Information Security Analyst Jobs: Duties, Pay, Requirements and How to Start

Information security analysts plan and carry out measures that protect an organization’s computer networks and systems. The median pay is $129,180 a year as of May 2025, and a bachelor’s degree is the typical way in. The Bureau of Labor Statistics (BLS) projects 21 percent job growth from 2025 to 2035, which is much faster than average.

What Does an Information Security Analyst Do?

Analysts are the people who notice when something is wrong with an organization’s systems and decide what to do about it. BLS describes the work as planning and carrying out security measures to protect computer networks and systems.

The duty list is concrete. Analysts monitor their organization’s networks for breaches and investigate when one happens. They use and maintain software such as firewalls and data encryption programs. They check computer and network systems for weak points, and they research the latest security trends.

They also write. Analysts prepare reports on general metrics, attempted attacks and security breaches. They develop security standards and best practices for their organization and recommend improvements to management or senior IT staff. And they help other people use new security products and procedures.

That last item is easy to overlook. Part of the job is teaching coworkers, which makes communication a core skill, not an extra.

How Is an Analyst Different From Other Security Jobs?

Titles overlap, and employers use them loosely. A security analyst, a SOC analyst and a threat analyst are all close to the BLS information security analyst category. We use the federal title for pay and outlook because it’s the closest match.

Other roles are separate. Security engineers build and configure defenses. Penetration testers attack systems on purpose to find flaws. Architects design the security structure, and managers lead teams and budgets. Our what can you do with a cybersecurity degree guide maps these paths.

The analyst role is often the first stop. It teaches you how an organization’s systems behave on a normal day, and that knowledge makes every later specialty easier.

How Much Do Information Security Analysts Earn?

The national median is $129,180 a year, or $62.11 an hour. The mean is $132,510. A quarter of analysts earn $97,810 or less and a quarter earn $163,500 or more. The lowest-paid tenth earn $75,090 or less, and the highest-paid tenth earn $199,850 or more.

Washington has the highest state average at $156,080, followed by Massachusetts at $151,000, Maryland at $149,940, California at $149,090 and New York at $144,720. Those are means, which run above the medians in states with a few very high salaries.

For a closer look at the numbers, see our cybersecurity analyst salary page. It covers state medians, percentiles and how to read an offer.

Where Are the Jobs?

Virginia employs 19,120 analysts, the most of any state. Texas is next with 16,130, California has 15,570, Florida has 14,220 and New York has 10,060. Maryland has 8,650 and North Carolina has 8,670.

Nationally, BLS counts 190,650 analysts in the wage survey. In its job projections it puts employment at 192,900 in 2025 and expects 40,600 more jobs by 2035. It also expects about 14,100 openings each year, which includes people who leave the field.

If you’re choosing where to live, the big markets give you many employers, while the high-paying smaller ones reward people with a specialty. Remote policies vary by employer, so ask early.

What Education Do You Need?

BLS lists a bachelor’s degree as the typical entry-level education and states that graduate school isn’t required. It doesn’t name a field, which is why you’ll see analysts with degrees in cybersecurity, computer science, information technology and related areas.

A cybersecurity degree gives you the most direct match. The programs on this site cover four levels: associate, bachelor’s, master’s and doctorate. Our online bachelor’s in cybersecurity list is the standard route. An online master’s in cybersecurity suits people who already hold a bachelor’s degree in another field or who want to move toward management or architecture.

Delivery matters for working adults. Most of the programs we compare are fully online, with a small number requiring some time on campus. Check the delivery details before you apply, because a few require onsite sessions.

What Skills Do Employers Want From Analysts?

The duty list tells you. You need to read network and system behavior, so networking fundamentals matter. You need to find and fix weak points, so vulnerability assessment and basic scripting help. You need to report and recommend, so writing is a daily skill.

Courses show up in program descriptions. Franklin University’s online master’s in cybersecurity lists Information Risk Management, Cryptography, Advanced Network Security, Ethical Hacking and Information Security Policy and Governance among its courses. American National University’s master’s lists Intrusion Detection Attack and Countermeasures, Forensic Evaluation and Analysis and Secure Software Development.

Programs differ in how much hands-on work they include. Labs, capstones and internships all count. Our online cybersecurity degrees with internships list shows which programs build real practice into the plan.

Which Certifications Help?

Certifications matter more in security than in many fields, because employers use them to check specific skills. Three come up most often for analysts.

CompTIA Security+ is foundational. CompTIA recommends Network+ and two years of experience in a security or systems administrator role, but it lists no required prerequisite. CompTIA CySA+ targets analyst work, and CompTIA recommends about four years in a SOC or vulnerability analyst role. The ISC2 CISSP is advanced and asks for five years of full-time experience in two or more of its eight domains.

