform well.

Meet expectations.

Take on additional responsibilities.

Wait for the annual review.

Receive an increment.

Then repeat the same cycle next year.

There is nothing necessarily wrong with that approach.

But over a cybersecurity career that may span twenty or thirty years, there is an important question worth asking:

Are you managing your salary, or are you managing your career?

The difference can become surprisingly significant.

Staying And Moving Produce Different Outcomes

Recent U.S. wage data provides an interesting perspective.

The Federal Reserve Bank of Atlanta's Wage Growth Tracker reported that, as of July 2026, workers who stayed in their jobs recorded median year-on-year wage growth of 3.6%, compared with 4.4% for job switchers.

Economist Justin Wolfers made a similar observation in his recent discussion, The Economics of Feeling Ripped Off, noting that recent wage gains have been driven disproportionately by people changing jobs.

The immediate conclusion may seem obvious.

Want a bigger raise?

Change jobs.

But I think that conclusion is too simple.

A good career strategy is not about changing organisations every few years just to increase salary.

It is about understanding when staying creates value and when moving creates greater opportunity.

Not Every Job Change Is Career Growth

Someone can change employers and receive a 20% salary increase.

That does not automatically mean their career has progressed by 20%.

Perhaps the role is almost identical.

The responsibilities remain the same.

The exposure remains the same.

The person simply performs the same job for another organisation at a higher salary.

Financially, that may still be worthwhile.

But career growth should be measured differently.

Did the new role increase your responsibility?

Did you gain exposure to larger environments?

Are you solving more difficult problems?

Are you now influencing decisions?

Are you learning something that makes you more valuable five years from now?

That is career progression.

Salary should ideally follow it.

Cybersecurity Careers Compound Too

Cybersecurity professionals sometimes think about careers one job at a time.

Analyst.

Senior Analyst.

Manager.

Head.

Architect.

CISO.

But careers compound in much the same way investments do.

One strong move may lead to another opportunity several years later.

A project gives you architecture experience.

Architecture experience gives you enterprise exposure.

Enterprise exposure gives you leadership responsibility.

Leadership experience gives you access to executive-level roles.

The value of the first move may therefore appear many years later.

This is why small differences in career trajectory can create very different outcomes over thirty years.

The mathematics behind job switching is interesting.

The career compounding behind it is even more important.

Sometimes Staying Is The Better Strategy

This is where job-hopping advice often becomes misleading.

There are times when staying is strategically smarter.

Perhaps you are about to lead a major transformation.

Perhaps your organisation is giving you exposure to the Board.

Perhaps you are building a new cybersecurity function.

Perhaps your manager is preparing you for leadership.

Perhaps you are gaining experience that would be difficult to obtain elsewhere.

Leaving purely for another 10% may actually reduce your long-term career value.

Salary is visible immediately.

Experience sometimes takes years to reveal its value.

A good career decision considers both.

Know When You Have Stopped Growing

There is also a point where loyalty can become career stagnation.

You have mastered the role.

The problems no longer challenge you.

Responsibilities have stopped increasing.

Promotions are unlikely.

You keep receiving good performance ratings but your career remains exactly where it was three years ago.

That is when another question becomes important:

What am I still gaining by staying?

Not:

"Am I unhappy?"

Not:

"Is my employer bad?"

Simply:

"Is this role still moving me towards where I want to be?"

You do not need to dislike an organisation before deciding that your career needs another environment.

Build Market Value Before You Need It

The worst time to think about your career is when you desperately need another job.

Career strategy should begin much earlier.

Build expertise.

Take difficult assignments.

Lead projects.

Develop business understanding.

Write.

Present.

Mentor others.

Build professional relationships.

Understand where the industry is moving.

Make your contribution visible without turning everything into self-promotion.

Then when opportunities appear, you have choices.

That is very different from sending twenty applications because you suddenly feel underpaid.

Certifications Are Only One Part Of The Equation

Cybersecurity professionals often respond to career uncertainty by collecting another certification.

Sometimes that is useful.

Sometimes it is simply easier than asking the harder question.

What capability am I actually trying to build?

A certification should support a career direction.

It should not become the career direction.

The professional who combines technical capability, business understanding, judgement, leadership and a strong professional reputation often has considerably more career mobility than someone who simply accumulates credentials.

Career mobility creates negotiating power.

And negotiating power affects compensation.

Your Manager Owns Your Performance Review. You Own Your Career.

A good manager can help enormously.

They can mentor you.

Create opportunities.

Recommend promotions.

Increase your exposure.

Support your development.

But your manager cannot own your thirty-year career plan.

You have to.

That means occasionally making uncomfortable decisions.

Stay or move?

Specialise or lead?

Take the higher salary or the better opportunity?

Accept the comfortable role or the difficult assignment?

There is no universal answer.

But there should be a reason behind the decision.

Final Thoughts

The difference between a 3.6% raise and a larger increase may look small in a single year.

Across an entire career, repeated differences compound.

But the biggest lesson is not that everyone should change jobs every three years.

That would be poor career advice.

The lesson is that passive careers usually produce passive outcomes.

If you simply wait for the next annual increment, your organisation largely determines your trajectory.

If you deliberately build capability, seek responsibility, understand your market value and move when the opportunity genuinely advances your career, the outcome can be very different.

Sometimes the right decision is to stay.

Sometimes the right decision is to leave.

The important thing is knowing why.

Because the best cybersecurity careers are rarely built around the next salary increase.

They are built around the person you are trying to become ten years from now.

Don't chase increments. Build career value.

Question assumptions. Share knowledge. Build trust.