Information security analyst salary: what cybersecurity analysts earn

If you're weighing a cybersecurity offer or deciding whether to ask for more, here's the official benchmark: information security analysts (occupation code 15-1212) earned a median of $129,180 a year in May 2025, according to the Bureau of Labor Statistics' Occupational Employment and Wage Statistics survey (OEWS). This guide shows where that number comes from, where the top of the range sits by industry and metro, and what the government data simply can't tell you.

Quick reference: information security analyst pay (May 2025 OEWS)

Every figure on this page is from May 2025 OEWS for occupation 15-1212 unless it says otherwise. That is the newest OEWS release; BLS publishes these estimates once a year.

Median and percentiles in plain words

The median is the middle paycheck. Line up every information security analyst in the country from lowest paid to highest, and the person in the middle earned $129,180 in May 2025. Half earned more, half earned less.

Percentiles tell you how far the range stretches. The 10th percentile, $75,090, means one in ten analysts earned less than that. The 90th percentile, $199,850, means one in ten earned more. The 25th and 75th percentiles mark out the middle half of the field: from $97,810 to $163,500.

Here's how to use that:

• Near the 25th percentile ($97,810): typical for someone newer to security, a smaller employer, or a lower-cost area.
• Around the median ($129,180): a solid, mid-market number for an analyst with a few years of experience.
• At or above the 75th percentile ($163,500): usually means senior scope, a high-paying metro or industry, or both.

For hourly comparisons (useful if you contract), the May 2025 hourly figures run from $36.10 at the 10th percentile to $96.08 at the 90th, with a median of $62.11.

For context, the median for all computer occupations was $109,470, and the median for all US workers was $50,980, both May 2025.

What the OEWS number includes, and what it leaves out

Before you compare an offer to the median, know what BLS counted. The OEWS technical notes define wages as straight-time gross pay. That includes base pay, cost-of-living allowances, hazardous-duty pay and incentive pay such as commissions and production bonuses.

It excludes overtime, shift differentials, nonproduction bonuses (think annual or signing bonuses), and what the employer spends on benefits. Self-employed consultants aren't counted either.

So the $129,180 median is close to a base-salary benchmark. If an offer includes a bonus, equity, or on-call pay, compare the base to OEWS and value the extras separately.

Two more things worth knowing about how the data is built:

• It blends three years of responses. The May 2025 estimates draw on survey panels collected from November 2022 through May 2025, with older wages adjusted forward to the May 2025 reference date. That makes the figures stable, but they can lag a fast-moving market.
• It is a large employer survey. The sample covers about 1.1 million establishments, and BLS publishes estimates for roughly 530 metro and nonmetro areas. That depth is why OEWS is a better benchmark than a vendor survey of a few thousand self-reported salaries.

What OEWS cannot tell you

Be clear-eyed here. OEWS reports pay by occupation, location and industry. It does not break out pay by certification, by security clearance, by specialty (incident response vs. cloud security vs. governance), or by years of experience.

That means this article can't put a dollar figure on a certification or a clearance, and you should be wary of anyone who quotes one as an official number. Vendor and recruiter surveys do publish those premiums, but they rely on self-reported, non-random samples. Treat them as conversation starters, not benchmarks.

Pay by industry: where the higher medians sit

BLS publishes median pay for the industries that employ the most information security analysts. The spread between them is narrower than you might expect.

What this tells you in practice:

• The information sector pays the highest median of the big employers, at $138,650. That's the group closest to what most people mean by "tech companies."
• Finance and insurance sits just above the overall median at $130,630, and it's the second-largest employer group.
• Consulting is at the bottom of this list at $125,420. If you're moving from a consulting firm to an in-house role, the data suggests room to ask for more.

What about government contractors?

OEWS sorts employers by what they do, not by who their customers are. There's no "government contractor" category. Many federal contractors fall under computer systems design or consulting, so their analysts are folded into those medians alongside commercial firms.

The upshot: OEWS can't isolate what cleared contractor roles pay. If you're comparing contractor offers, ask the recruiter for the posted range and the labor category the role is billed under, and compare across several postings in the same metro.

Highest-paying metros and states

Location moves the number more than industry does. California shows how wide the gap can get inside a single state.

California's May 2025 median for information security analysts was $138,570, above the national $129,180. But the metros inside it range widely:

Three things jump out:

1. San Jose is the clear high end. Its median of $176,120 is well above the national figure, and its 90th percentile reaches $278,340.
2. Big metros have wide ranges. San Francisco's 10th percentile ($61,860) is actually below the national 10th percentile, even though its median is far higher. A big-city label doesn't guarantee a big-city salary; the role and employer still matter.
3. Los Angeles is basically at the national median. Its $129,630 median is a reminder that "big expensive city" and "top-paying market for this job" are not the same thing.

Outside California, large markets worth checking include the Washington, DC, area, New York, Seattle and Boston. Their May 2025 figures are in the BLS OEWS occupation profiles: choose Information Security Analysts and the profile lists every state and metro with published estimates. BLS also lists all metro and nonmetro area estimates for May 2025. Some smaller metros have no published figure for this occupation, so the data can be thin outside major markets.

Price-adjusted comparison of top metros

A higher salary in an expensive metro can buy less than a lower one somewhere cheaper. To compare fairly, adjust for prices.

