Most cyber security salary figures online come from recruiter surveys and job boards with unclear samples, so hiring managers and job seekers end up negotiating from numbers nobody can verify. This page brings together salary statistics only from primary sources: the US Bureau of Labor Statistics (BLS), the UK Department for Science, Innovation and Technology (DSIT) labour market study, and the salary data ISC2 publishes from its Cybersecurity Workforce Study. Every figure carries its publisher and the period it describes. It is written for security leaders setting pay bands, HR and workforce planners, and practitioners benchmarking their own pay. For routes into the field and role descriptions, see the Cybersecurity Careers Guide.
Last reviewed: November 2026. The sources below are updated each year (BLS each spring, DSIT each autumn, ISC2 after each annual workforce study), and this page should be refreshed on the same cycle.
Key takeaways
- US analysts earn a median of $129,180. BLS reports this median annual wage for information security analysts for May 2025, with the top 10% above $199,850.
- Security management pays far more. Computer and information systems managers, the BLS occupation that includes IT security managers, had a median of $175,140 in May 2025.
- UK advertised pay is lower and the premium is shrinking. DSIT found a median advertised salary of £55,000 for core cyber roles in 2024 job adverts, about 12% above the wider IT market, down from 33% in 2022.
- Region changes pay more than certification. ISC2's published CISSP medians run from US$70,000 in Asia-Pacific to US$150,000 in North America.
- Treat every figure as a range, not a price. Medians hide wide spreads by industry, location and seniority, and advertised salaries are not the same as pay actually received.
How to read cyber security salary statistics
Salary data differs in what it measures, and mixing sources leads to bad pay decisions. The three source types used here answer different questions:
| Source | What it measures | Strengths | Limits |
|---|---|---|---|
| BLS Occupational Outlook Handbook (US, May 2025 data) | Wages actually paid, from employer survey data, by standard occupation | Large official sample; percentiles; industry breakdown | Occupations are broad; no separate code for most security specialisms; US only |
| DSIT Cyber security skills in the UK labour market 2025 (2024 job adverts) | Salaries advertised in cyber job postings | Government-commissioned; cyber-specific; London and regional view | The report gives conflicting figures for the share of postings that advertised a salary (25% in one section, 70% in another); advertised pay is not pay received |
| ISC2 certification salary pages (from its Cybersecurity Workforce Study) | Self-reported salaries of survey respondents holding each certification | Global, regional, by certification | Self-reported; ISC2 does not state the survey year on the pages; shown only where at least 50 valid responses exist |
Median, not mean: all headline figures below are medians unless marked otherwise. Means are pulled upwards by a small number of very high salaries, as the gap between the DSIT median (£55,000) and mean (£58,800) shows.
United States: pay by occupation and industry
BLS does not have one "cyber security" occupation. The closest is information security analysts; security engineering and administration roles also fall in neighbouring occupations, and security leadership sits within computer and information systems managers.
| BLS occupation (May 2025) | Typical security roles | Lowest 10% earn less than | Median annual wage | Highest 10% earn more than |
|---|---|---|---|---|
| Network and computer systems administrators | Systems and network administration with security duties | $62,640 | $99,130 | $155,050 |
| Information security analysts | SOC analyst, security engineer, security analyst, threat and vulnerability roles | $75,090 | $129,180 | $199,850 |
| Computer and information systems managers | IT security manager, head of security, security leadership | $107,550 | $175,140 | $297,510 |
BLS reports 192,900 information security analyst jobs in 2025 and projects employment to grow 21% between 2025 and 2035, which it describes as much faster than average, an increase of 40,600 jobs. For computer and information systems managers it projects 16% growth over the same period. BLS lists a bachelor's degree as the typical entry-level education for information security analysts, with less than five years of related work experience.
By industry
BLS median annual wages for information security analysts in the largest employing industries, May 2025:
- Information: $138,650.
- Computer systems design and related services: $132,410.
- Finance and insurance: $130,630.
- Management of companies and enterprises: $128,950.
- Management, scientific and technical consulting services: $125,420.
The industry spread among these sectors is narrower (about $13,000 between highest and lowest) than the spread between the 10th and 90th percentiles of the occupation as a whole (about $125,000). Seniority and role scope move pay more than sector does.
United Kingdom: advertised pay and the cyber premium
DSIT's Cyber security skills in the UK labour market 2025, researched by Ipsos and Perspective Economics, first published on 19 September 2025, analyses cyber job adverts from January to December 2024.
| Measure (DSIT, 2024 job adverts) | Figure |
|---|---|
| Median advertised salary, core cyber roles | £55,000 |
| Mean advertised salary, core cyber roles | £58,800 |
| London mean advertised salary | £69,800 (about £11,000 above the UK mean) |
| Median for the wider IT market (ASHE proxy, SIC 62) | £48,900 |
| Cyber premium over wider IT | About 12% (25% in 2023, 33% in 2022) |
| Postings that advertised a salary | Not stated consistently (the report gives 25% in section 4.6 and 70% in section 4.1) |
| Postings asking for 2 to 6 years' experience | 63% |
| Postings asking for less than 1 year's experience | 17% |
The same report estimates the UK cyber security workforce at approximately 143,000 people at the end of 2024, and a workforce gap of 3,800, compared with 3,500 in the 2024 report and 11,100 in 2023. A narrowing gap alongside a falling pay premium suggests the UK market has moved from acute shortage towards a market that still pays well but no longer pays any price for any candidate. The Cybersecurity Skills Gap and Hiring Guide covers what this means for recruiting.
