Information security analyst salary in 2026

The median information security analyst earned $129,180 a year - $62.11 an hour - as of May 2025, according to the BLS Occupational Outlook Handbook for SOC code 15-1212. The bottom 10 percent of the occupation earned less than $75,090 and the top 10 percent more than $199,850.

That $124,760 gap is the actual subject of this post. A single median is nearly useless for deciding whether an offer is fair, and for this occupation the distance between the two ends of the distribution is larger than the median wage of most American jobs.

What does an information security analyst earn in 2026?

The most recent federal estimate is May 2025, which is the number the 2026 hiring year is being benchmarked against. Median is not average: it is the midpoint of the 192,900 people BLS counted in the occupation in 2025, half above and half below.

Information security analyst pay, May 2025

$75,09010th percentile - below this, one in ten

$129,180Median annual wage

$199,85090th percentile - above this, one in ten

How to read this. The two outer numbers do more work than the one in the middle. Nine analysts in ten sit inside a band $124,760 wide, and the median sits nearer the bottom of that band than the top - which is what you would expect in an occupation where a small group of very senior people pulls the upper tail out. An analyst benchmarking against $129,180 who is offered $112,000 has not been lowballed. They have been offered a wage that is entirely ordinary for the occupation and slightly below its midpoint.

For scale: BLS put the median for all occupations at $50,980 in May 2025, and for computer and information technology occupations as a group at $109,470. Information security analysts sit $19,710 above their own occupational family and about two and a half times the typical American worker.

What this number is not: local. It is a national estimate. The per-occupation OEWS page BLS used to publish for code 15-1212 no longer serves a state or metropolitan wage table - the address now lands on an index of downloadable OEWS files and interactive tools. The geographic data still exists inside those files; it is no longer a page anyone can cite in one click, which is why there is no city-by-city table for information security analysts in this post.

Why is the range so wide, and what actually moves you inside it

The OOH publishes median wages for the five industries that employ the most information security analysts. Top to bottom, the whole spread is $13,230.

Now hold that next to the percentile spread of $124,760. Picking the right industry is worth roughly a tenth of what it is worth to land in the upper half of the distribution - and industry choice is what most salary advice written for this role spends its time on. The data does not explain the gap: BLS publishes the shape of the distribution, not its causes, so it cannot tell you how much of that $124,760 is seniority, how much is employer size, how much is metropolitan location, and how much is the clearance or the specialism. What the two tables together do say is that the industry column is the smaller lever, and a candidate optimising it first is optimising the wrong variable.

Median annual wage by industry, May 2025

The five industries BLS lists for information security analysts. The full spread between them is $13,230.

Information		$138,650
Computer systems design and related services		$132,410
Finance and insurance		$130,630
Management of companies and enterprises		$128,950
Management, scientific, and technical consulting services		$125,420

Information - the industry group that covers publishing, broadcasting, telecommunications and data processing - pays the highest median of the five. Consulting pays the lowest, and the distance between them is smaller than one good promotion.

Where the job sits between the job before it and the job after it

BLS is unusually direct about the path into and out of this occupation. On the way in: "Many analysts have experience in an information technology department, often as a network and computer systems administrator." On the way out: analysts "may advance to become chief security officers or another type of computer and information systems manager."

That makes a ladder you can price, because BLS publishes the same four figures for every rung.

Every figure in the table is from the BLS Occupational Outlook Handbook, wages as of May 2025 and projections for 2025–35. These are separate occupations, not seniority levels inside one - nobody is guaranteed the next row.

The step BLS describes most often is the first one, and at the median it is worth $30,050. The direction of travel matters more than the size of the step. Administrator employment is projected to fall 4 percent between 2025 and 2035 while analyst employment rises 21 percent, so a network and computer systems administrator moving into security is moving from a shrinking occupation of 323,600 jobs into a growing one of 192,900 - a smaller job market, but one BLS expects to add 40,600 positions rather than lose them.

Do you need a degree for this?

