Cybersecurity is among the highest-demand fields in technology—and compensation has followed. With millions of unfilled security positions globally and breach costs escalating, organizations pay heavily for qualified security professionals.
Pay at a Glance (BLS Data)
Bureau of Labor Statistics wage estimates for information security analysts, across all industries:
| Percentile | Annual Wage | Hourly Equivalent |
|---|---|---|
| 10th (entry level) | $75,090 | $36.10 |
| 25th | $97,810 | $47.02 |
| 50th (median) | $129,180 | $62.11 |
| 75th | $163,500 | $78.61 |
| 90th | $199,850 | $96.08 |
| Average (mean) | $132,510 | $63.71 |
Source: US Bureau of Labor Statistics, Occupational Employment and Wage Statistics, May 2025, for Information Security Analysts (all industries). Hourly figures are annual wages divided by 2,080 hours. “Not published” means BLS withheld the estimate, usually because wages are above its top reporting limit.
Cybersecurity Analyst Salary by Role and Level
| Role | Entry Level | Mid-Level | Senior |
|---|---|---|---|
| SOC Analyst (Tier 1) | $50,000-$70,000 | $70,000-$95,000 | — |
| SOC Analyst (Tier 2/3) | — | $85,000-$115,000 | $110,000-$140,000 |
| Incident Response Analyst | $75,000-$95,000 | $95,000-$130,000 | $130,000-$165,000 |
| Penetration Tester | $80,000-$100,000 | $100,000-$140,000 | $140,000-$190,000 |
| Threat Intelligence Analyst | $70,000-$90,000 | $90,000-$120,000 | $120,000-$155,000 |
| Cloud Security Engineer | $90,000-$120,000 | $120,000-$155,000 | $150,000-$200,000 |
| Security Architect | $120,000-$150,000 | $150,000-$190,000 | $180,000-$250,000 |
| CISO | — | — | $200,000-$400,000+ |
Salary by Certification
| Certification | Median Salary | Level |
|---|---|---|
| None / entry | $55,000-$68,000 | Entry |
| CompTIA Security+ | $70,000-$85,000 | Entry-Mid |
| CompTIA CySA+ | $80,000-$100,000 | Mid |
| CEH (Certified Ethical Hacker) | $90,000-$115,000 | Mid |
| OSCP (Offensive Security) | $110,000-$150,000 | Senior (pen testing) |
| AWS/Azure Security Specialty | $110,000-$145,000 | Mid-Senior |
| CISA | $100,000-$135,000 | Mid-Senior |
| CISM | $120,000-$155,000 | Senior-Manager |
| CISSP | $130,000-$165,000 | Senior+ |
CISSP is the gold standard for senior security professionals. OSCP is the most respected for penetration testing. Cloud security certs are growing in importance as organizations shift to AWS/Azure/GCP.
Cybersecurity Salary by State
| Rank | State | Avg Salary | Starting Salary | Median Salary |
|---|---|---|---|---|
| 1 | Washington | $156,080 | $96,730 | $154,940 |
| 2 | Massachusetts | $151,000 | $85,790 | $136,550 |
| 3 | Maryland | $149,940 | $79,130 | $139,640 |
| 4 | California | $149,090 | $66,070 | $138,570 |
| 5 | New York | $144,720 | $83,110 | $134,660 |
| 6 | District of Columbia | $143,330 | $86,280 | $135,090 |
| 7 | Colorado | $142,660 | $87,560 | $135,220 |
| 8 | New Mexico | $142,450 | $99,100 | $130,070 |
| 9 | Virginia | $141,360 | $81,410 | $134,900 |
| 10 | New Jersey | $140,040 | $86,860 | $134,820 |
| 11 | Delaware | $137,080 | $82,500 | $137,030 |
| 12 | Georgia | $131,590 | $77,060 | $128,970 |
| 13 | North Carolina | $130,990 | $77,150 | $131,540 |
| 14 | Minnesota | $130,970 | $83,140 | $130,710 |
| 15 | Connecticut | $130,840 | $79,780 | $130,570 |
| 16 | Texas | $130,710 | $77,990 | $129,890 |
| 17 | Tennessee | $130,320 | $63,870 | $115,430 |
| 18 | Illinois | $127,000 | $78,760 | $124,180 |
| 19 | Arizona | $125,170 | $78,330 | $125,260 |
| 20 | Florida | $124,510 | $75,410 | $124,860 |
| 21 | New Hampshire | $122,980 | $61,940 | $124,000 |
| 22 | Hawaii | $122,660 | $76,390 | $126,250 |
| 23 | Vermont | $122,390 | $74,840 | $109,750 |
