Watch for attacks and stop them. High pay, real shortage, and the government is one of the biggest employers.
Click through it
Pay, the path, pros and cons and the facts on one printable page. Good for a wall or a guidance counsellor.
Or read the whole thing here
What you earn and what it costs to get there.
Typical
$103,000
Junior
$62,000
Senior or specialist
$150,000
Job Bank's national median is $49.52 an hour, about $103,000 a year full time. The page sits under the broader cybersecurity specialists group (NOC, the National Occupational Classification, code 21220). Banks and consulting firms in Toronto pay above this. Small companies and entry-level monitoring roles pay below.
$60,000 to $75,000
Junior analyst in a SOC (security operations centre), or IT (information technology) support moving into security
Job Bank's low end is $30 an hour. The federal government, through the Communications Security Establishment, hires students and new graduates directly in Ottawa.
$130,000 to $150,000+
Senior analyst, incident responder, security architect
Job Bank's top end is $72.12 an hour. Holders of the CISSP (Certified Information Systems Security Professional) certificate, which needs 5 years of experience, are often above this. Consulting and contract work pays the most.
Tuition, fees, exams and kit. Not rent, food or travel
The low end is a two year college diploma at Ontario public rates plus one entry level certification exam such as Security Plus. The high end is a four year university computer science degree at the top of the tuition range with a couple of certifications on top. Employers usually pay for certifications once you are hired, and practice labs and capture the flag contests cost nothing. The CISSP (Certified Information Systems Security Professional) is not an entry cost at all, because you need five years of experience before you can hold it.
Employers often pay for certifications once you are hired. Free practice labs and capture-the-flag contests cost nothing.
Pension and security clearance
Government and defence jobs come with both. A clearance makes you more valuable to every employer after.
On-call pay
Incident response teams get paid extra to be reachable.
Paid certifications and training
Standard, because the threats change every year.
Remote or hybrid work
Common, though classified government work is in the office.
The exact path from high school to qualified.
Learn how systems work, then learn how they get broken. Most people start in networking or IT (information technology) support.
High school
Grades 11 and 12
Computer science and math. Play capture-the-flag challenges online. Learn Linux and how networks work. Do not hack anything you do not own.
Diploma or degree
2 to 5 years
A 2 to 3 year college diploma in cybersecurity or networking (many Ontario colleges, BCIT (British Columbia Institute of Technology), NAIT (Northern Alberta Institute of Technology)), or a 4-year computer science degree. Pick co-op.
First certificate
During school
CompTIA Security+ is the standard entry certificate: 90 questions, 90 minutes. Network+ before it helps.
First job
After graduation
Junior analyst in a SOC (security operations centre), IT (information technology) support, or a student job at the Communications Security Establishment or a bank.
Specialize
Years 2 to 6
Incident response, threat intelligence, cloud security, or penetration testing. After 5 years, the CISSP (Certified Information Systems Security Professional) opens senior roles.
Computer science
Reading code and scripts is daily work.
Math
Required for the degree route. Cryptography is math.
Networking or IT (information technology) courses
If your school has them. Networks are where attacks happen.
English and law
Incident reports, policy, and privacy law are a large part of the job.
No licence or professional body controls the title. Certifications fill the gap and employers treat them as required: CompTIA Security+ at entry, then the CISSP (Certified Information Systems Security Professional), which covers 8 domains and needs 5 years of experience. Government and defence jobs also need a security clearance, which means a background check and, for the highest levels, a long wait.
Things you don't need, but that help.
Incident response
The people called in when a company is breached. Stressful, well paid, often contract.
Cloud security
Securing AWS (Amazon Web Services), Azure and Google Cloud. Certificates from each vendor.
Penetration testing
Being paid to break in. A separate career on this site.
Governance and compliance
Policy, audits and privacy law. Less technical, and banks pay well for it.
Capture-the-flag contests
Free online competitions where you solve hacking puzzles legally. A strong signal on a first resume.
A home lab
A few virtual machines you attack and defend.
Security clearance
Earned through a government or defence job. Follows you and raises your value.
French
Federal jobs in Ottawa often want both languages.
The Communications Security Establishment in Ottawa is Canada's signals intelligence and cyber defence agency, and its Canadian Centre for Cyber Security is the national source of cyber advice. Both hire students and new graduates, offer a pension and a clearance, and let you work on national-scale threats. The trade-off is a long hiring process and a background check.
Day to day, pros and cons, where you'd work.
In a SOC (security operations centre), you watch dashboards of alerts from across the company's network. Most are false alarms; you learn to tell in seconds. A real one means investigating: what did the attacker touch, is it still happening, who needs to know. You write it up and hand off at shift change. Outside the SOC, analysts review new systems for weaknesses, run phishing tests on staff, and patch what the last audit found. When a real breach hits, everything else stops.
The good
The hard parts
Things people don't tell you.
That is Job Bank's count of cybersecurity specialists as of 2023, and it projects a moderate risk of shortage through 2033. Nova Scotia and Quebec are rated good for prospects right now.
The Communications Security Establishment, Canada's signals intelligence agency, runs a student program and hires new graduates for cyber defence roles in Ottawa. Its Canadian Centre for Cyber Security publishes the advice every Canadian company follows.
The CISSP (Certified Information Systems Security Professional) covers 8 domains, from cryptography to software security, and you cannot hold it without 5 years of paid experience. That is why it is on almost every senior job ad.
Phishing, a fake email that tricks someone into clicking, is still the most common way attackers get in. A big part of the analyst's job is training people, not machines.
Last checked September 2026. Pay figures are typical full-time annual amounts in Canadian dollars, based on Government of Canada Job Bank wage data and published salary grids. They vary by province, employer and experience. Tuition is for domestic students.