Cybersecurity has become one of the better-paid areas of information technology, but there is no single salary that represents the entire field. Earnings vary widely depending on job title, technical skills, experience, industry, certifications, location, and level of responsibility.
A cyber security salary in the United States can range from roughly $75,000 at the lower end of information security analyst pay to nearly $200,000 or more for highly experienced professionals. The U.S. Bureau of Labor Statistics reports a median annual wage of $129,180 for information security analysts as of May 2025, while specialized engineering and management positions can command considerably higher total compensation.
This guide explains what cybersecurity professionals earn, how salaries change with experience, which roles tend to pay more, and what skills can improve earning potential.
What Is the Average Cyber Security Salary?
Cybersecurity is an umbrella term covering security analysts, engineers, penetration testers, incident responders, security architects, consultants, managers, and many other specialists. That makes an occupation-specific benchmark more useful than a single industry-wide average.
According to the U.S. Bureau of Labor Statistics, information security analysts earned a median annual wage of $129,180 in May 2025, equivalent to about $62.11 per hour. The mean annual wage was $132,510.
The wage distribution shows how broad the field can be:
| Pay Level | Annual Salary | Approx. Hourly Pay |
|---|---|---|
| Bottom 10% | $75,090 | $36.10 |
| 25th percentile | $97,810 | $47.03 |
| Median | $129,180 | $62.11 |
| 75th percentile | $163,500 | $78.61 |
| Top 10% | $199,850 | $96.08 |
These figures are for information security analysts rather than every cybersecurity occupation. They are useful as a benchmark, but security engineers, managers, architects, and senior specialists may have different compensation structures.
Average Salary vs. Median Salary
Salary discussions often use “average” and “median” interchangeably, although they measure different things.
An average adds all salaries and divides the result by the number of workers. A median identifies the midpoint: half of workers earn less and half earn more.
For careers with some exceptionally high salaries, the median often gives job seekers a clearer picture of typical earnings.
Cyber Security Salary by Job Role
Your job title can have as much influence on compensation as your years of experience.
Cybersecurity professionals perform very different jobs. A SOC analyst monitoring alerts does not have the same responsibilities as a penetration tester attempting to exploit vulnerabilities or a security manager overseeing an organization’s security program.
Recent salary data compiled by Coursera from Glassdoor showed median total compensation of approximately $128,000 for cybersecurity analysts, $159,000 for cybersecurity engineers, $189,000 for information security managers, $154,000 for penetration testers, and $146,000 for cybersecurity specialists as of April 2026. These estimates include potential additional compensation and therefore should not be compared directly with base-wage statistics.
Cybersecurity Analyst
A cybersecurity analyst monitors systems, investigates suspicious activity, assesses vulnerabilities, and helps protect networks and data.
Common responsibilities include:
- Monitoring security alerts
- Reviewing logs and SIEM events
- Identifying vulnerabilities
- Investigating suspicious activity
- Supporting incident response
- Maintaining security controls
- Documenting security incidents
Analyst positions are a common route into the profession, although some employers still expect previous IT, networking, systems administration, or security experience.
Cybersecurity Engineer
Security engineers focus heavily on designing, implementing, and maintaining technical defenses.
They may work with firewalls, endpoint protection, identity and access management, network security, cloud infrastructure, encryption, security automation, and detection systems.
Because these jobs typically require stronger engineering skills, compensation can exceed that of general analyst positions.
Penetration Tester
Penetration testers, sometimes called ethical hackers, identify weaknesses by simulating attacks against authorized systems.
Their work can involve web applications, networks, APIs, cloud environments, mobile applications, and internal infrastructure.
Strong penetration testers understand both offensive techniques and defensive controls. Knowledge of Linux, networking, scripting, authentication, web security, and vulnerability assessment can be particularly valuable.
Incident Responder
Incident responders investigate security breaches and help organizations contain and recover from attacks.
The job may involve malware investigation, forensic evidence, compromised accounts, network logs, endpoint telemetry, threat intelligence, and communication with technical and business teams.
Incident response can also involve irregular hours because serious security events do not necessarily happen during the workday.
Information Security Manager
Security managers combine technical knowledge with leadership, risk management, budgeting, policy, compliance, and team management.
The greater responsibility helps explain why management positions can have higher compensation than individual-contributor analyst roles.
Entry-Level Cyber Security Salary
A common question is: How much can you make in cybersecurity with little or no experience?
There is no universal starting figure.
The BLS reports that the lowest 10% of information security analysts earned below $75,090 annually in May 2025, but this percentile should not be interpreted as an official entry-level salary. Workers at different experience levels can fall within the same wage group.
Glassdoor-based figures cited by Coursera provide another perspective. Median total pay for cybersecurity analysts with 0–1 years of experience was approximately $103,000, while the comparable estimate for cybersecurity engineers was about $123,000 as of April 2026.
Actual starting salaries can be substantially lower or higher depending on location and position.