Degree programs sometimes fold these into coursework. Thirty-four programs we compare name Security+ preparation, 24 name CISSP and 7 name CySA+. Our online cybersecurity degrees with certifications list shows the match.

What Does the Work Look Like Week to Week?

BLS doesn’t publish a schedule, so this is a reading of the duty list, not a timetable. Monitoring is the steady part. Analysts watch for signs that someone is attacking or misusing a network, and when something looks wrong they investigate.

Maintenance comes next. Firewalls and encryption software need updating and tuning, and systems need to be checked for weak points on a regular basis. That’s the part of the job that prevents problems, and it’s usually less dramatic than the investigation.

Reporting and recommending fill the rest of the time. Analysts write up what happened, track metrics, and tell managers what to change. A good report turns a bad day into a better setup, and it’s how analysts earn trust.

If you’re deciding whether the work suits you, picture a mix of watching, fixing and writing, with an occasional scramble. People who like puzzles and clear communication tend to enjoy it.

How Does the Role Grow With Experience?

Analysts rarely stay at the same level of responsibility for long. At the start you’ll follow procedures and escalate what you can’t solve. After a few years you’re the one who investigates, writes the procedures and trains newcomers.

From there the paths branch. Some analysts specialize in forensics or incident response. Others move into architecture, designing the controls the next analysts will tune. Others manage teams. The federal survey shows how pay follows: the analyst median is $129,180, network architects have a median of $134,050, and computer and information systems managers have a median of $175,140.

None of those moves is automatic, and the survey can’t tell you how long each takes. But they show that the analyst job isn’t a dead end. It’s a starting point with a lot of exits.

Which Programs Show Different Ways to Build Skills?

Programs prepare analysts in different ways, and the differences are worth seeing. These are examples from the programs we compare, not recommendations for any one student.

The SANS Technology Institute bachelor’s is a degree-completion program for students who bring 70 transferable college credits. It includes hands-on courses and labs, a portfolio practicum, and the chance to earn 9 GIAC certifications while studying. Norwich University’s online bachelor’s partners with Hack The Box for hands-on practice and accepts up to 90 transfer credits.

The University of Maryland Global Campus bachelor’s has a Virtual Security Lab and a competition team, with courses aligned to Security+, PenTest+ and CySA+ exams. At the master’s level, Georgia Tech’s online M.S. in cybersecurity lists total tuition of $12,384, and Dakota State University’s M.S. in cyber defense lists courses in Offensive Security, Incident Response, Digital Forensics and Malware Analysis.

What those programs share is proof of practice. Whatever you choose, ask what you’ll be able to show an employer at graduation.

What Are the Downsides?

The job has pressure that some people don’t enjoy. Analysts investigate breaches, and breaches don’t keep office hours. Some employers run monitoring around the clock and expect analysts to cover shifts or be on call. BLS doesn’t report how common that is, so ask each employer.

The work can also be repetitive. Monitoring and reporting take time, and the interesting investigations are a smaller share. People who like variety sometimes move toward penetration testing or engineering.

And the learning never stops. BLS lists researching the latest security trends among the duties, which is a way of saying you’ll be studying for as long as you do the job. If you like learning, that’s a plus. If you don’t, it’s a cost.

What Should You Ask Before You Take an Analyst Job?

Titles hide a lot, so a few questions are worth asking in every interview. Ask what a typical week includes, and how much of it is monitoring and how much is investigation. Ask whether the team covers nights or weekends, and whether on-call time is paid. Ask who you’ll learn from, because a mentor shortens the early years.

Ask about training too. Some employers pay for certification exams and tuition, and that benefit can be worth thousands of dollars over a few years. Ask what tools the team uses, so you can see whether the experience will carry over to your next job.

Finally, compare the pay with the state table. If an offer is below the 25th percentile for your state, find out whether the work is really analyst work or help desk work under a different title.

How Do You Get Started With an Online Program?

Start by picking the level that matches where you are. If you have no college credits, an associate degree gets you into an IT role quickly. If you have credits, a degree-completion program can apply them. If you hold a bachelor’s degree, a master’s is the next step.

Then compare what matters to you. Price differs enormously, and our cheapest online cybersecurity degrees list sorts it. Flexibility differs too, and our online cybersecurity degrees for working adults list covers asynchronous and part-time options.

Finally, build proof while you study. An internship, a lab write-up or a Security+ certification gives you something concrete to show. Our entry-level cybersecurity jobs guide explains how to turn that into an offer.