Cybersecurity Analyst Salary: Pay by State, Experience and Degree

A cybersecurity analyst typically earns about $129,180 a year, based on the May 2025 federal wage survey for information security analysts. That works out to $62.11 an hour. Half of all analysts earn between $97,810 and $163,500, and where you work changes the figure more than most job-title tweaks do.

What Does a Cybersecurity Analyst Earn Each Year?

The federal wage survey doesn’t have a job called “cybersecurity analyst.” It groups the work under information security analysts, and that is the closest match we can use. Pay for related titles such as SOC analyst, security analyst and threat analyst will land in the same neighborhood, though individual employers vary.

Two averages describe the pay. The median is $129,180 and the mean is $132,510. The median means half of analysts earn less and half earn more. The mean runs about $3,330 higher because a few very large salaries pull it up. When you’re judging an offer, the median is the fairer yardstick.

The hourly figures are $62.11 for the median and $63.71 for the mean. If you’re paid hourly as a contractor, those numbers are a useful check, but remember that contractors cover their own benefits and gaps between jobs.

How Wide Is the Pay Range for Analysts?

The lowest-paid tenth of analysts earn $75,090 or less. The highest-paid tenth earn $199,850 or more. The 25th percentile is $97,810 and the 75th is $163,500.

That spread is the reason salary talk online feels contradictory. A person with two years in a small company and a person with ten years at a large firm can both be correct when they say what they earn. Neither is describing the whole field.

Rather than chase the top number, look at where each role sits. Entry-level and junior monitoring jobs cluster in the lower part of the range. Analysts who lead investigations, write detection rules or own a program tend to sit in the upper part. For a fuller view of the low end, see our entry-level cybersecurity salary page.

What Do Cybersecurity Analysts Do All Day?

The Bureau of Labor Statistics (BLS) lists the core duties. Analysts monitor their organization’s networks for breaches and investigate when one happens. They maintain firewalls and data encryption software, and they check computer and network systems for vulnerabilities.

They also research security trends, prepare reports on metrics and attempted attacks, and develop security standards and best practices. Analysts recommend improvements to management and help colleagues learn new security products and procedures.

Pay follows how much of that list a person owns. Someone who mostly watches alerts is doing the first duty. Someone who investigates, writes the report and recommends the fix is doing most of the list, and that person is the one who moves up the percentile ladder.

How Does Pay Differ by State?

State medians for analysts range widely. Washington is highest at $154,940. Maryland is at $139,640, California at $138,570, Delaware at $137,030 and Massachusetts at $136,550.

Montana’s median is $81,950, Mississippi’s is $87,690 and Louisiana’s is $92,990. The distance between Washington and Montana is bigger than most people get from a promotion.

Pay and openings don’t always line up. Virginia has the most analysts at 19,120, and its median is $134,900. Texas has 16,130 analysts and a median of $129,890. Florida has 14,220 and a median of $124,860. These large markets give you many employers to choose from, even where the median sits close to the national figure.

Low-end pay matters when you’re starting out. In Texas the 10th percentile is $77,990, in Florida it’s $75,410 and in California it’s $66,070. California’s low end is below the national figure even though its median is high, which is a reminder that big markets include small employers too.

Does a Degree Change a Cybersecurity Analyst’s Pay?

BLS lists a bachelor’s degree as the typical entry-level education for information security analysts and says graduate school isn’t required.

What a degree does is get you through the screening step at many employers and give you a way to show skills through labs, a capstone or an internship. Programs that include those pieces are easier to explain in an interview.

Cost is the other side. The median price for the online bachelor’s programs we compare is $426 a credit, and the median total tuition is $54,780. Associate degrees have a median total of $15,822. Our online bachelor’s in cybersecurity list shows each program’s price and delivery, and our online associate degrees in cybersecurity list covers the lower-cost start.

Which Certifications Matter for Analysts?

Two entry points come up most often. CompTIA Security+ is a foundational certification. CompTIA recommends Network+ and two years of experience in a security or systems administrator role, but states no required prerequisite. The exam has a maximum of 90 questions, runs 90 minutes and needs a score of 750 on a scale of 100 to 900.

CompTIA CySA+ is aimed at the analyst role itself. CompTIA recommends about four years in a SOC analyst or vulnerability analyst job, with no required prerequisite. The exam has a maximum of 85 questions, runs 165 minutes and needs the same 750 score.

