Information security analysts held about 112,300 jobs in 2018. The largest employers of information security analysts were as follows:
| Computer systems design and related services | 26% |
| Finance and insurance | 18 |
| Management of companies and enterprises | 10 |
| Information | 8 |
| Administrative and support services | 6 |
Many information security analysts work with other members of an information technology department, such as network administrators or computer systems analysts.
Work Schedules
Most information security analysts work full time. Information security analysts sometimes have to be on call outside of normal business hours in case of an emergency. Some work more than 40 hours per week.
Most information security analyst positions require a bachelor’s degree in a computer-related field. Employers usually prefer analysts to have experience in a related occupation.
Education
Information security analysts usually need at least a bachelor’s degree in computer science, information assurance, programming, or a related field.
Some employers prefer applicants who have a Master of Business Administration (MBA) in information systems. Programs offering the MBA in information systems generally require 2 years of study beyond the undergraduate level and include both business and computer-related courses.
Work Experience in a Related Occupation
Information security analysts generally need to have previous experience in a related occupation. Many analysts have experience in an information technology department, often as a network or computer systems administrator. Some employers look for people who have already worked in fields related to the one in which they are hiring. For example, if the job opening is in database security, they may look for a database administrator. If they are hiring in systems security, a computer systems analyst may be an ideal candidate.
Licenses, Certifications, and Registrations
There are a number of information security certifications available, and many employers prefer candidates to have certification, which validates the knowledge and best practices required from information security analysts. Some are general information security certificates, such as the Certified Information Systems Security Professional (CISSP), while others have a more narrow focus, such as penetration testing or systems auditing.
Advancement
Information security analysts can advance to become chief security officers or another type of computer and information systems manager.
Information security analysts typically have an interest in the Building, Thinking and Organizing interest areas, according to the Holland Code framework. The Building interest area indicates a focus on working with tools and machines, and making or fixing practical things. The Thinking interest area indicates a focus on researching, investigating, and increasing the understanding of natural laws. The Organizing interest area indicates a focus on working with information and processes to keep things arranged in orderly systems.
If you are not sure whether you have a Building or Thinking or Organizing interest which might fit with a career as an information security analyst, you can take a career test to measure your interests.
Information security analysts should also possess the following specific qualities:
Analytical skills . Information security analysts must carefully study computer systems and networks and investigate any irregularities to determine if the networks have been compromised.
Detail oriented . Because cyberattacks can be difficult to detect, information security analysts pay careful attention to their computer systems and watch for minor changes in performance.
Ingenuity. Information security analysts try to outthink cybercriminals and invent new ways to protect their organization’s computer systems and networks.
Problem-solving skills . Information security analysts uncover and fix flaws in computer systems and networks.
The median annual wage for information security analysts was $99,730 in May 2019. The median wage is the wage at which half the workers in an occupation earned more than that amount and half earned less. The lowest 10 percent earned less than $57,810, and the highest 10 percent earned more than $158,860.
In May 2019, the median annual wages for information security analysts in the top industries in which they worked were as follows:
| Finance and insurance | $103,510 |
| Computer systems design and related services | 101,980 |
| Information | 100,560 |
| Management of companies and enterprises | 97,440 |
| Administrative and support services | 96,190 |
Most information security analysts work full time. Information security analysts sometimes have to be on call outside of normal business hours in case of an emergency. Some work more than 40 hours per week.
Employment of information security analysts is projected to grow 32 percent from 2018 to 2028, much faster than the average for all occupations.
Demand for information security analysts is expected to be very high. Cyberattacks have grown in frequency, and analysts will be needed to come up with innovative solutions to prevent hackers from stealing critical information or creating problems for computer networks.
Banks and financial institutions, as well as other types of corporations, will need to increase their information security capabilities in the face of growing cybersecurity threats. In addition, as the healthcare industry expands its use of electronic medical records, ensuring patients’ privacy and protecting personal data are becoming more important. More information security analysts are likely to be needed to create the safeguards that will satisfy patients’ concerns.
Employment of information security analysts is projected to grow 55 percent in computer systems design and related services from 2018 to 2028. The increasing adoption of cloud services by small and medium-sized businesses and a rise in cybersecurity threats will create demand for managed security services providers in this industry.
Job Prospects
Job prospects for information security analysts should be good. Information security analysts with related work experience will have the best prospects. For example, an applicant with experience as a database administrator would have better prospects in database security than someone without that experience.
For more information about computer careers, visit
Association for Computing Machinery
Computing Research Association
For information about opportunities for women pursuing information technology careers, visit:
National Center for Women & Information Technology