Common early-career titles include:
- SOC analyst
- Junior security analyst
- Security administrator
- Vulnerability analyst
- Information security analyst
- Junior incident responder
- IT security specialist
One practical mistake is searching only for jobs literally titled “cybersecurity.” Employers use many different titles for overlapping security responsibilities.
Cyber Security Salary by Experience
Experience generally increases earning potential because experienced professionals are trusted with more complex systems, larger environments, and higher-risk decisions.
Glassdoor data summarized by Coursera illustrates the progression for several positions.
| Experience | Cybersecurity Analyst | Cybersecurity Engineer | Penetration Tester |
|---|---|---|---|
| 0–1 years | $103,000 | $123,000 | $116,000 |
| 1–3 years | $113,000 | $133,000 | $129,000 |
| 4–6 years | $125,000 | $147,000 | $154,000 |
| 7–9 years | $134,000 | $159,000 | $165,000 |
| 10–14 years | $146,000 | $170,000 | $171,000 |
These are median total-pay estimates, not guaranteed base salaries.
Entry Level: 0–2 Years
Early-career professionals usually spend considerable time developing foundational skills.
Employers may value knowledge of:
- TCP/IP and networking
- Windows and Linux
- Active Directory
- Security monitoring
- SIEM platforms
- Firewalls
- Endpoint security
- Vulnerability scanning
- Basic scripting
- Incident-response procedures
Hands-on ability matters. Someone who can investigate an alert, interpret network traffic, explain a vulnerability, and document findings may be more attractive to employers than someone whose knowledge is entirely theoretical.
Mid-Level: 3–6 Years
At this stage, professionals often move from following established procedures to independently investigating and solving security problems.
They may specialize in cloud security, penetration testing, application security, threat hunting, digital forensics, identity security, governance, risk and compliance, or security engineering.
Specialization can significantly affect compensation.
Senior Level: 7+ Years
Senior professionals may design security architecture, lead incident investigations, manage security programs, mentor teams, assess enterprise risk, or advise executives.
Compensation increasingly reflects the consequences of their decisions rather than simply the number of tools they know how to operate.
Which Cybersecurity Jobs Pay the Most?
There is no permanently fixed list of the highest-paying cybersecurity jobs because compensation changes by employer, market, seniority, and location.
However, positions requiring advanced technical expertise or organizational responsibility often have greater earning potential.
Examples include:
- Security architect
- Cloud security engineer
- Application security engineer
- Senior penetration tester
- Security engineering manager
- Information security manager
- Security consultant
- Director of information security
- Chief Information Security Officer (CISO)
Management is not the only route to higher compensation. Senior technical specialists can also command strong salaries when they have expertise in areas that are difficult to hire for.
Cloud security is a good example. Organizations increasingly operate workloads across platforms such as AWS, Microsoft Azure, and Google Cloud, creating demand for professionals who understand both cloud architecture and security.
How Location Affects Cyber Security Salary
Location remains an important compensation factor even with the growth of remote work.
BLS-linked wage data show considerable differences among U.S. states. For information security analysts, 2025 median wages included approximately $139,640 in Maryland, $131,540 in North Carolina, $124,860 in Florida, $105,800 in South Carolina, and $99,690 in Utah.
High salaries do not automatically mean greater purchasing power.
Housing, transportation, taxes, health care, and general living costs can consume a larger share of income in expensive markets. A lower nominal salary in a lower-cost region can therefore sometimes provide comparable disposable income.
Remote employment adds another variable. Some organizations use national salary bands, while others adjust compensation according to the employee’s location.
Which Industries Pay Cybersecurity Professionals More?
Industry also influences compensation.
The BLS reported the following median annual wages for information security analysts in major industries in May 2025:
| Industry | Median Annual Wage |
|---|---|
| Information | $138,650 |
| Computer systems design and related services | $132,410 |
| Finance and insurance | $130,630 |
| Management of companies and enterprises | $128,950 |
| Management, scientific and technical consulting | $125,420 |
Why does industry matter?
The financial and operational consequences of a breach vary between organizations. Companies handling financial transactions, sensitive customer information, intellectual property, critical infrastructure, or heavily regulated data may invest more heavily in security expertise.
Skills That Can Increase Cyber Security Salary
Simply collecting tools on a résumé rarely produces the strongest career growth. Higher-value professionals usually understand why security controls exist and how systems interact.
Networking
Networking remains one of cybersecurity’s foundational skills.
Understanding IP addressing, DNS, routing, ports, protocols, VPNs, firewalls, proxies, and network segmentation makes it easier to understand both attacks and defenses.
Linux and Windows
Security teams protect real operating systems.
Comfort with Windows, Active Directory, PowerShell, Linux permissions, processes, services, command-line utilities, and system logs can make investigations much easier.
Cloud Security
AWS, Microsoft Azure, and Google Cloud have created an entire category of security responsibilities.
Useful cloud-security knowledge includes identity and access management, storage permissions, logging, secrets management, network controls, encryption, containers, and configuration management.
SIEM and Security Monitoring
Security Information and Event Management platforms collect and analyze security-related events.
Professionals who can investigate logs rather than simply acknowledge alerts are more valuable to a Security Operations Center.