BLS lists a bachelor's degree as the typical entry-level education, and O*NET's survey of people doing the work broadly agrees: asked how much education a new hire needs, 53 percent said a bachelor's degree, 23 percent a post-baccalaureate certificate, and 13 percent an associate's or other two-year degree. Those two non-degree answers are 36 percent of responses between them, and the three levels O*NET breaks out cover 89 percent of the survey, so the rest sits in categories the summary page does not show. BLS also notes that "many employers prefer to hire candidates who have information security certification" and that "some of these certifications are for workers at the entry level; others, are designed for experienced information security workers."

Which title should you actually be searching?

"Information security analyst" is the census label, not the posting label. Searching only that phrase will hide most of the market from you, and it will also anchor you to the wrong wage, because the adjacent O*NET code pays differently: Information Security Engineers (15-1299.05) show a median of $116,580 a year, or $56.05 an hour, in O*NET's 2025 wage data - $12,600 below the analyst median for work most hiring managers would describe in similar terms.

O*NET lists these as the titles people in this occupation actually report:

• Information Security Officer
• Information Security Specialist
• Information Systems Security Analyst
• Information Systems Security Officer (ISSO)
• Information Technology Security Analyst (IT Security Analyst)
• Network Security Analyst
• Security Analyst
• Systems Analyst

Two things follow from that list. The first is practical: run your search on at least three of these, not one. The second is a warning about benchmarks - "Systems Analyst" appears on that list and also maps to a different SOC code with a median of $105,850, so a posting carrying that title may be priced against either occupation, and it is worth asking which.

How fast is the field growing?

BLS projects employment of information security analysts to grow 21 percent from 2025 to 2035, from 192,900 jobs to 233,400, an increase of 40,600. The Handbook puts the projection for all occupations over the same decade at 3 percent. Underneath that rate, BLS expects about 14,100 openings a year across the decade.

One caution on projections, because it trips up a lot of comparison articles. O*NET is still reporting the previous vintage: 182,800 employed in 2024 and 16,000 projected annual openings for 2024–34. Those are not smaller or larger versions of the OOH figures above; they are a different base year and a different projection window, and putting the two side by side to show a trend produces a number that means nothing. Pick one vintage and label it.

Does 21 percent growth mean the job is easy to get?

No, and the arithmetic behind that is worth doing once, because the growth rate is the most quoted and least useful figure attached to this occupation.

BLS projects 40,600 new information security analyst jobs between 2025 and 2035 and about 14,100 openings a year. Spread the first across the decade and you get roughly 4,060 new positions a year - under a third of the annual openings. The remaining seven in ten are replacement needs: somebody transferred to a different occupation or left the labor force, and the seat has to be filled again. The 21 percent is real. It is also not what most 2026 candidates are competing over, which is a seat that already existed.

Scale cuts against the percentage too. Across all computer and information technology occupations BLS projects about 280,000 openings a year over the same decade, so information security analysts account for roughly one opening in twenty in their own field. A fast-growing occupation and a small one are not the same thing, and the two pull in opposite directions when what you want to know is how many postings you can actually apply to this month.

One limit on all of this. An opening in the BLS sense is a job that needs filling, not a posting you can see and apply to. BLS does not publish how many of the 14,100 reach a public job board, or how they fall across states, metros or employers, so the figure sets the size of the field and nothing about the size of your own shortlist.

If you are applying for this role

Three specifics, in the order they matter.

Search the title variants, not the SOC label. Run Security Analyst, Information Systems Security Analyst and Network Security Analyst as separate searches. Postings cluster by employer habit, and a company that says "ISSO" will almost never say "information security analyst" in the same requisition.

Expect a range, and know where in it you are. The 10th percentile is $75,090 and the median is $129,180, and a first security role arriving from a $99,130-median administrator job is priced somewhere in that lower stretch. BLS publishes no wage breakdown by years of experience, so it cannot tell you where in the stretch - only that if a posting's band tops out below $75,090, it is paying under the bottom decile of the occupation. That is a fact you can say out loud in a negotiation.

Ask one question about the number's shape. Ask whether the band you have been quoted is the full range for the level or the range for new hires into it. Those are different bands at most employers, and BLS cannot tell you which one you are looking at.

When you have the title variants settled, the tedious part is retyping the same work history into a fresh form for each one. HeroApply reads your resume once and fills those applications in, which is where the platform is useful on a search like this - the shortlist is still yours to build.