Updated recently
Last updated:
Quick Answer: How much does cyber security analyst make: A cyber security analyst in the United States earns roughly $75,000-$95,000 starting out, $110,000-$140,000 with several years of SOC or GRC experience, and $150,000-$185,000 at senior or lead level before bonuses or equity. The band varies more by specialisation than by certification, because operations, governance and application security are three different markets with three different shortages.
Cyber Security Analyst Pay Bands in the US
Security has become one the more predictable routes into tech, with a steady demand curve and a clear ladder underneath it. The ladder runs from tier one SOC analyst, through tier two and tier three, into senior analyst, then into engineering, architecture, governance and leadership. Most people in the United States are paid on the analyst side of that ladder even when their job title does not say analyst.
The important variable is what kind of security work you do. Operations – monitoring alerts and working tickets – has the most entry points and the most people competing for them. Governance, risk and compliance has fewer entry points and pays better. Offensive security and application security pay best and are hardest to enter without a background.
| Specialisation | Entry | Mid | Senior | Typical entry route |
|---|---|---|---|---|
| SOC / operations | $60,000-$75,000 | $85,000-$105,000 | $115,000-$140,000 | Tier 1 rota, with shifts |
| Security analyst (GRC) | $75,000-$95,000 | $110,000-$140,000 | $150,000-$185,000 | Audit, compliance or IT background |
| Cloud security | $85,000-$105,000 | $130,000-$165,000 | $180,000-$230,000 | Cloud or infrastructure experience first |
| Application security | $95,000-$120,000 | $140,000-$175,000 | $195,000-$245,000 | Development background |
| Offensive security | $90,000-$115,000 | $140,000-$180,000 | $200,000-$260,000 | Lab hours and a practical cert |
Shift allowance is the detail that catches new analysts out. A tier one role covering nights and weekends at a managed security provider will often carry an additional 5% to 15%, and that is worth more in the first year than most certifications will ever add to the band.
How Much Does Cyber Security Analyst Make, and What Decides It
Three factors decide the number. The first is the specialisation, which sets the market you are in. The second is the employer type: a managed security provider pays a service band, a mid-sized company pays a department band, and a large enterprise with a mature security function pays a third thing entirely, higher but slower to move.
The third factor is your evidence. Security is unusually evidence-driven because the work is hard to fake – a hiring manager can ask which alert type you handled last week and find out quickly. Candidates who can describe a specific detection, a specific escalation and a specific outcome consistently negotiate higher than candidates who can only describe categories of work.
Which Certifications Move the Number, and Which Do Not
At entry level, certifications move the number meaningfully because they are the filter a recruiter uses to reduce an application pile. A Security+ listed on a resume for a tier one SOC role does real work. At mid and senior level, the same certificate is close to a rounding error, because hiring managers are filtering on specialisation depth and incident experience instead.
What continues to pay at every level is rare depth in a specific area – identity, cloud security, detection engineering, application security, or a regulated domain such as healthcare or financial services. The certificate is the proof you can talk about that depth; it is not a substitute for having it.
Why Security Pays More as It Gets More Specific
Security is a cost centre until something goes wrong, and the price of that risk is paid by the business. That is why generalist security roles are priced on headcount and specialist security roles are priced on the cost of the incident they prevent. A role that can reduce the blast radius of a breach is priced like insurance, and insurance pays more than administration.
This is also why the same person can be priced very differently depending on which domain they work in. Healthcare, financial services and critical infrastructure pay more for the same skill set because the consequence of being wrong is higher and the regulatory load is heavier. Moving domains is often the fastest available pay move in security.
How to Read a Security Salary Offer
Ask what the on-call expectation is and what it pays before you look at the base. In operations roles, being on the escalation path for a 24/7 environment is a large, invisible part of the job, and it is usually compensated separately. A role at $95,000 with a proper availability payment and a defined rota can be a better package than one at $105,000 with an informal expectation.
Then ask how the tier is assessed. If there is a written progression framework with examples of what each tier looks like, you can have a concrete promotion conversation in six months. If the answer is that it depends on the team, you are negotiating the promotion without a map, and you should price that into the decision.
What the Security Salary Data Leaves Out
Published security salary data almost always reports base salary and rarely reports the shift differential, the on-call allowance, or the fact that a tier one role at a provider pays materially less than a tier one role at a company with its own SOC. Both are real jobs with real differences in what the year feels like.
It also almost never separates the security function from the security-adjacent work that carries the same title. A person doing vulnerability management in an engineering team and a person running a 24/7 detection function in a provider are both ‘security analysts’, and the second is paid for the coverage.
