Cybersecurity Analyst
Cybersecurity analysts plan and carry out security measures that protect an organization's computer networks and systems. They monitor networks for security breaches and analyze events using data from cyber defense tools such as IDS alerts, firewalls, and network traffic logs.
Related job titles
- Information security analyst
- Security analyst
- Cyber defense analyst
- IT security analyst
- Network security analyst
What They Do
12 tasks- Monitor the organization's networks for security breaches and investigate when one occurs.
- Detect and alert on possible attacks, intrusions, anomalous activity, and misuse, and distinguish them from benign activity.
- Analyze malicious activity to determine the weaknesses exploited, the exploitation methods, and the effects on systems and information.
- Check computer and network systems for vulnerabilities.
- Use and maintain software such as firewalls and data encryption programs to protect sensitive information.
- Document and escalate incidents, with their history, status, and potential impact.
- Prepare reports on general metrics, attempted attacks, and security breaches.
- Recommend security enhancements to management or senior IT staff.
- Correlate event information gathered from sources across the enterprise to gain situational awareness and judge how effective an observed attack was.
- Characterize and analyze network traffic, including its metadata, to identify anomalous activity and potential threats to network resources.
- Research the latest IT security trends and develop security standards and best practices for the organization.
- Help create the organization's disaster recovery plan and test its steps on a regular basis.
Knowledge and Skills
- Computer networking concepts, protocols, and network security methods
- Intrusion detection methods for host and network based intrusions
- Network traffic analysis methods and packet-level analysis
- Cyber threats, vulnerabilities, and common attack vectors on the network layer
- Risk management processes for assessing and mitigating risk
- Laws, regulations, policies, and ethics related to cybersecurity and privacy
- Intrusion detection and intrusion prevention system (IDS/IPS) tools and applications
- Network protocols such as TCP/IP, dynamic host configuration, DNS, and directory services
- Classes of attacks and types of cyber attackers, from script kiddies and insiders to nation-sponsored groups
How to Become a Cybersecurity Analyst
BLS reports that information security analysts typically need a bachelor's degree in computer and information technology or a related field, such as engineering or math. Some workers enter the occupation with a high school diploma and relevant industry training and certifications.
Analysts may need work experience in a related occupation, and many have worked in an IT department, often as a network and computer systems administrator. The U.S. Department of Labor has also approved registered apprenticeship titles for the occupation, including cyber defense analyst and cybersecurity analyst.
Many employers prefer candidates who hold an information security certification. Some certifications are meant for entry-level workers and others for experienced information security workers, and certifications in specialized areas such as systems auditing also exist.
With experience, analysts may lead a team of other analysts or become experts in one area of information security. Some advance to chief security officer or another computer and information systems manager role.
Typical education
A bachelor's degree in a computer science field is typical, along with related work experience. Some employers prefer analysts who hold a professional certification.
Pay and Outlook
Figures are U.S. Bureau of Labor Statistics data for the occupation Information Security Analysts (O*NET-SOC 15-1212.00), which covers this role.
Certifications
20 certificationsThe DoD 8140 Qualification Matrix V2.1 lists 20 certifications as qualification options for DCWF work role 511 Cyber Defense Analyst, up to the proficiency level shown. Options aligned to a higher proficiency level also qualify for the lower levels.
| Certification | Issuer | DoD 8140 level |
|---|---|---|
| CBROPS Cisco Certified Network Associate Cybersecurity · Cisco | Cisco | Up to Advanced |
| CFR CyberSec First Responder · CertNexus | CertNexus | Up to Advanced |
| CySA+ CompTIA Cybersecurity Analyst · CompTIA | CompTIA | Up to Advanced |
| GCFA GIAC Certified Forensic Analyst · GIAC | GIAC | Up to Advanced |
| GCIA GIAC Certified Intrusion Analyst · GIAC | GIAC | Up to Advanced |
| GICSP Global Industrial Cyber Security Professional · GIAC | GIAC | Up to Advanced |
| CEH(P) Certified Ethical Hacker (Practical) · EC-Council | EC-Council | Up to Intermediate |
| Cloud+ CompTIA Cloud+ · CompTIA | CompTIA | Up to Intermediate |
| FITSP-O Federal IT Security Professional-Operator-NG · Federal IT Security Institute | Federal IT Security Institute | Up to Intermediate |
| GCED GIAC Certified Enterprise Defender · GIAC | GIAC | Up to Intermediate |
| GDSA GIAC Defensible Security Architect · GIAC | GIAC | Up to Intermediate |
| GMON GIAC Continuous Monitoring Certification · GIAC | GIAC | Up to Intermediate |
| GRID GIAC Response and Industrial Defense · GIAC | GIAC | Up to Intermediate |
| GSEC GIAC Security Essentials · GIAC | GIAC | Up to Intermediate |
| PenTest+ CompTIA PenTest+ · CompTIA | CompTIA | Up to Intermediate |
| Security+ CompTIA Security+ · CompTIA | CompTIA | Up to Intermediate |
| CC Certified in Cybersecurity · ISC2 | ISC2 | Up to Basic |
| CEH Certified Ethical Hacker · EC-Council | EC-Council | Up to Basic |
| GFACT GIAC Foundational Cybersecurity Technologies · GIAC | GIAC | Up to Basic |
| GISF GIAC Information Security Fundamentals · GIAC | GIAC | Up to Basic |
Frequently Asked Questions
What does a cybersecurity analyst do?→
A cybersecurity analyst monitors an organization's networks for security breaches and investigates them, checks systems for vulnerabilities, maintains protections such as firewalls and encryption, and reports on attempted attacks and breaches.
How much does a cybersecurity analyst make?→
BLS reports a median annual wage of $129,180 in May 2025 for information security analysts, the occupation that covers this role.
Is cybersecurity analyst an entry-level job?→
BLS lists a bachelor's degree as the typical entry-level education for information security analysts, with less than 5 years of work experience in a related occupation.
What is the job outlook for cybersecurity analysts?→
BLS projects employment of information security analysts to grow 21 percent from 2025 to 2035, with about 14,100 openings each year on average.
How do you become a cybersecurity analyst?→
The typical path is a bachelor's degree in computer and information technology or a related field, plus work experience in a related occupation, often as a network and computer systems administrator. Some workers enter with a high school diploma and relevant industry training and certifications.
What skills does a cybersecurity analyst need?→
BLS names analytical, communication, creative, and problem-solving skills, and attention to detail because attacks may be hard to detect. CISA lists knowledge of networking concepts and protocols, intrusion detection methods, and network traffic analysis, along with skill in packet-level analysis.
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. Certification options come from the DoD 8140 Qualification Matrix V2.1 (2025-09-19); the matrix and a specific job posting are the authority for a given position. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense. Last verified Oct 28, 2026.