Information security analysts in the US earn a median of $129,180 a year in base pay. The middle half earn between $97,810 and $163,500, and the top 10% earn more than $199,850 (BLS OEWS May 2025). To negotiate, aim for the part of that range that matches your experience — with 3–5 years, for example, $129,000 to $164,000 — and open slightly above it.
How much do information security analysts make?
| Percentile | Annual base pay |
|---|---|
| 10th | $75,090 |
| 25th | $97,810 |
| Median | $129,180 |
| 75th | $163,500 |
| 90th | $199,850 |
Source: U.S. Bureau of Labor Statistics, OEWS May 2025 — Information Security Analysts, national, about 190,650 jobs. BLS figures are base pay including commissions and production bonuses; they exclude year-end bonuses, stock, overtime and benefits.
Where information security analysts earn the most
| State | Median | 75th percentile |
|---|---|---|
| Washington | $154,940 | $178,890 |
| Maryland | $139,640 | $183,260 |
| California | $138,570 | $177,890 |
| Delaware | $137,030 | $166,300 |
| Massachusetts | $136,550 | $176,450 |
Pay also differs within a state — big metro areas often pay more. Use your state's numbers when you set your target.
What should you ask for as a information security analyst?
| Experience | Suggested target range | Open with about |
|---|---|---|
| 0–2 years | $98,000–$129,000 | $135,000 |
| 3–5 years | $129,000–$164,000 | $172,000 |
| 6–10 years | $143,000–$176,000 | $185,000 |
| 10+ years | $164,000–$200,000 | $210,000 |
The ranges follow national percentiles by experience (25th–50th, 50th–75th, 60th–80th, 75th–90th); the opening number is the top of the range plus about 5%, rounded. Guidance, not a guarantee — check your state and experience, and see how to negotiate salary.
What drives information security analyst pay?
Information security analysts protect an organization's systems and data — monitoring threats, responding to incidents and hardening infrastructure. Pay varies with the niche (cloud security, incident response, governance), certifications, clearances and whether the role includes on-call duty.
- Specialty: cloud security, security engineering, incident response, GRC.
- Certifications such as CISSP, OSCP or cloud security credentials.
- Security clearance for government and contractor roles.
- On-call rotation for incident response.
Your leverage as a information security analyst
- Hands-on incidents you handled and what you prevented.
- Certifications the employer needs for audits or contracts.
- An active security clearance.
- Cloud platform experience the team lacks.
- Audit or compliance projects you led (SOC 2, ISO 27001).
Only use leverage you really have. Never invent a competing offer.
Information security analyst objections and how to answer
| They say | You can say |
|---|---|
| “That's above our band for analysts.” | “Would the role fit the engineer band, given my experience with [system]?” |
| “Certifications don't change our pay.” | “Then could we look at a sign-on bonus and a training budget?” |
| “On-call is part of the job.” | “I'm fine with on-call. How often is the rotation, and is it compensated?” |
| “We're not a tech company, so pay is lower.” | “The work is the same; I'd like the base to reflect the market rate for this role.” |
Sample counter offer for a information security analyst
Thank you — I'm excited about the role. Given my [certification], my incident response work at [company] and the on-call rotation, I'm asking for a base of [number]. The national median for information security analysts is $129,180, and the 75th percentile is $163,500.
Then stop talking and let them respond.
Asking for a raise as a information security analyst
Document incidents, audits passed and risk reduced. A new certification or a move into engineering or cloud security is the clearest case for a level change.