How to Move Up a Security Band Deliberately
The reliable pattern is specialisation plus evidence. Pick a domain the industry you are targeting actually has – healthcare, financial services, identity, cloud – and get genuinely useful in it. Then make your evidence legible in writing, because that is what survives the interview.
The second half is choosing a next step that raises the floor rather than just the ceiling. Moving from a provider to an in-house team, or from operations to detection engineering, usually pays more than another year in the same seat, and it also changes what you are able to move into later.
A Tier One Analyst Who Skipped the Band and Moved Domains
A candidate took a tier one SOC role at a managed security provider covering nights, at $68,000 with shift allowance. Their Security+ had got them through the screen, and the rota was the standard entry point for anyone with a general IT background.
Eighteen months in, they noticed that every incident from one client – a regional healthcare network – took twice as long to close as the same pattern from another client. The difference was state healthcare data-handling rules and the fact that the provider had no runbook for them. The analyst built one, and the provider’s internal documentation now cites it.
That single piece of work became the entire basis of their next application. They moved from a service band into a healthcare security analyst role at $105,000 – a 54% increase from where they started – because they could talk about a domain no generic SOC analyst had context in. The lesson is that in security, the cheapest available move is often a domain move rather than a certification.
Why This Matters Outside the United States
Security operations and GRC roles are among the most remote-friendly jobs in tech, so this band is directly relevant to analysts in any country applying to US-contracted security teams.
Security operations and governance are among the most widely distributed functions in tech, which makes them one of the more accessible routes into a US-market career from another country. The credential transfers internationally; the US band usually does not, because most international hires are employed by a provider in their own country on a local band.
How to Read These Numbers
The figures here separate base pay from allowances rather than blending them, because in security the allowances are often larger than people expect. A tier one SOC role covering a 24/7 rota typically carries a differential, and a role with on-call responsibility carries an availability payment. Both are real money and both are usually absent from the headline number a recruiter quotes.
Comparisons across roles are also tricky in security, because ‘security analyst’ covers everything from a tier one ticket queue to an in-house detection engineering role. Whenever you see a single average for the whole field, treat it as the midpoint of a very wide distribution rather than as a target.
Key Terms Used Above
| Term | What it means in practice |
|---|---|
| Tier 1 / 2 / 3 | The SOC grading structure. Tier 1 triages and follows runbooks, tier 2 investigates and resolves, tier 3 leads investigations and tunes detection. The tier determines both pay and autonomy. |
| Shift differential | Extra pay for covering nights, weekends or holidays, usually a percentage of base. In a 24/7 SOC it is commonly 5% to 15%. |
| On-call allowance | Additional pay for being reachable outside working hours. It exists because being paged at 3am has a cost that salary alone does not cover. |
| GRC | Governance, risk and compliance – the assurance side of security. It is usually quieter than operations and usually pays better from mid career. |
| Detection engineering | Building and tuning what the SOC sees. It is a scarce skill and one of the main routes from tier three into a senior individual contributor band. |
Before accepting any SOC offer, get the rota in writing: which shifts, how often, and what the differential is. It is the single largest variable in the package and the one most often left verbal.
Related Reading
If you want the wider context, start with the cybersecurity career roadmap, then the full guide, then the full guide. Each of these covers a different part of the same decision.
Training Resources
For a structured path rather than scattered free material, the SkilBrill training programme covers the practical side of this topic with the same framing employers use. For a broader foundation, the related SkilBrill course covers the surrounding concepts so you are not learning this topic in isolation.
FAQ
How much does a cyber security analyst make?
A cyber security analyst in the USA typically earns $75,000-$95,000 starting out, $110,000-$140,000 with a few years of SOC or GRC experience, and $150,000-$185,000 at senior or lead level, before bonuses or equity.
Do cyber security certifications raise an analyst’s salary?
They help most at the entry level and at specialist pivots – cloud security, penetration testing, identity. A Security+ or equivalent gets you past resume screens; it does not by itself move a senior analyst’s band.
Is SOC work paid less than GRC and AppSec?
Usually yes in the early years. SOC analyst roles are the most common entry point and tend to sit lower, while GRC, identity and application security pay more because those skills are scarcer.
Can a cyber security analyst work remotely from outside the USA?
Commonly for SOC and GRC work, where the employer sells a service rather than a product. Expect the employer to prefer candidates in their own country for payroll and clearance reasons, so a US band is a ceiling rather than a default.
