Cybersecurity is among the highest-demand fields in technology—and compensation has followed. With millions of unfilled security positions globally and breach costs escalating, organizations pay heavily for qualified security professionals.
Pay at a Glance (BLS Data)
Bureau of Labor Statistics wage estimates for information security analysts, across all industries:
| Percentile | Annual Wage | Hourly Equivalent |
|---|---|---|
| 10th (entry level) | $75,090 | $36.10 |
| 25th | $97,810 | $47.02 |
| 50th (median) | $129,180 | $62.11 |
| 75th | $163,500 | $78.61 |
| 90th | $199,850 | $96.08 |
| Average (mean) | $132,510 | $63.71 |
Source: US Bureau of Labor Statistics, Occupational Employment and Wage Statistics, May 2025, for Information Security Analysts (all industries). Hourly figures are annual wages divided by 2,080 hours. “Not published” means BLS withheld the estimate, usually because wages are above its top reporting limit.
Cybersecurity Analyst Salary by Role and Level
| Role | Entry Level | Mid-Level | Senior |
|---|---|---|---|
| SOC Analyst (Tier 1) | $50,000-$70,000 | $70,000-$95,000 | — |
| SOC Analyst (Tier 2/3) | — | $85,000-$115,000 | $110,000-$140,000 |
| Incident Response Analyst | $75,000-$95,000 | $95,000-$130,000 | $130,000-$165,000 |
| Penetration Tester | $80,000-$100,000 | $100,000-$140,000 | $140,000-$190,000 |
| Threat Intelligence Analyst | $70,000-$90,000 | $90,000-$120,000 | $120,000-$155,000 |
| Cloud Security Engineer | $90,000-$120,000 | $120,000-$155,000 | $150,000-$200,000 |
| Security Architect | $120,000-$150,000 | $150,000-$190,000 | $180,000-$250,000 |
| CISO | — | — | $200,000-$400,000+ |
Salary by Certification
| Certification | Median Salary | Level |
|---|---|---|
| None / entry | $55,000-$68,000 | Entry |
| CompTIA Security+ | $70,000-$85,000 | Entry-Mid |
| CompTIA CySA+ | $80,000-$100,000 | Mid |
| CEH (Certified Ethical Hacker) | $90,000-$115,000 | Mid |
| OSCP (Offensive Security) | $110,000-$150,000 | Senior (pen testing) |
| AWS/Azure Security Specialty | $110,000-$145,000 | Mid-Senior |
| CISA | $100,000-$135,000 | Mid-Senior |
| CISM | $120,000-$155,000 | Senior-Manager |
| CISSP | $130,000-$165,000 | Senior+ |
CISSP is the gold standard for senior security professionals. OSCP is the most respected for penetration testing. Cloud security certs are growing in importance as organizations shift to AWS/Azure/GCP.
Cybersecurity Salary by State
| Rank | State | Avg Salary | Starting Salary | Median Salary |
|---|---|---|---|---|
| 1 | Washington | $156,080 | $96,730 | $154,940 |
| 2 | Massachusetts | $151,000 | $85,790 | $136,550 |
| 3 | Maryland | $149,940 | $79,130 | $139,640 |
| 4 | California | $149,090 | $66,070 | $138,570 |
| 5 | New York | $144,720 | $83,110 | $134,660 |
| 6 | District of Columbia | $143,330 | $86,280 | $135,090 |
| 7 | Colorado | $142,660 | $87,560 | $135,220 |
| 8 | New Mexico | $142,450 | $99,100 | $130,070 |
| 9 | Virginia | $141,360 | $81,410 | $134,900 |
| 10 | New Jersey | $140,040 | $86,860 | $134,820 |
| 11 | Delaware | $137,080 | $82,500 | $137,030 |
| 12 | Georgia | $131,590 | $77,060 | $128,970 |
| 13 | North Carolina | $130,990 | $77,150 | $131,540 |
| 14 | Minnesota | $130,970 | $83,140 | $130,710 |
| 15 | Connecticut | $130,840 | $79,780 | $130,570 |
| 16 | Texas | $130,710 | $77,990 | $129,890 |
| 17 | Tennessee | $130,320 | $63,870 | $115,430 |
| 18 | Illinois | $127,000 | $78,760 | $124,180 |
| 19 | Arizona | $125,170 | $78,330 | $125,260 |
| 20 | Florida | $124,510 | $75,410 | $124,860 |
| 21 | New Hampshire | $122,980 | $61,940 | $124,000 |
| 22 | Hawaii | $122,660 | $76,390 | $126,250 |
| 23 | Vermont | $122,390 | $74,840 | $109,750 |
| 24 | Rhode Island | $121,640 | $74,880 | $109,420 |
| 25 | South Dakota | $120,750 | $71,610 | $116,640 |
| 26 | Iowa | $119,800 | $71,550 | $119,710 |
| 27 | Pennsylvania | $119,570 | $67,840 | $117,770 |
| 28 | Nevada | $119,190 | $57,160 | $106,200 |
| 29 | Alabama | $119,070 | $66,090 | $122,730 |
| 30 | Alaska | $117,930 | $75,770 | $114,990 |
| 31 | Ohio | $117,710 | $68,070 | $110,480 |
| 32 | South Carolina | $115,090 | $66,410 | $105,800 |
| 33 | Wyoming | $112,320 | $75,580 | $98,710 |
| 34 | Michigan | $111,160 | $64,150 | $106,230 |
| 35 | Maine | $109,230 | $63,210 | $101,730 |
| 36 | Kentucky | $108,310 | $64,650 | $103,630 |
| 37 | Missouri | $107,610 | $60,700 | $103,440 |
| 38 | North Dakota | $107,420 | $69,480 | $107,540 |
| 39 | Wisconsin | $106,960 | $62,110 | $101,550 |