Global and regional pay by certification
ISC2 publishes median salaries for holders of its certifications, drawn from what it describes as the latest ISC2 Cybersecurity Workforce Study. ISC2 does not state the survey year on these pages; the figures below were checked on 8 November 2026. ISC2 shows a regional median only where there are at least 50 valid responses, and states the figures are not guaranteed salaries. All amounts are in US dollars.
| Certification (ISC2 data, checked Nov 2026) | Global median | North America | Europe | Asia-Pacific |
|---|---|---|---|---|
| SSCP (security operations and administration) | $95,200 | $102,000 | $94,400 | $70,000 |
| CCSP (cloud security) | $118,840 | $146,000 | $118,000 | $84,000 |
| CISSP (security leadership and broad practice) | $127,000 | $150,000 | $106,200 | $70,000 |
| CGRC (governance, risk and compliance) | $134,500 | $140,000 | ISC2 publishes global and North America medians only | ISC2 publishes global and North America medians only |
Two cautions apply. First, these are holders' salaries, not the effect of the certification: CISSP requires several years of experience, so its holders are more senior on average. Second, the US dollar conversion makes lower-cost regions look lower than local purchasing power would. The certification guides cover requirements: see the CISSP Certification Guide, CCSP Certification Guide, SSCP Certification Guide and ISC2 CGRC Certification Guide.
The 2025 ISC2 Cybersecurity Workforce Study was published on 4 December 2025; check the ISC2 research pages after each December release for refreshed figures.
Pay by seniority
None of the primary sources publishes a clean "junior, mid, senior" table, but the official data supports a reasonable view of how pay grows with career stage:
| Career stage | Primary source indicator | Figure and period |
|---|---|---|
| UK graduate entry | DSIT: median salary band for 2021/22 cyber security graduates in full-time work, 15 months after graduating | £30,001 to £35,000 |
| US early career | BLS: information security analysts, lowest 10% | Less than $75,090 (May 2025) |
| US established practitioner | BLS: information security analysts, median | $129,180 (May 2025) |
| US senior specialist | BLS: information security analysts, highest 10% | More than $199,850 (May 2025) |
| US security management | BLS: computer and information systems managers, median | $175,140 (May 2025) |
| US senior leadership | BLS: computer and information systems managers, highest 10% | More than $297,510 (May 2025) |
Experience demand matters as much as pay. In the DSIT data only 17% of UK core cyber postings asked for less than a year's experience, which is why entry-level candidates find the market harder than headline shortage figures suggest. BLS notes that an IT security manager may need prior experience as an information security analyst, which matches the typical step from analyst to management. The Path to CISO Career Guide and SOC Analyst Career Guide describe these routes.
Worked example: building a band from official data
A US employer setting a band for a mid-level security analyst could start from the BLS information security analyst figures for May 2025: lowest 10% below $75,090, median $129,180 and highest 10% above $199,850. A band that runs from roughly the midpoint between the 10th percentile and the median (about $102,000) to the midpoint between the median and the 90th percentile (about $164,500) brackets the middle of the market without matching its extremes. The employer then adjusts for industry, using the BLS industry medians, and for location. A UK employer would anchor instead on the DSIT median advertised salary of £55,000 and the London mean of £69,800, remembering that only a quarter of adverts disclosed pay. Either way, record the source and period beside the band so the next review can refresh it.
What the numbers mean for defenders
- Pay bands: anchor bands to an official median for the closest occupation and region, then adjust for scope. Recruiter surveys can add detail on specialisms, but should not set the anchor.
- Retention: the spread between the BLS median and 90th percentile for analysts (about $70,000) is the room a competitor has to poach a strong engineer. Track your own staff's position within the band.
- Grow your own: with most postings asking for two to six years' experience, organisations that hire graduates and train them reduce dependence on a small pool of experienced candidates.
- Specialist skills: cloud, identity and governance roles appear at or above general practice medians in the ISC2 data (CCSP and CGRC global medians are above SSCP). Identity specialists, including those managing non-human identities and AI agents, often sit in this premium group; see the NHI and Machine Identity Engineer Career Guide.
- Location strategy: the London premium of about £11,000 over the UK mean (DSIT) and the North America premium in ISC2 data both make remote and regional hiring a real budget lever.
- Measure: track time to fill, offer acceptance rate, regretted attrition in security roles, internal promotion share and position against the official median each year.
Practitioner checklist
- Map every security role to the closest official occupation (BLS occupation or UK equivalent) before benchmarking.
- Use medians and percentiles, never a single average, to set pay ranges.
- Record the source, publisher and data period for every figure in your pay framework.
- Separate advertised salary data from paid salary data in comparisons.
- Adjust for region and currency rather than applying US figures elsewhere.
- Review bands each year after the BLS, DSIT and ISC2 releases.
- Track regretted attrition and offer acceptance alongside pay position.
- Fund a graduate or apprentice route to reduce reliance on experienced hires.
Standards and references
- US Bureau of Labor Statistics: Information Security Analysts, Occupational Outlook Handbook
- US Bureau of Labor Statistics: Computer and Information Systems Managers, Occupational Outlook Handbook
- US Bureau of Labor Statistics: Network and Computer Systems Administrators, Occupational Outlook Handbook
- UK Department for Science, Innovation and Technology: Cyber security skills in the UK labour market 2025
- ISC2: CISSP salary
- ISC2: CCSP salary
- ISC2: SSCP salary
- ISC2: CGRC salary
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · Cybersecurity Skills Gap and Hiring Guide · Cybersecurity Certifications Guide · Path to CISO Career Guide