Watch for attacks and stop them. High pay, real shortage, and the government is one of the biggest employers.
Click through it
Pay, the path, pros and cons and the facts on one printable page. Counsellors: send it to a student from your own email in one click.
Programs in the fields this career usually comes through. Each has its own page: what it takes to get in, the courses you need and what it costs.
The median pay is about $103,000 a year. Across everyone in the job it runs from about $62,000 at the lower end to about $150,000 at the upper end. The source is listed under Sources at the end of this page.
2 to 6 years after high school, on the usual route.
$8,500 to $61,500 all in for tuition, fees, exams and kit. Living costs are not counted.
No. There is no licence to hold, though many employers still ask for training or a certificate.
Moderate demand nationally, from government outlook data. Demand varies by region, so check your area.
Or read the whole thing here
What you earn and what it costs to get there.
Median
$103,000
Lower end
$62,000
Upper end
$150,000
Job Bank's national median is $49.52 an hour, about $103,000 a year at 40 hours a week. The lower and upper ends are Job Bank's low and high wages for everyone in the group, $30 and $72.12 an hour. The page sits under the broader cybersecurity specialists group (NOC, the National Occupational Classification, code 21220).
$51.28 an hour
The median in Ontario, the highest of any province
Alberta follows at $50.51 and Quebec at $49.23. Nova Scotia's median is the lowest, at $42.05. Many people start as a junior analyst in a SOC (security operations centre). The federal government, through the Communications Security Establishment, hires students and new graduates directly in Ottawa.
Roughly, all in
$8,500 to $61,500
Tuition, fees, exams and kit. Not rent, food or travel
The low end is a two year college diploma at Ontario public rates plus one entry level certification exam such as Security Plus. The high end is a four year university computer science degree at the top of the tuition range with a couple of certifications on top. Employers usually pay for certifications once you are hired, and practice labs and capture the flag contests cost nothing. The CISSP (Certified Information Systems Security Professional) is not an entry cost at all, because you need five years of experience before you can hold it.
Employers often pay for certifications once you are hired. Practice labs and capture-the-flag contests cost nothing.
Pension and security clearance
Government and defence jobs come with both. A clearance is useful to every employer after.
On-call pay
Incident response teams get paid extra to be reachable.
Paid certifications and training
Standard, because the threats change every year.
Remote or hybrid work
Common, though classified government work is in the office.
The exact path from high school to qualified.
Learn how systems work, then learn how they get broken. Most people start in networking or IT (information technology) support.
High school
Grades 11 and 12
Computer science and math. Play capture-the-flag challenges online. Learn Linux and how networks work. Do not hack anything you do not own.
Diploma or degree
2 to 5 years
A 2 to 3 year college diploma in cybersecurity or networking (many Ontario colleges, BCIT (British Columbia Institute of Technology), NAIT (Northern Alberta Institute of Technology)), or a 4-year computer science degree. Pick co-op.
First certificate
During school
CompTIA Security+ is the standard entry certificate: 90 questions, 90 minutes. Network+ before it helps.
First job
After graduation
Junior analyst in a SOC (security operations centre), IT (information technology) support, or a student job at the Communications Security Establishment or a bank.
Specialize
Years 2 to 6
Incident response, threat intelligence, cloud security, or penetration testing. After 5 years, the CISSP (Certified Information Systems Security Professional) opens senior roles.
Computer science
Reading code and scripts is daily work.
Math
Required for the degree route. Cryptography is math.
Networking or IT (information technology) courses
If your school has them. Networks are where attacks happen.
English and law
Incident reports, policy, and privacy law are a large part of the job.
No licence or professional body controls the title. Certifications fill the gap and employers treat them as required: CompTIA Security+ at entry, then the CISSP (Certified Information Systems Security Professional), which covers 8 domains and needs 5 years of experience. Government and defence jobs also need a security clearance, which means a background check and, for the highest levels, a long wait.
Quebec has a college route: a computer science diploma from a CEGEP (public college), then a short public cybersecurity program for people who already know networks.
Finish Secondary V
Age 16 or 17
Take Secondary IV math in the Technical and Scientific or the Science sequence. It meets the math requirement for the computer science DEC (Diploma of College Studies) and keeps university science programs open.
Computer Science Technology DEC (420.B0)
3 years
3 years at a CEGEP (public college), with no tuition for full-time Quebec residents. Each college picks its options, so choose one strong on networks and servers. In English at Dawson, Vanier, John Abbott, Champlain and Heritage.
Work in networks or support
1 to 3 years
Security jobs want people who know how networks run. Every computer science DEC (Diploma of College Studies) includes an information security course, and the network side goes further.
Cybersecurity AEC (Attestation of College Studies)
About 1 year
Cybersecurity: Prevention and Intervention (LEA.D8), 570 hours, mostly evenings and Saturdays. It needs the computer science DEC, a network AEC or network work experience.
Certifications
Ongoing
The same as everywhere: CompTIA Security+ to start, then the CISSP (Certified Information Systems Security Professional) after 5 years of experience.
All three teach the same provincial program (LEA.D8). An AEC needs a high school diploma plus time out of full-time study, a year of college or university, or a vocational diploma, so it is not a route straight from Secondary V.
Things you don't need, but that help.
Incident response
The people called in when a company is breached. Stressful, often contract.
Cloud security
Securing AWS (Amazon Web Services), Azure and Google Cloud. Certificates from each vendor.
Penetration testing
Being paid to break in. A separate career on this site.
Governance and compliance
Policy, audits and privacy law. Less technical, and banks hire for it.
Capture-the-flag contests
Online competitions, at no cost, where you solve hacking puzzles legally. A strong signal on a first resume.
A home lab
A few virtual machines you attack and defend.
Security clearance
Earned through a government or defence job. It follows you to later jobs.
French
Federal jobs in Ottawa often want both languages.
The Communications Security Establishment in Ottawa is Canada's signals intelligence and cyber defence agency, and its Canadian Centre for Cyber Security is the national source of cyber advice. Both hire students and new graduates, offer a pension and a clearance, and let you work on national-scale threats. The trade-off is a long hiring process and a background check.
Day to day, pros and cons, where you'd work.
In a SOC (security operations centre), you watch dashboards of alerts from across the company's network. Most are false alarms; you learn to tell in seconds. A real one means investigating: what did the attacker touch, is it still happening, who needs to know. You write it up and hand off at shift change. Outside the SOC, analysts review new systems for weaknesses, run phishing tests on staff, and patch what the last audit found. When a real breach hits, everything else stops.
The good
The hard parts
Things people don't tell you.
That is Job Bank's count of cybersecurity specialists as of 2023, and it projects a moderate risk of shortage through 2033. Nova Scotia and Quebec are rated good for prospects right now.
The Communications Security Establishment, Canada's signals intelligence agency, runs a student program and hires new graduates for cyber defence roles in Ottawa. Its Canadian Centre for Cyber Security publishes the advice every Canadian company follows.
Phishing, a fake email that tricks someone into clicking, is still the most common way attackers get in. A big part of the analyst's job is training people, not machines.
Every list is built from the same numbers shown above, so you can see where this career sits next to the others.
Security and networks first, then the rest of the field. See every career in tech.
Last checked October 2026. Pay figures are typical full-time annual amounts in Canadian dollars, based on Government of Canada Job Bank wage data and published salary grids. They vary by province, employer and experience. Tuition is for domestic students. How every figure on this site is sourced and checked.
Tell us about this page. A person reads every message.
No email app on this device? Use Gmail instead: report a mistake in Gmail or say what you like in Gmail.