Information security analyst: the outlook, the work and the certification ladder
Information security analysts protect an organization's systems and data. BLS projects their jobs to grow 21% between 2025 and 2035, from 192,900 to 233,400, with about 14,100 openings a year, and put median pay at $129,180 in May 2025. BLS lists a bachelor's degree and less than five years of related experience as typical, so by BLS's description it is usually not a first IT job. The order we recommend is Security+ ($439 on the cheapest route, November 2026), then CySA+ or SSCP once you do security work, then CISSP after five years.
BLS figures for security analysts
| Jobs in 2025 | 192,900 |
|---|---|
| Projected jobs in 2035 | 233,400 |
| Projected change, 2025–35 | +21.0% |
| Openings per year, 2025–35 average | 14,100 |
| Median annual pay, May 2025 | $129,180 |
| Middle half of pay (25th to 75th percentile) | $97,810 to $163,500 |
| Lowest and highest 10 percent earn less than / more than | $75,090 / $199,850 |
| Typical education to enter (BLS) | Bachelor's degree |
| Work experience in a related job (BLS) | Less than 5 years |
Of the five occupations on this site, this is the only one BLS projects to grow by double digits; growth alone accounts for about 4,060 new jobs a year, with the rest of the openings coming from people leaving. BLS's "less than 5 years" entry means it finds that new analysts typically need some work experience in a related occupation.
The work, from the task list
O*NET lists 11 core tasks, which group into four kinds of work: planning how data and systems are protected and recovered, watching for threats and updating defenses, testing and assessing risk, and handling the people side, from documenting security policy to discussing violations with the staff involved. Titles in the occupation include security analyst, IT security analyst, network security analyst and information systems security officer.
The certification ladder and what each rung costs
| Stage | Certification | Cheapest priced route on our guide | Experience |
|---|---|---|---|
| Entering security | Security+ | $439 | None required; CompTIA recommends Network+ and 2 years |
| Working as an analyst | CySA+ | $593 (exam alone $439) | None required; about 4 years recommended |
| Or, ISC2 route | SSCP | $609 (exam alone $249) | 1 year in an SSCP domain |
| Senior | CISSP | $818 | 5 years in 2 of 8 domains (a degree or approved credential can replace 1 year) |
Security+ V8 is expected around November 17, 2026, and V7 remains available until June 11, 2027; the Security+ guide covers timing. If you are starting from no IT background, begin with the first cybersecurity certification guide instead.
Getting there from another IT job
BLS counts experience in a related occupation, and in our view the closest are IT support and systems administration; both are projected to shrink, so moving from them toward security follows the BLS outlook rather than betting against it.
Questions
- Is cybersecurity a growing field?
- For this occupation, yes: BLS projects 21% growth from 2025 to 2035.
- Can I become a security analyst without experience?
- BLS lists less than five years of related experience as typical. In our view the closest related jobs are IT support and systems administration, and Security+ is the certification to earn while you are there.
Next step
Tell us your current job and how long you have done it, and we will reply with the next rung and how to pay for it.
Ask for a security certification plan
Sources
- BLS Employment Projections: Table 1.2, 2025–35 (information security analysts, 15-1212), checked November 5, 2026
- BLS Occupational Employment and Wage Statistics, May 2025 national estimates, checked November 5, 2026
- O*NET OnLine: 15-1212.00 Information Security Analysts, checked November 5, 2026
Prices are published list prices we recorded on the dates shown, not quotes. How we research.
This page includes information from O*NET OnLine by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA), used under the CC BY 4.0 license. We paraphrased and selected the content; USDOL/ETA has not approved or endorsed it.