Information Security Analyst Salary

What Is an Information Security Analyst Salary?

Information security analysts protect an organization’s computer systems and networks from attack. The Bureau of Labor Statistics reports a median salary of $129,180 a year for the occupation, which is $62.11 an hour. That is occupation code 15-1212, Information Security Analysts, in the OEWS survey, May 2025 release, at bls.gov/oes.

About 190,650 people work in the occupation. It is smaller than support or administration and growing far faster, which is why employers compete for people with the right skills and pay accordingly.

Security analysts work under many titles: security analyst, SOC analyst, cybersecurity analyst, security engineer and incident responder, among others. BLS combines them, and so this page treats them as one pool, with pay depending on the specialty.

Information Security Analyst Salary Range

The 10th percentile is $75,090. The median is $129,180. The 90th percentile is $199,850. A gap that wide is worth understanding before you pick a path.

At the low end are entry-level analysts, often in a security operations center, watching alerts, deciding which are real and escalating the serious ones. It is shift work at many employers and it is demanding. At the high end are senior analysts, incident responders, penetration testers and security architects with years of hands-on experience, often at large financial, healthcare, technology or government-contractor employers.

The route from the lower part of the range to the upper part is specialization. Analysts who become the person an employer calls when something serious happens, or who can break into systems to find weaknesses before attackers do, are paid for scarcity.

What Moves Information Security Analyst Pay

Specialty. Incident response, cloud security, application security, penetration testing and threat hunting pay more than general monitoring. These are the jobs that require judgment under pressure and cannot be handed to a tool.

Industry and regulation. Financial firms, healthcare organizations, defense contractors and technology companies pay the most because their regulatory exposure and the cost of a breach are highest. Security clearances, where required, add a premium.

Hands-on experience. An analyst who has worked an incident from first alert to cleanup, or who has found real vulnerabilities, is worth far more than one with the same credentials and no such record. Labs, competitions and home projects help early in a career.

Certifications. CompTIA Security+ is a common first credential. Later, management-oriented and technical certifications such as CISSP, CISM and vendor or specialty credentials can raise your standing, and some employers and government contracts require them. They matter more in security than in most IT fields.

Foundational IT skills. Security analysts who understand networks, operating systems and identity systems from the inside are better at the job than those who know only security tools. This is why many strong analysts came from administration or networking, and why the network administrator salary path is a common first step.

Information Security Analyst Salary Outlook

BLS projects employment for information security analysts to change by 21% between 2025 and 2035, with about 14,100 openings a year. That makes it one of the fastest-growing occupations in IT, in a group of occupations where several are projected to shrink.

The causes are not mysterious. Attacks keep rising, regulations require more organizations to show that they protect data, and more of the business has moved to systems that need protection. Employers cannot meet the demand by buying tools alone, because tools generate alerts that people have to judge.

Do not read this as an easy path. The work can be stressful, and entry-level roles are competitive because many people want in. The growth is real, but it rewards people who can show practical skill. For the full tables, see the BLS Employment Projections.

The Degree Behind an Information Security Analyst Salary

BLS lists a bachelor's degree as typical entry education for information security analysts. Common majors are cybersecurity, information technology and computer science. Employers often also ask for related experience, so the first job is frequently in help desk, networking or systems administration.

If you want to go straight for security, look for programs designated by the National Security Agency and the Department of Homeland Security as centers of academic excellence in cyber defense. They are described by the NSA’s program page, and they can help with some government and contractor jobs. Compare programs in our ranking of online cybersecurity degrees, which covers cost, format and accreditation.

A master’s degree helps if you want to move into security management or architecture. For analyst work itself, experience and certifications often carry the same weight.

Information Security Analyst Salary Compared with Other IT Jobs

Information security analysts earn more than any of the other analyst or administrator occupations on this site, with the exception of managers and network architects. Computer systems analysts earn a median of $105,850. Database administrators earn $104,620. Network and computer systems administrators earn $99,130. Security analysts earn $129,180.

The difference reflects both scarcity and risk. A security failure can cost an organization millions, and the people who prevent it are priced accordingly. It also reflects the demand curve: security is projected to grow, while administration is projected to shrink.

That is why many administrators and support specialists plan a move toward security. The skills overlap, and the pay and growth are better on the other side.

How to Raise Your Information Security Analyst Salary

Pick a specialty within the first few years and build real evidence in it. Do the labs, enter the competitions, document your findings. Employers hiring for specialist roles want proof that you can do the work.

Earn certifications in the order they help you. Security+ early, a specialist or management credential later. Move toward higher-stakes employers, such as finance, healthcare and defense, once you have two or three years of experience. And keep your fundamentals current, because analysts who understand how systems work do better than those who only know the tools.

For a look at how the work is organized, see our information security analyst career guide.

What Information Security Analysts Do Day to Day

The pay makes more sense when you know the work. In a security operations center, an analyst watches a queue of alerts from monitoring tools, decides which ones are real, investigates them and writes up what happened. Most alerts turn out to be harmless. A few do not, and the job is to tell the difference quickly.

Outside the operations center, analysts review the security of new systems before they go live, run vulnerability scans and chase down the fixes, help write policies, and train employees to spot phishing. When an incident happens, the analyst becomes part of a team that contains the damage, finds out how the attacker got in and brings systems back.

There are hard parts to say plainly. Shift work and on-call duty are common, especially early on. Alert fatigue is real, and burnout is a known problem in the field. Some of the best-paid roles carry the most pressure, because the people in them are called when something is on fire. The pay reflects that, and so does the turnover.

Reading an Information Security Analyst Salary Offer

Use the range to place any offer. A figure near $75,090 describes an entry-level monitoring role, often with shift work. A figure near the $129,180 median describes an analyst who works independently on investigations and assessments. A figure near $199,850 describes a senior specialist, an incident response lead or an architect who sets direction for an organization’s defenses.

Ask what you will actually do. A job titled security analyst can mean watching a dashboard for eight hours or leading investigations. Ask whether there is on-call duty, what training the employer funds, and whether the role lets you build skills in a specialty. The role that teaches you a specialty is often worth more over two or three years than a slightly higher starting salary in a role that does not.

If you are starting from support or administration, our help desk salary page shows the starting point many analysts come from, and the numbers explain why so many make the move.

Information Security Analyst Salary by State

Washington pays information security analysts the most, with a median of $154,940, 20% above the $129,180 national figure. Puerto Rico is the lowest of the 49 places BLS reports, at $63,740. Washington stays first after adjusting for local prices, at $144,786 in buying power.

The 10 highest of 49. These figures are for information security analysts. The adjusted column divides the median by the BEA 2024 regional price parity for the state: an estimate of buying power, not what an employer pays.

Information Security Analyst Salary in Major Metros

Of the 48 metro areas in our city guides with a published figure, San Jose has the highest median at $176,120, and Grand Rapids has the lowest at $95,660. A metro median covers the whole area, suburbs included, so it can differ from pay in the city itself.

The 10 highest of 48. These figures are for information security analysts, BLS May 2025.

IT Salaries Side by Side

Information Security Analysts rank 3 of 9 by median pay among the IT occupations we cover. The low and high ends show how much overlap there is: a strong earner in a lower-paid job can out-earn a new hire in a higher-paid one.

Sorted by median pay. BLS Occupational Employment and Wage Statistics, May 2025, and Employment Projections, 2025-35.