Certifications aren’t a replacement for a degree, and the wage survey doesn’t connect them to pay. They’re proof of specific knowledge, and degree programs that build them in can save you the cost of separate prep courses. Thirty-four programs we compare name Security+ preparation, and 7 name CySA+. Our online cybersecurity degrees with certifications list shows which ones.

What Does the Mean by State Tell You?

The mean and the median tell different stories in some states. Washington’s mean is $156,080 against a median of $154,940, so pay there is fairly even. Massachusetts has a mean of $151,000 and a median of $136,550, which means a group of very highly paid analysts lifts the average.

Maryland’s mean is $149,940 against a median of $139,640. California’s is $149,090 against $138,570. In all three states the top earners pull the mean up by thousands of dollars. If you see a state average quoted in a news story, check whether it’s the mean. The median is closer to what a typical new hire will be offered.

Tennessee is the extreme case. Its median is $115,430, and its mean is $130,320. The 90th percentile there is $250,590, the highest of any state, so a small number of senior jobs inflate the average. Don’t plan on that number. Plan on the median, then treat anything above it as upside you have to earn through scope and seniority.

The same logic works for any state you’re considering. Compare its median with its 10th and 90th percentiles. A narrow spread means pay is predictable and employers use similar bands. A wide spread means the right specialty or employer can change your income a lot, and the wrong one can leave you below the national median.

What Do the Numbers Mean If You’re Moving From IT Support?

Many analysts start somewhere else in IT. Network and computer systems administrators have a national median of $99,130, well below the analyst median of $129,180. A strong administrator at the 75th percentile earns $126,640, close to the analyst median.

So a move from the top of the administrator range to the middle of the analyst range is roughly a lateral pay change, while a move from the middle of the administrator range is a raise. Our systems administrator salary page lays out those numbers.

The skills overlap, too. BLS lists maintaining network and computer system security among administrator duties, so you’re already doing some of the work. A certification such as Security+ and a few projects you can describe will make the move easier to explain.

How Should You Think About the Cost of Getting There?

A degree is the biggest expense on the path, so it helps to compare it with the pay in plain terms. At the 25th percentile of $97,810, a year of analyst pay is more than the median total tuition of $25,488 for the online master’s programs we compare. At the median bachelor’s price of $54,780, it is still less than half of a median year’s pay.

This isn’t a promise of a return. Not everyone who earns a degree gets hired quickly, and costs vary a great deal. The lowest-priced master’s programs charge well under the median, and the highest charge several times as much per credit.

What it does suggest is that price differences between programs are worth more attention than they usually get. Two programs that cover the same ground can differ by tens of thousands of dollars. Our cheapest online cybersecurity degrees list is a good place to see the spread.

How Do You Negotiate an Analyst Offer?

You don’t need a mountain of data. You need three numbers and a reason.

Know the state median for your area, which you can find in the wage table on this page. Know where the offer falls against the national percentiles. And know what you’re bringing that a typical hire at the median isn’t, such as a certification, an internship in security, or a project you built.

Then ask about the parts of pay the survey doesn’t show. On-call pay, certification budgets and tuition help can be worth as much as a few thousand dollars of salary, and many employers have more flexibility there than on the base figure.

If an offer sits below the 25th percentile for your state, ask what the role includes. Some positions are support jobs with a security title. That doesn’t make them bad starting points, but it should shape how you weigh them.

How Much Will the Job Grow?

BLS projects 21 percent growth for information security analysts from 2025 to 2035, which it calls much faster than average. It expects 40,600 more jobs, from a base of 192,900 jobs in 2025, and about 14,100 openings each year once retirements and job changes are counted.

Growth doesn’t set your pay, but it affects your negotiating position. A field that’s adding jobs gives you more choices about employer, location and specialty than a shrinking one does.

How Can You Raise Your Pay as an Analyst?

Pay moves when your responsibility moves. The steps are usually the same.

Take the investigations other people avoid, because owning a hard problem is visible. Write your own reports and recommendations, since that’s part of the BLS duty list and it’s where analysts become trusted. Pick a specialty, such as cloud security or forensics, and build proof in it. Add a certification that matches your next role, not the one you already have.

If you like leading people, look at the management track. The category for computer and information systems managers has a median of $175,140, well above the analyst median. Our cybersecurity salary overview compares the ladder, and the information security analyst career guide explains the daily work.

When you’re ready to compare programs, start with the best online cybersecurity degrees and filter by what fits your schedule and budget.