| 24 | Rhode Island | $121,640 | $74,880 | $109,420 |
| 25 | South Dakota | $120,750 | $71,610 | $116,640 |
| 26 | Iowa | $119,800 | $71,550 | $119,710 |
| 27 | Pennsylvania | $119,570 | $67,840 | $117,770 |
| 28 | Nevada | $119,190 | $57,160 | $106,200 |
| 29 | Alabama | $119,070 | $66,090 | $122,730 |
| 30 | Alaska | $117,930 | $75,770 | $114,990 |
| 31 | Ohio | $117,710 | $68,070 | $110,480 |
| 32 | South Carolina | $115,090 | $66,410 | $105,800 |
| 33 | Wyoming | $112,320 | $75,580 | $98,710 |
| 34 | Michigan | $111,160 | $64,150 | $106,230 |
| 35 | Maine | $109,230 | $63,210 | $101,730 |
| 36 | Kentucky | $108,310 | $64,650 | $103,630 |
| 37 | Missouri | $107,610 | $60,700 | $103,440 |
| 38 | North Dakota | $107,420 | $69,480 | $107,540 |
| 39 | Wisconsin | $106,960 | $62,110 | $101,550 |
| 40 | Indiana | $106,020 | $60,450 | $101,420 |
| 41 | Utah | $105,680 | $48,630 | $99,690 |
| 42 | Kansas | $104,550 | $63,730 | $100,620 |
| 43 | Arkansas | $102,980 | $59,410 | $103,490 |
| 44 | Nebraska | $102,210 | $66,630 | $92,550 |
| 45 | Louisiana | $100,810 | $66,660 | $92,990 |
| 46 | Oklahoma | $100,810 | $56,050 | $94,000 |
| 47 | Montana | $97,940 | $57,000 | $81,950 |
| 48 | Mississippi | $92,790 | $51,170 | $87,690 |
| — | National | $132,510 | $75,090 | $129,180 |
Source: US Bureau of Labor Statistics OEWS, 2025 estimates, fetched 2026-09-29. Figures cover Information Security Analysts (cross-industry). Some states are omitted where BLS did not publish a reliable estimate. Note: Government contractors and federal positions in the DC/Maryland/Virginia (DMV) corridor pay among the highest in the US due to security clearance requirements.
Security Clearance Premium
Security clearances significantly increase cybersecurity salaries:
| Clearance Level | Salary Premium |
|---|---|
| Secret | +$10,000-$20,000 |
| Top Secret | +$20,000-$35,000 |
| TS/SCI | +$30,000-$50,000+ |
| TS/SCI + Polygraph | +$40,000-$70,000+ |
A TS/SCI cleared cybersecurity engineer in the DC area can earn $180,000-$250,000+.
Sector Comparison
| Sector | Notes |
|---|---|
| Finance / Banking | Strong demand; breach costs very high |
| Tech (large companies) | Total comp with equity can be 2x base |
| Defense / Government contracting | Clearance required; stable; good benefits |
| Healthcare | HIPAA compliance driver |
| Consulting / MSSP | Varied work; good career development |
| Startups | Higher risk; equity upside |
Career Ladder: Entry to Six Figures
| Stage | Typical Timeline | Actions |
|---|---|---|
| SOC Tier 1 (entry) | Years 0-2 | Learn alert triage; get Security+ |
| SOC Tier 2 / Incident Response | Years 1-3 | Develop investigation skills; get CySA+ or CEH |
| Specialist (pen test, cloud security, threat intel) | Years 2-5 | Choose track; pursue OSCP, CISSP, or cloud certs |
| Senior Security Engineer | Years 5-8 | Deep expertise in one area; earn $130,000-$165,000 |
| Security Architect / Manager | Years 8-12 | Design systems or lead teams; $160,000-$220,000 |
Maximizing Cybersecurity Income
| Strategy | Expected Impact |
|---|---|
| Obtain CISSP after 5 years of experience | +$20,000-$30,000 over no cert |
| Pursue penetration testing with OSCP | Premium niche; $130,000-$180,000 range |
| Develop cloud security expertise (AWS/Azure) | High demand; +$15,000-$25,000 vs. general sec |
| Target financial sector or defense contracting | +$20,000-$40,000 vs. average sector |
| Obtain or maintain security clearance | +$20,000-$60,000+ in cleared market |
| Move to large financial firm or FAANG security team | Total compensation can be well above average |
Related Salary Guides
See every profession in our salary by profession guides.
