James Henderson

Building an MSSP in NZ could cost $1.68M on talent alone

The cost of building a dedicated managed security service provider (MSSP) from the ground up in New Zealand could require a talent investment of $1.68 million, with cyber credentials commanding deep pockets across the ecosystem.

Based on paying a premium in a highly competitive market, this figure – which is reported in NZD – is expected to hold firm irrespective of city with salaries in Auckland, Wellington and Christchurch identical across the vast majority of roles.

Exclusive of KiwiSaver plus additional hiring and recruitment costs, this number is based on the standard roles required to deliver a credible MSSP offering but could be scaled up or down depending on services provided.

Adam Shapley (Hays)

If hired and deployed, this talent pool would service a local market expected to spend $1 billion on cyber security solutions and services during the next 12 months.

While the exact talent cost could be negotiated, this is the dilemma facing a channel now accepting of the fact that selling security services is not as easy as adding new products to an expanding IT services portfolio.

According to Hays Salary Guide 2023/24 – and based on the highest salary range per position in either Auckland and Wellington – the talent cost of building an MSSP practice in New Zealand is broken down as:

Auckland / Wellington:

  • Security Analyst: $140K
  • Security Engineer: $160K
  • Security Architect: $200K
  • GRC Consultant: $200K
  • SOC Manager: $180K
  • Penetration Tester: $170K
  • IDAM Engineer: $170K
  • IDAM Architect: $210K
  • CISO: $250K

Total = $1.68 million

(GRC – governance, risk management and compliance / SOC – security operations centre / IDAM – identity and access management)

The talent cost total in Christchurch is marginally lower at $1.62 million with only SOC Manager ($160K), IDAM Engineer ($160K) and CISO ($210K) positions expected to command slightly lower salaries at the most expensive end of the scale.

But these figures might be temporary given that 97% of Kiwi employers within the technology sector are expected to offer higher salaries during the next 12 months.

Specifically, most industry players – which spans channel partners, vendors, distributors and the in-house IT departments of end-user organisations – are expected to offer a salary increase somewhere between 3-6% (53%), ahead of 7-10% (15%) and more than 10% (3%).

Either way – and according to Hays – 92% of employers within the technology industry in New Zealand are experiencing a skills shortage with a lack of talent impacting productivity (63%), project delivery (59%), growth and expansion plans (49%) and revenue and profit (41%).

In response – and somewhat unsurprisingly – 37% of businesses are considering employing or sponsoring an overseas candidate to help plug the skills gap.

“Despite some levelling off in demand, the shortage in technology skills will remain for some time,” observed Adam Shapley, Managing Director of Technology Solutions across Australia and New Zealand at Hays.

Shapley said that offshoring – which reversed during the height of the pandemic – is also making a comeback.

“Remote work has demonstrated the feasibility of utilising talent irrespective of geographic location and a tight local market motivates organisations to search for more capacity and capability,” he added.

In-demand cyber contractors command premium rate

Moving away from full-time employees, in-demand technology contractors also continue to command a premium rate in New Zealand. Within the space of 12 months, the typical day rates of Penetration Testers, Test / QA Managers and Software Developers have increased by 12%, 7% and 6% respectively.

Away from cyber security however, many rates have remained flat over the year – evident by an 11% drop in typical rates for enterprise resource planning (ERP) and customer relationship management (CRM) roles – “this reflects the maturing digitisation journey of organisations”.

“With large organisations now finalising digital transformations and ERP system implementation projects, project managers are in less demand and command lower daily rates,” Shapley explained.

Within that context, the rates that Business Analysts and Senior Business Analysts can command have also “topped out”.

According to Hays IT Contractor Rates Guide 2023/24, the most expensive daily contractor rates for cyber security professionals in New Zealand are:

Auckland / Wellington / Christchurch:

  • Security Analyst: $960
  • Security Engineer: $1040
  • Security Architect: $1600
  • GRC Consultant: $1280
  • SOC Manager: $1600
  • Penetration Tester: $960
  • IDAM Engineer: $1200
  • IDAM Architect: $1600

“The technology industry has transitioned from a boom to a phase of correction and stabilisation,” Shapley stated. “Skill recalibration and evolving market dynamics shape the sector’s landscape, with implications for strategies on attracting and retaining top IT contractors.”


Inform your opinion with executive guidance, in-depth analysis and business commentary.