Typical comp shape
Head of securitys usually earn large rsu + sign-on grants. Common employers include Cloudflare, CrowdStrike, Okta. Security leaders joining post-breach often negotiate accelerated sign-on vesting, concentrating tax in the first 12 months.
What District of Columbia changes
In District of Columbia, every RSU vest, NSO exercise, and ESPP purchase carries 10.75% state tax on top of federal. For a senior head of security with $300k+ of equity income, the state layer routinely adds $25-45k to the annual bill.
Planning cadence
For a head of security in District of Columbia, the three planning windows are: after each RSU vest (withholding check and sell-vs-hold), before any ISO exercise (AMT model at federal only), and in Q4 (estimated tax top-up to clear the safe harbor).