Python and Automation
Python, PowerShell, Bash, and other scripting tools can help automate repetitive security work.
Automation becomes particularly useful when processing logs, querying APIs, analyzing indicators, performing repetitive checks, or building internal security tools.
Incident Response
Knowing how to detect, contain, investigate, eradicate, and recover from security incidents is valuable across many security roles.
Strong responders also communicate clearly. Technical findings need to be understandable to engineers, managers, legal teams, and other stakeholders.
Penetration Testing
Offensive security skills can include vulnerability assessment, web application testing, privilege escalation, Active Directory security, API testing, and network exploitation.
Tools are useful, but understanding the underlying vulnerability is more important than memorizing commands.
Do Cybersecurity Certifications Increase Salary?
Certifications can improve employability and sometimes earning potential, but they do not automatically produce a particular salary.
Common credentials include:
- CompTIA Security+
- CompTIA CySA+
- Certified Ethical Hacker (CEH)
- OSCP
- CISSP
- CISM
- CCSP
- GIAC certifications
- AWS security certifications
- Microsoft security certifications
The value depends on the role.
Security+ may help establish foundational knowledge for an early-career candidate. OSCP is more closely aligned with offensive security and penetration testing. CISSP is frequently associated with experienced security professionals and positions involving broader security responsibilities.
Certifications tend to work best when they validate skills you can demonstrate rather than substitute for practical experience.
Do You Need a Degree for a High Cyber Security Salary?
Not necessarily, although education can influence hiring.
The BLS lists a bachelor’s degree as the typical entry-level education for information security analysts and notes that employers may prefer professional certification. It also indicates that related work experience is commonly relevant.
Cybersecurity professionals come from computer science, information technology, networking, software engineering, and other backgrounds.
Some also enter security without a traditional cybersecurity degree by building experience through IT support, networking, system administration, software development, cloud engineering, or other technical roles.
A degree can help pass hiring requirements. Practical ability determines whether someone can actually perform the job.
Is Cybersecurity a High-Paying Career?
Compared with the broader U.S. workforce, information security analysis is a relatively high-paying occupation.
The median annual wage for information security analysts was $129,180 in May 2025, compared with $50,980 for all occupations.
Compensation is only one part of the career, however.
Cybersecurity jobs can involve substantial responsibility. Professionals may handle incidents affecting customer information, business operations, regulatory obligations, or critical systems. Some analyst positions also require on-call work outside normal business hours.
The higher pay therefore comes with expectations for continuous learning and dependable decision-making.
Cybersecurity Job Outlook
Salary matters more when considered alongside demand.
The BLS projects employment of information security analysts to grow 21% from 2025 to 2035, compared with 3% across all occupations. Approximately 14,100 openings per year are projected on average over the decade.
Several trends support continued demand for security expertise.
Organizations depend increasingly on cloud infrastructure, online services, connected devices, artificial intelligence, and digital data. At the same time, cyberattacks require businesses to strengthen their defenses.
That does not mean every cybersecurity applicant will immediately find a high-paying position. Entry-level competition can still be significant, and many security roles require experience with IT infrastructure before employers will hand over substantial security responsibility.
How to Increase Your Cyber Security Salary
Salary growth usually comes from increasing the value and difficulty of the problems you can solve.
A practical progression looks like this:
- Build strong IT fundamentals. Learn networking, operating systems, authentication, cloud concepts, and basic scripting.
- Develop hands-on security skills. Use labs and controlled environments to practice monitoring, vulnerability assessment, incident response, and system hardening.
- Choose a specialization. Cloud security, application security, penetration testing, security engineering, incident response, and identity security can provide deeper career paths.
- Earn relevant certifications. Select credentials that match the role you actually want rather than collecting unrelated certifications.
- Document measurable results. Employers care about vulnerabilities discovered, incidents resolved, systems secured, processes automated, and risks reduced.
- Improve communication skills. Senior security professionals must explain technical risk to people who are not security specialists.
- Take on greater responsibility. Compensation often rises when your decisions affect larger systems, more users, critical applications, or organization-wide security strategy.
The biggest mistake is focusing exclusively on salary while ignoring skill development.
A certification may help secure an interview. A tool may help perform a task. Sustainable career growth comes from understanding systems well enough to recognize risks, investigate problems, and design effective solutions.
Cyber Security Salary: Final Takeaway
A cyber security salary can vary dramatically by role, experience, location, specialization, and employer. For a reliable U.S. benchmark, information security analysts earned a median $129,180 annually in May 2025, with the top 10% earning more than $199,850.
Cybersecurity engineers, penetration testers, managers, architects, cloud security specialists, and other advanced professionals can follow different compensation paths, so job title and responsibilities should always be considered when comparing salary figures.
For someone planning a career in the field, the most useful next step is not chasing the highest-paying title immediately. Build solid networking and operating-system fundamentals, gain practical security experience, develop a valuable specialization, and gradually take responsibility for more complex security problems. Those capabilities are what create stronger long-term earning potential.
