Time Machine

Information security analysts

Name: Information Security Analysts: employment and wages since 2000
Creator: Future History
License: https://futurehistory.earth/terms

Also called SOC analyst, Cybersecurity analyst, Security analyst, Infosec analyst, Cyber analyst

In brief

In May 2025, BLS counted 190,650 US information security analysts, with median pay of $129,180 a year. Of the BLS counts since 2021, the May 2025 count is the highest. The earliest figure here is an estimate of 50,000 from 2000, not measured the same way as today's count. The last full technology era for information security analysts: Cloud-native security + supply-chain defense, 2020 to 2023.

What the sources say

Official outlook

BLS projects employment to grow 21% from 2025 to 2035.

BLS Employment Projections 2025-35

AI exposure studies

54.3% of this job's tasks are exposed to large language models. Not a forecast of job losses. Eloundou and others, 2023

Data as of BLS OEWS May 2025; BLS Employment Projections 2025-35. BLS publishes these counts as yearly survey snapshots and cautions against reading them as a precise trend.

Last updated 11 October 2026.

Cite this page

APA

Future History. (2026, October 11). Information security analysts: jobs and pay since 2000 [Data set; data as of BLS OEWS May 2025; BLS Employment Projections 2025-35]. https://futurehistory.earth/timeline/15-1212

Chicago

Future History. "Information security analysts: jobs and pay since 2000." Data as of BLS OEWS May 2025; BLS Employment Projections 2025-35. Last modified October 11, 2026. https://futurehistory.earth/timeline/15-1212.

BibTeX

@misc{futurehistory_15_1212, author = {{Future History}}, title = {Information security analysts: jobs and pay since 2000}, year = {2026}, month = oct, howpublished = {\url{https://futurehistory.earth/timeline/15-1212}}, note = {Last updated 2026-10-11. Data as of BLS OEWS May 2025; BLS Employment Projections 2025-35}, }

The access date is today's date on your device.

drag to travel through time

2000now

Country

US Employment

191K

Est.

Stated in source: BLS OEWS

Official statistic

Report an error

Median Annual Wage

$129,180

≈ $125,868 in 2024 prices (derived by us, CPI-adjusted)

Official statistic

Report an error

Beat · 1972

The Anderson Report, "Computer Security Technology Planning Study," published by the US Air Force Electronic Systems Division, is the founding document of computer security as a discipline. It introduced the concepts of penetration testing, reference monitor, and the threat taxonomy (masquerader, clandestine user, authorized user misuse) that practitioners still use.

Beat · 1983

Ken Thompson's Turing Award lecture, "Reflections on Trusting Trust," demonstrates that a compiler can be modified to insert a backdoor into any program it compiles, including a modified version of itself, making the attack invisible to source-code review. Still cited in every supply-chain security discussion 40 years later.

Beat · 1988

(ISC)², the International Information System Security Certification Consortium, is founded, the same year as the Morris Worm. The organization develops the CISSP (Certified Information Systems Security Professional) certification, first administered in 1994, which becomes the primary credential for senior information security roles globally.

Beat · 1988

Robert Tappan Morris's worm, the first internet worm, infects approximately 6,000 machines, roughly 10% of the ARPANET, in November 1988. The CERT Coordination Center is established at Carnegie Mellon within months as the first formal institution for coordinated computer security incident response. Morris is convicted under the Computer Fraud and Abuse Act (1986) in 1989: the first such conviction.

Beat · 2002

The Sarbanes-Oxley Act (SOX), signed July 30, 2002, requires public companies to establish, document, and audit internal controls over financial reporting, including IT controls. Section 404 mandates annual management assessment and external auditor attestation. SOX is the single regulatory event most frequently cited by practitioners as the catalyst for first-wave corporate information security hiring.

Beat · 2010

Stuxnet is publicly disclosed. The first cyberweapon known to cause physical damage to industrial infrastructure, Stuxnet targeted Iranian uranium enrichment centrifuges operated by Siemens PLCs. Its discovery established the concept of "nation-state grade adversaries" as a category information security teams must be prepared for, not just financially-motivated criminals.

Beat · 2013

Mandiant publishes APT1: Exposing One of China's Cyber Espionage Units (February 2013), the first major public attribution of sustained state-sponsored industrial espionage to a specific military unit (Comment Crew / Unit 61398 of the People's Liberation Army). The report documents 141 victim organizations across 20 industries and 7 years of intrusion activity. The Snowden disclosures follow in June, permanently reframing public understanding of the scope of state-level surveillance.