Cybersecurity analyst salaries are tracked in the profession salary guides hub. Compare earnings with a closely related tech role in the data analyst salary guide, and benchmark against national pay ranges at the good salary hub.
Is It a Good Career?
Good fit for
- Curious problem-solvers — Security is detective work finding how attacks succeed.
- Career changers from IT — Network admins, sysadmins have transferable skills.
- Self-motivated learners — Field rewards continuous education.
- Detail-oriented people — Security mistakes come from overlooking details.
- People wanting remote work — Many roles fully remote, especially post-pandemic.
- Military veterans — Security clearance + discipline valued highly.
- IT professionals seeking higher pay — Security consistently pays more than general IT.
- People wanting job security — Demand exceeds supply by millions of workers.
Poor fit for
- Non-technical people — Even GRC roles need technical understanding.
- High anxiety individuals — Incident response is crisis management.
- Those who need immediate visible impact — Security work is often invisible until something fails.
- People who hate documentation — Reports, policies, compliance docs are constant.
- Those unwilling to start lower — SOC analyst grind is often necessary stepping stone.
- People needing creative expression — Most work is following frameworks and procedures.
Penetration Tester Salary Guide (2026): OSCP, Career Path, and Real Pay
Penetration testing turns attacker techniques into a legitimate profession. Here’s the full salary picture — from junior web app testers to senior red team operators.
Penetration Tester Salary Overview
By Experience Level
| Level | Annual Salary |
|---|---|
| Entry-level (junior pentester, 0–2 yrs) | $65,000–$90,000 |
| Mid-level pentester (2–5 yrs, OSCP) | $100,000–$145,000 |
| Senior pentester (5+ yrs) | $140,000–$185,000 |
| Red team lead | $155,000–$220,000 |
| Principal / consultant (boutique firm) | $165,000–$240,000 |
Salary by Pentesting Specialty
| Specialty | Annual Pay Range |
|---|---|
| Web application penetration testing | $85,000–$160,000 |
| Network / infrastructure penetration testing | $90,000–$165,000 |
| Cloud penetration testing (AWS/Azure/GCP) | $105,000–$180,000 |
| Mobile app penetration testing (iOS/Android) | $110,000–$165,000 |
| Hardware / IoT penetration testing | $120,000–$185,000 |
| ICS / SCADA industrial systems testing | $130,000–$200,000 |
| Red team operations | $145,000–$220,000 |
Salary by Employer Type
| Employer | Pay Range |
|---|---|
| Boutique pentesting firm (Bishop Fox, NCC Group, Rapid7) | $100,000–$200,000 |
| Big 4 consulting (Deloitte, KPMG, EY, PwC) | $95,000–$185,000 |
| In-house (FAANG, financial sector) | $130,000–$240,000 |
| Defense contractor (Booz Allen, MITRE, SAIC) | $105,000–$185,000 + clearance premium |
| Government / DoD (with clearance) | $100,000–$180,000 |
| Independent freelance | $150–$400/hr |
| MSSP (managed security service provider) | $80,000–$140,000 |
Security Clearance Premium
| Clearance Level | Annual Pay Premium |
|---|---|
| Secret | +$10,000–$20,000 |
| Top Secret | +$20,000–$40,000 |
| TS/SCI | +$30,000–$60,000 |
Cleared pentesters working for defense contractors are in extremely high demand.
