"9/11 was a big turning point," confirmed ISC(2) Foundation's Franz. "That is when that role around GRC became extraordinarily important. Those roles opened up, but by and large the men didn't want them... The guys might be just more rooted in the technical aspects and the GRC role requires a lot of dealing with different types of people, and with interdepartmental and cross-functional operations."
Angela Messer, executive vice president at Booz Allen Hamilton, added that women often come to information security with more diverse backgrounds than men, and this is a benefit in GRC.
"You're going into roles that are more complex, you're dealing with the business side and not just the technical side," she said. "It's a very strategic role, and women bring not just their technical skills base but also the diverse skills that they have."
Money isn't everything
In the report's salary section, Frost & Sullivan concentrated specifically on the respondents in the United States, working in GRC, in order to minimize the number of variables that can distort analysis.
And, despite their higher levels of education, women made, on average, 4.7 percent less than men. One contributing factor was that men's tenure was 5.6 longer in infosec than that of women.
But there were two other factors that came out in the survey. One was that women valued non-monetary compensation higher than men did, and the other was that women stayed longer with their employers.
For example, flexible work schedules were very important to 78 percent of female respondents, compared to 58 percent of men, while more men than women prioritized total compensation.
Last year, 20 percent of men reported that they changed employers while still employed, compared to 12 percent of women. This correlated to higher salary gains.
"You make those biggest jobs in salary when you switch positions, and women are switching less," said Franz. "You need to move to earn."
The problem, she said, is that it's still more common in marriages to move for the husband's career rather than the wife's.
"Or you're raising a family, you don't want to move the kids or drag them across the country," she added. "Consequently that's having an effect on the aggregate salaries long-term."
Companies need to be extra careful to address the wage gap, said Booz Allen's Messer.
"We scrutinize that -- is there parity here?" she said. "We are very pro-active, not passive on that. All corporations have to be and leaders have to be very engaged to be conscious of it."
Education pipeline the biggest challenge
Sign up for CIO Asia eNewsletters.