| 40 | Indiana | $106,020 | $60,450 | $101,420 |
| 41 | Utah | $105,680 | $48,630 | $99,690 |
| 42 | Kansas | $104,550 | $63,730 | $100,620 |
| 43 | Arkansas | $102,980 | $59,410 | $103,490 |
| 44 | Nebraska | $102,210 | $66,630 | $92,550 |
| 45 | Louisiana | $100,810 | $66,660 | $92,990 |
| 46 | Oklahoma | $100,810 | $56,050 | $94,000 |
| 47 | Montana | $97,940 | $57,000 | $81,950 |
| 48 | Mississippi | $92,790 | $51,170 | $87,690 |
| — | National | $132,510 | $75,090 | $129,180 |
Source: US Bureau of Labor Statistics OEWS, 2025 estimates, fetched 2026-09-29. Figures cover Information Security Analysts (cross-industry). Some states are omitted where BLS did not publish a reliable estimate. Note: Government contractors and federal positions in the DC/Maryland/Virginia (DMV) corridor pay among the highest in the US due to security clearance requirements.
Security Clearance Premium
Security clearances significantly increase cybersecurity salaries:
| Clearance Level | Salary Premium |
|---|---|
| Secret | +$10,000-$20,000 |
| Top Secret | +$20,000-$35,000 |
| TS/SCI | +$30,000-$50,000+ |
| TS/SCI + Polygraph | +$40,000-$70,000+ |
A TS/SCI cleared cybersecurity engineer in the DC area can earn $180,000-$250,000+.
Sector Comparison
| Sector | Notes |
|---|---|
| Finance / Banking | Strong demand; breach costs very high |
| Tech (large companies) | Total comp with equity can be 2x base |
| Defense / Government contracting | Clearance required; stable; good benefits |
| Healthcare | HIPAA compliance driver |
| Consulting / MSSP | Varied work; good career development |
| Startups | Higher risk; equity upside |
Career Ladder: Entry to Six Figures
| Stage | Typical Timeline | Actions |
|---|---|---|
| SOC Tier 1 (entry) | Years 0-2 | Learn alert triage; get Security+ |
| SOC Tier 2 / Incident Response | Years 1-3 | Develop investigation skills; get CySA+ or CEH |
| Specialist (pen test, cloud security, threat intel) | Years 2-5 | Choose track; pursue OSCP, CISSP, or cloud certs |
| Senior Security Engineer | Years 5-8 | Deep expertise in one area; earn $130,000-$165,000 |
| Security Architect / Manager | Years 8-12 | Design systems or lead teams; $160,000-$220,000 |
Maximizing Cybersecurity Income
| Strategy | Expected Impact |
|---|---|
| Obtain CISSP after 5 years of experience | +$20,000-$30,000 over no cert |
| Pursue penetration testing with OSCP | Premium niche; $130,000-$180,000 range |
| Develop cloud security expertise (AWS/Azure) | High demand; +$15,000-$25,000 vs. general sec |
| Target financial sector or defense contracting | +$20,000-$40,000 vs. average sector |
| Obtain or maintain security clearance | +$20,000-$60,000+ in cleared market |
| Move to large financial firm or FAANG security team | Total compensation can be well above average |
Related Salary Guides
See every profession in our salary by profession guides.
Cybersecurity analyst salaries are tracked in the profession salary guides hub. Compare earnings with a closely related tech role in the data analyst salary guide, and benchmark against national pay ranges at the good salary hub.
Is It a Good Career?
Good fit for
- Curious problem-solvers — Security is detective work finding how attacks succeed.
- Career changers from IT — Network admins, sysadmins have transferable skills.
- Self-motivated learners — Field rewards continuous education.
- Detail-oriented people — Security mistakes come from overlooking details.
- People wanting remote work — Many roles fully remote, especially post-pandemic.
- Military veterans — Security clearance + discipline valued highly.
- IT professionals seeking higher pay — Security consistently pays more than general IT.
- People wanting job security — Demand exceeds supply by millions of workers.
Poor fit for
- Non-technical people — Even GRC roles need technical understanding.
- High anxiety individuals — Incident response is crisis management.
- Those who need immediate visible impact — Security work is often invisible until something fails.
- People who hate documentation — Reports, policies, compliance docs are constant.
- Those unwilling to start lower — SOC analyst grind is often necessary stepping stone.
- People needing creative expression — Most work is following frameworks and procedures.
The content on Wealthvieu is for informational purposes only and should not be considered financial, tax, or investment advice. Consult a qualified professional before making financial decisions. Full disclaimer · Editorial policy