Key Penetration Testing Certifications
| Cert | Cost | Format | Employer Value |
|---|---|---|---|
| eJPT (eLearnSecurity) | $200 | Entry; multiple choice | Beginner credential |
| CompTIA PenTest+ | $370 | Multiple choice | Some compliance roles |
| PNPT (TCM Security) | $400 | Practical 5-day + report | Growing recognition |
| OSCP (Offensive Security) | $1,499 | 24-hr practical + report | Gold standard |
| OSEP (Offensive Security) | $1,499 | Advanced exploitation | Senior / red team |
| CRTO (Zero-Point Security) | $400 | Practical; red team C2 | Red team premium |
| GPEN (GIAC) | $2,000 | Multiple choice + lab | Enterprise |
| CREST CPSA / CRT | $600–$1,200 | UK standard; US accepted | UK-linked firms |
Career Entry Path
| Stage | Action | Timeline |
|---|---|---|
| 1 | Complete TryHackMe Jr. Penetration Tester path | 3–4 months |
| 2 | Practice HackTheBox retired machines | Ongoing |
| 3 | Earn eJPT or Security+ | 1–2 months |
| 4 | Complete Offensive Security PEN-200 and earn OSCP | 3–6 months |
| 5 | Apply for junior pentester roles | 6–12 month job search |
| 6 | Specialize in cloud, mobile, or ICS | Year 2–3 |
Freelance Penetration Testing Rates
| Service | Typical Rate |
|---|---|
| Web application pentest (small app) | $5,000–$15,000 |
| Web application pentest (large scope) | $15,000–$35,000 |
| Network/infrastructure pentest (SMB) | $8,000–$20,000 |
| External attack surface assessment | $3,000–$8,000 |
| Social engineering test | $2,000–$8,000 |
| Full red team engagement | $30,000–$150,000+ |
Job Outlook
BLS projects 21% information security analyst job growth through 2035. Penetration testing specifically is driven by:
- PCI DSS 4.0 mandatory annual internal/external penetration testing requirements for payment card merchants
- HIPAA and healthcare security requirements driving medical sector demand
- SOC 2 Type II compliance requiring regular security assessments
- Ransomware surge making proactive offensive security top C-suite priority
- Cloud adoption increasing attack surface complexity — cloud pentest skills outpacing supply
Related Guides
- Ethical Hacker Salary Guide
- Blockchain Developer Salary Guide
- DevOps Engineer Salary Guide
Related Salary Guides
See every profession in our salary by profession guides.
Common questions
How much do penetration testers make?
Penetration testers earn $85,000–$185,000+ at the mid-to-senior level. Entry-level junior pentesters typically earn $65,000–$90,000. Mid-level pentesters with OSCP certification earn $100,000–$145,000. Senior pentesters and red team leads earn $145,000–$200,000+. Independent freelance pentesters charge $150–$400/hour for engagement-based work. Big 4 consulting and boutique pentesting firms like Rapid7, NCC Group, and Bishop Fox pay competitive salaries with less volatility than startups.
What is the difference between a penetration tester and a red teamer?
Penetration testing is typically scoped, time-limited (1–4 weeks), and follows a defined methodology with clear deliverables (written report with findings and recommendations). Red team operations are broader, longer (weeks to months), simulate full advanced persistent threat (APT) scenarios, test organizational detection and response capabilities, and may include physical access attempts and social engineering. Red teamers typically earn more than pentesters due to greater scope and sophistication required.
Is OSCP required for penetration testing jobs?
OSCP is not technically required, but it is heavily preferred by hiring managers. Multiple surveys of penetration testing job postings show OSCP appears in 40–60% of mid-to-senior level requirements. Employers specifically value OSCP because the 24-hour practical exam cannot be passed by memorization — it requires actual hands-on exploitation skills. Without OSCP, candidates need to demonstrate ability through HackTheBox or TryHackMe rankings, CTF accomplishments, or a strong GitHub portfolio with security tools.
What types of penetration testing pay the most?
By specialty: Red team operations pay the highest full-time salaries. Hardware and IoT penetration testing commands premiums ($120,000–$185,000) due to specialized knowledge. ICS/SCADA penetration testing for industrial infrastructure pays $130,000–$200,000. Mobile application penetration testing is high-demand ($110,000–$165,000). Cloud penetration testing (AWS, Azure, GCP) is fastest-growing (+25% YoY demand). Web application penetration testing has the most job openings and best entry path.
The content on Wealthvieu is for informational purposes only and should not be considered financial, tax, or investment advice. Consult a qualified professional before making financial decisions. Full disclaimer · Editorial policy