The standard tool is the Bureau of Economic Analysis's Regional Price Parities (RPP), which index each state and metro's price level against the national average of 100. The math is simple:

• Adjusted pay = salary ÷ (RPP ÷ 100)

An RPP above 100 shrinks the salary's buying power; below 100 stretches it. Use the newest RPP year BEA has published, and remember housing drives most of the gap, so your own rent or mortgage matters more than any index.

A quick rule that works without a calculator: a higher offer only wins in real terms if it's higher by a bigger share than prices are. If one offer is a third higher but the metro's prices are more than a third higher, you're worse off.

Example: comparing two metro offers

This is an illustrative scenario, not a real person. Say you have two offers, each set at the May 2025 OEWS median for its metro:

• Offer A, San Jose: $176,120
• Offer B, Sacramento: $133,570

In pay terms, Offer A is roughly a third higher. Before deciding, look up both metros' RPPs from BEA, run each offer through the formula above, and then sanity-check with real listings for the housing you'd actually rent or buy.

Then compare position, not just dollars. Both offers sit at the median for their own market. Offer A isn't "rich" for San Jose; it's average there. If Offer A came in at San Jose's 25th percentile instead, it could look strong nationally while being below par locally. Always benchmark against the metro where the job is based.

For remote roles, ask which location the pay range is tied to. Some employers pay one national band; others adjust by where you live.

What moves pay up: scope, on-call duties, clearance and certifications

Because OEWS can't measure these factors, what follows is a guide to what to ask about, not a set of official premiums.

Scope. BLS notes that analysts can advance by leading a team or becoming an expert in one area, and can move into management. The step up is real: computer and information systems managers had a May 2025 median of $175,140. If your role already includes owning a program, supervising others, or reporting to executives, price it closer to the 75th percentile and say why.

On-call and after-hours work. BLS says analysts sometimes have to be on call outside normal hours for emergencies, and some work more than 40 hours a week. Shift differentials and overtime are excluded from OEWS wages, so whatever a 24/7 security operations role pays for nights, weekends or pager duty is on top of the benchmark. Ask about it directly; it's easy to miss in an offer letter.

Whether you're owed overtime depends on how the role is classified under federal and state wage law. Many salaried analysts are treated as exempt, but classification depends on duties and pay, not job title. If you think you're misclassified, contact the US Department of Labor's Wage and Hour Division or your state labor department.

Security clearance. Clearance requirements are common in federal and contractor work and limit the pool of eligible candidates. That can strengthen your hand, but there's no official figure for what a clearance adds. Use comparable cleared postings in the same metro as your yardstick.

Certifications. BLS says many employers prefer certified candidates, with some certifications aimed at entry level and others at experienced practitioners. A certification can get you through screening or justify a higher step in a pay band. Again, OEWS doesn't publish a per-certification premium, so frame it as evidence of skill rather than a fixed price tag.

How to reach this pay level

The typical path, per BLS:

• Education: usually a bachelor's degree in computer and information technology or a related field such as engineering or math. Some people get in with a high school diploma plus industry training and certifications.
• Experience: less than five years of related work, often in IT. Network and computer systems administration is a common stepping stone.
• Advancement: team lead, specialist, then roles like chief security officer or IT manager.

The outlook is strong. BLS projects employment to grow 21% from 2025 to 2035 and expects about 14,100 openings a year on average.

How security analyst pay compares with nearby roles

All figures are May 2025 medians from the BLS Occupational Outlook Handbook.

The jump from network or systems administrator ($99,130) into security ($129,180) is one of the clearer pay steps in IT. And the next big jump is usually into management, not another analyst title.

Benchmarking a security offer

Here's a step-by-step check you can run on any offer.

1. Find the right row. Look up the metro where the job is based in the OEWS profile. If it isn't listed, use the state figure.
2. Place the base salary on the range. Is it near the 25th percentile, the median, or the 75th? Match that against your experience and the role's scope.
3. Adjust for industry. If the employer is in the information sector, the national median is higher than in consulting. Use that as a nudge, not a formula.
4. Separate the extras. Value bonus, equity, on-call pay and shift differentials apart from base, since OEWS excludes most of them.
5. Check the posted range. A growing number of states and cities require pay ranges in job ads, and the rules differ by place, so check your state labor department's site for yours. Where a range is posted, ask where in it the offer falls and why.
6. Adjust for prices if you're comparing across metros.

Scripts you can use

Asking about on-call pay:

"Before I respond to the offer, can you walk me through the on-call setup? How often would I be on the rotation, and is on-call time or after-hours response paid separately, through a stipend, overtime or a shift differential?"

If the answer is "it's built into the salary":

"That makes sense. Given that the role includes a regular on-call rotation, I'd like the base to reflect it. Based on May 2025 BLS data for this metro, the median is [figure]. I'm asking for [your number] to account for the after-hours coverage."

Anchoring with the data:

"I've looked at the BLS figures for information security analysts here. With my experience leading incident response, I'd put this role around the 75th percentile, which is [figure]. Is there flexibility to get closer to that?"

None of these guarantee a yes. But a specific, sourced number is harder to wave away than "I was hoping for more."

What to do next

• Pull your metro's May 2025 row from the BLS occupation profiles and note the 25th, median and 75th percentile.
• Write down your scope, on-call duties, clearance and certifications, since those are your arguments for moving up the range, even without an official price on them.
• Ask every employer for the posted range and how on-call work is paid.
• For more guides, browse salaries by role, compare markets in salaries by city, and get more scripts in negotiation.