What They Do: Information security analysts plan and carry out security measures to protect an organization's computer networks and systems.
Work Environment: Most information security analysts work for computer companies, consulting firms, or business and financial companies.
How to Become One: Most information security analyst positions require a bachelor's degree in a computer-related field. Employers usually prefer to hire analysts with experience in a related occupation.
Salary: The median annual wage for information security analysts is $102,600.
Job Outlook: Employment of information security analysts is projected to grow 35 percent over the next ten years, much faster than the average for all occupations.
Related Careers: Compare the job duties, education, job growth, and pay of information security analysts with similar occupations.
Information security analysts plan and carry out security measures to protect an organization's computer networks and systems. Their responsibilities are continually expanding as the number of cyberattacks increases.
Information security analysts typically do the following:
IT security analysts are heavily involved with creating their organization's disaster recovery plan, a procedure that IT employees follow in case of emergency. These plans allow for the continued operation of an organization's IT department. The recovery plan includes preventive measures such as regularly copying and transferring data to an offsite location. It also involves plans to restore proper IT functioning after a disaster. Analysts continually test the steps in their recovery plans.
Information security analysts must stay up to date on IT security and on the latest methods attackers are using to infiltrate computer systems. Analysts need to research new security technology to decide what will most effectively protect their organization.
Information security analysts hold about 163,000. The largest employers of information security analysts are as follows:
| Computer systems design and related services | 27% |
| Finance and insurance | 15% |
| Information | 14% |
| Management of companies and enterprises | 8% |
| Administrative and support services | 5% |
Many information security analysts work with other members of an information technology department, such as network administrators or computer systems analysts.
Most information security analysts work full time. Information security analysts sometimes have to be on call outside of normal business hours in case of an emergency. Some work more than 40 hours per week.
Get the education you need: Find schools for Information Security Analysts near you!
Most information security analyst positions require a bachelor's degree in a computer-related field. Employers usually prefer analysts to have experience in a related occupation.
Information security analysts usually need at least a bachelor's degree in computer science, information assurance, programming, or a related field.
Some employers prefer applicants who have a Master of Business Administration (MBA) in information systems. Programs offering the MBA in information systems generally require 2 years of study beyond the undergraduate level and include both business and computer-related courses.
Information security analysts generally need to have previous experience in a related occupation. Many analysts have experience in an information technology department, often as a network or computer systems administrator. Some employers look for people who have already worked in fields related to the one in which they are hiring. For example, if the job opening is in database security, they may look for a database administrator. If they are hiring in systems security, a computer systems analyst may be an ideal candidate.
There are a number of information security certifications available, and many employers prefer candidates to have certification, which validates the knowledge and best practices required from information security analysts. Some are general information security certificates, such as the Certified Information Systems Security Professional (CISSP), while others have a more narrow focus, such as penetration testing or systems auditing.
Information security analysts can advance to become chief security officers or another type of computer and information systems manager.
Analytical skills. Information security analysts must carefully study computer systems and networks and assess risks to determine how security policies and protocols can be improved.
Detail oriented. Because cyberattacks can be difficult to detect, information security analysts must pay careful attention to computer systems and watch for minor changes in performance.
Ingenuity. Information security analysts must anticipate information security risks and implement new ways to protect their organizations' computer systems and networks.
Problem-solving skills. Information security analysts must respond to security alerts and uncover and fix flaws in computer systems and networks.
The median annual wage for information security analysts is $102,600. The median wage is the wage at which half the workers in an occupation earned more than that amount and half earned less. The lowest 10 percent earned less than $61,520, and the highest 10 percent earned more than $165,920.
The median annual wages for information security analysts in the top industries in which they work are as follows:
| Information | $128,970 |
| Finance and insurance | $104,790 |
| Management of companies and enterprises | $101,350 |
| Computer systems design and related services | $101,170 |
| Administrative and support services | $95,270 |
Most information security analysts work full time, and some work more than 40 hours per week. Information security analysts sometimes have to be on call outside of normal business hours in case of an emergency.
Employment of information security analysts is projected to grow 35 percent over the next ten years, much faster than the average for all occupations.
About 19,500 openings for information security analysts are projected each year, on average, over the decade. Many of those openings are expected to result from the need to replace workers who transfer to different occupations or exit the labor force, such as to retire.
High demand is expected for information security analysts. Cyberattacks have grown in frequency, and these analysts will be needed to create innovative solutions to prevent hackers from stealing critical information or creating problems for computer networks.
As businesses focus on enhancing cybersecurity, they will need information security analysts to secure new technologies from outside threats or hacks. A shift to remote work and the rise of e-commerce have increased the need for enhanced security, contributing to the projected employment growth of these workers over the decade.
Strong growth in digital health services and telehealth will also increase data security risks for healthcare providers. More of these analysts are likely to be needed to safeguard patients' personal information and data.
| Occupational Title | Employment, 2021 | Projected Employment, 2031 | Change, 2021-31 | |
|---|---|---|---|---|
| Percent | Numeric | |||
| Information security analysts | 163,000 | 219,500 | 35 | 56,500 |
For more information about computer careers, visit
Association for Computing Machinery
Computing Research Association
For more information about opportunities for women pursuing information technology careers, visit
A portion of the information on this page is used by permission of the U.S. Department of Labor.