Watch a network for attacks and shut them down. Certifications count as much as a degree here.
Click through it
Pay, the path, pros and cons and the facts on one printable page. Good for a wall or a guidance counsellor.
Or read the whole thing here
What you earn and what it costs to get there.
Median
$129,180
Lower tenth
$75,090
Top tenth
$199,850
The national median for information security analysts is $129,180 a year, and the bottom tenth still start near $75,090. This is one of the best paid jobs on this site that does not need a graduate degree or a license.
About $70,000 to $90,000
First security role, usually in a security operations center
Very few people are hired straight into security with no background. Most arrive from a help desk, a network administrator job or a systems administrator job after one or two years.
$180,000 and up
Senior analysts, incident responders and security engineers at large companies
Finance, health care, defense contractors and cloud companies pay the most. Government agencies pay less in cash but add a pension and, for federal jobs, loan forgiveness for public service.
Tuition, fees, exams and kit. Not rent, food or travel
The low end is certificates and self-study: one entry level security exam voucher, a home lab built from old hardware and free virtual machines, and the no cost online training run by the Cybersecurity and Infrastructure Security Agency. People really are hired this way, almost always by starting on a help desk and moving across, so the cheap door works but is slower and less certain. The high end is four years of in-state public tuition for a computing degree, and two years at a community college first cuts that by roughly a third. File the FAFSA (Free Application for Federal Student Aid) before you pay tuition anywhere.
Fill in the FAFSA (Free Application for Federal Student Aid) first. There is also a real free tier in this field: the Cybersecurity and Infrastructure Security Agency runs a no-cost online training platform, and a lot of good practice material costs nothing.
Remote work is genuinely common
Monitoring and analysis can be done from anywhere with the right access.
Employer paid certifications
Most security teams have a training budget and expect you to use it.
On-call pay or shift differential
Round the clock security teams pay extra for nights and weekends.
Federal service options
Agencies hire heavily, and government service counts toward student loan forgiveness.
The exact path from high school to qualified.
There are two routes in: a degree, or a help desk job plus certifications. Both work.
High school
Grades 11 and 12
Computer science if your school offers it, plus math. Start breaking and fixing things at home now.
Degree or first technical job
0 to 4 years
A four year degree in computer science, information systems or cybersecurity is the common route. The other is a help desk or support job straight out of high school while you certify.
Learn the ground floor
1 to 2 years
Networking, operating systems and scripting. You cannot defend a network you do not understand. This is where most self-taught people stall.
Get certified
3 to 6 months of study
Security+ is the usual first one. Its exam is up to 90 questions in 90 minutes with a pass mark of 750 on a 100 to 900 scale, and two years of systems or security work is the recommended background.
First security role
Ongoing
A security operations center analyst, triaging alerts on shift. From there: incident response, threat hunting, security engineering or cloud security.
Computer science
Any programming at all. Python is the language this field runs on.
Math
Logic, probability and a little discrete math show up in detection work.
English
Half the job is writing an incident report that a manager can act on.
Government or law
Privacy rules and breach reporting duties shape what a security team is allowed to do.
There is no license to work in security. What replaces it is certifications and clearances. Employers screen on credentials because the work is trust-heavy: you will hold administrative access to systems holding other people's money and medical records. Federal and defense jobs add a security clearance, which means a background investigation into your finances, your travel and your honesty. Past drug use and unpaid debts are the two things that most often stop a clearance.
Things you don't need, but that help.
Security+
The standard first credential, and the one many federal and defense jobs require by name.
Certified Information Systems Security Professional
The big one, but it needs five years of paid security experience. Aim at it in your late twenties, not now.
Certified in Cybersecurity
An entry level credential from the same body, designed for people with no experience yet.
Cloud security certifications
Most company systems now live with a cloud provider, and security people who know one well are short on the ground.
A home lab
Virtual machines on an old computer, a firewall you configured yourself, and notes on what broke.
Capture the flag competitions
Free online security puzzle contests. A good scoreboard history gets interviews.
Scripting
Python and a shell language. Analysts who can automate repetitive checks move up fastest.
A public write-up habit
A blog or repository showing how you solved something is worth more than a certificate alone.
Federal agencies hire security people in volume and train them. The Cybersecurity and Infrastructure Security Agency runs free online training open to anyone, plus a twelve week skilling academy for federal employees moving into cyber defense work. Military service also puts people through this training and often leaves them with a clearance, which is worth real money in the private sector afterward.
Day to day, pros and cons, where you'd work.
Take the handover from the previous shift, then work the alert queue: a login from an unusual country, a laptop talking to a suspicious address, someone plugging in a device they should not have. Most alerts are nothing and you close them with a note. A few are real, and then it is fast: isolate the machine, pull the logs, work out what touched what, tell the people who need to know. In between, tuning detection rules so the same false alarm stops waking people at 3am.
The good
The hard parts
Things people don't tell you.
A convincing email, a reused password or a phone call to a help desk opens the door far more often than an exotic software flaw. That is why security teams spend so much time on training and on password and login controls.
The Certified Information Systems Security Professional credential requires five years of paid security work before it is awarded. You can pass the exam earlier and hold associate status while you build the experience.
The Cybersecurity and Infrastructure Security Agency publishes a free online training system covering beginner to advanced material, including courses on protecting power grids and water treatment plants.
Breaking into systems gets the attention, but the overwhelming majority of security jobs are defensive: monitoring, hardening and responding. There are many more analyst seats than there are professional attackers.
Last checked September 2026. Pay figures are typical full-time annual amounts in United States dollars, based on Bureau of Labor Statistics wage data and published pay scales. They vary by state, employer and experience. Tuition is for in-state students at public schools unless the card says otherwise.