Beat · 2018

BLS 2018 SOC revision establishes 15-1212 as a dedicated code for Information Security Analysts, splitting the prior 15-1122 combined category (which had blended security analysts with web developers and computer network architects since 2010). The split gives the profession its own clean statistical series for the first time.

Beat · 2020

SolarWinds supply-chain compromise (disclosed December 2020): attackers inserted malicious code into SolarWinds Orion software updates, reaching 18,000 customers including the US Treasury, State Department, and nine other federal agencies. The breach was active for months before discovery. The incident permanently elevated software supply-chain security from a theoretical concern to a budget line item.

Beat · 2024

DARPA launches the AI Cyber Challenge (AIxCC) at DEF CON 2024, a $20 million competition for AI systems that can autonomously find and fix software vulnerabilities. Seven finalists compete at DEF CON 32 in August 2024. The challenge marks the first government-sponsored public test of fully autonomous offensive and defensive security AI at competition scale.

How to read this number

OEWS is a point-in-time survey snapshot, not a continuous time series; BLS advises against using it for year-over-year trend comparison.

Each dot is a cited figure over time; the dotted line only links them (values between aren't measured). Hollow dots are estimates.

Official statistic: Copied by a script from a statistics agency table or a published study's table, not retyped by hand. BLS figures and the forecast and exposure tables are also re-checked against that table on every data run. Researched context: Researched from the cited source rather than copied from it by a script, so it is not machine-checked yet. Spot a mistake? Each figure has a “Report an error” link.

How it began · 1988

On the evening of November 2, 1988, a graduate student named Robert Tappan Morris released a program from an MIT terminal that was meant, he later said, to do nothing more than measure the size of the internet. Within hours it had crashed an estimated 6,000 machines, roughly ten percent of every computer connected to the ARPANET at the time, and the engineers watching it happen had no name for what they were fighting, no playbook for how to stop it, and no organizational structure that assigned anyone the job of trying. Clifford Stoll at Lawrence Berkeley National Lab had published a prescient account in the Communications of the ACM just one year earlier, describing how he'd tracked a West German hacker through LBL's systems to a KGB contact, but Stoll was a lone astronomer acting on instinct, not a security professional. The Morris Worm changed that. Within months the CERT Coordination Center was established at Carnegie Mellon, funded by DARPA, as the first formal institution tasked with coordinating the response to internet-borne attacks. The federal government already had a framework (the 1972 Anderson Report from the Air Force Electronic Systems Division had laid out the first formal taxonomy of computer security threats, and the 1977 Federal Information Processing Standards had mandated DES encryption) but those were policy documents, not job descriptions. What the Morris Worm created was a felt urgency. Corporate IT departments that had previously tasked a network administrator with 'also keep an eye on security' began posting dedicated positions. The (ISC)² credentialing body, founded in 1988, the same year as the worm, started developing what would become the CISSP certification, formalizing the profession's claim to a distinct body of knowledge. By 1995, when RSA Security hosted the first RSA Conference and Netscape introduced SSL, the role had a name, an industry, and a market. The information security analyst was not born in 1988, but 1988 is when the emergency made the position unavoidable.

Cited forecasts · present → 2035

Will AI replace information security analysts? What the research says

Each figure is stated by the named source; we publish no forecasts of our own. Where sources disagree, we show the disagreement rather than an average.

Each figure is stated by the named source; we publish no forecasts of our own. Where sources disagree, the spread is the honest signal.

What published forecasts say

Forecast change in the number of people doing this work, as published by each named source. Bars share one scale on every role, centred on zero and reaching the end at ±30%. Grey marks a small change, 3% or less either way.

BLS Employment Projections 2025-35

→ 2035

+21%

BLS National Employment Matrix, 2025-35 cycle, line for SOC 15-1212 (Information security analysts): 192.9 thousand jobs in 2025, projected 233.4 thousand in 2035, a change of +40.6 thousand (+21.0%). Matrix employment counts all jobs in the occupation, including self-employed workers (0.2% of this occupation in 2025). The average for all occupations in this cycle is +3.5%.

Official statisticReport an error

How exposed is this work to AI (research measures)

Scores as published by each study. Each row says what it measures. These measure what AI could technically do, not forecasts of jobs lost.

Eloundou et al. (2023), "GPTs are GPTs"

2023 study · Share of tasks exposed to LLMs (β, human-rated)

54.3%

of tasks

What this measures

Published occupation-level exposure from the paper's occ_level.csv for O*NET-SOC 15-1212.00 Information Security Analysts. Shown: human-rated β = 0.543, the share of the occupation's tasks an LLM could do in at least half the time at equal quality, counting tasks that need LLM-powered software at half weight (β = E1 + 0.5 × E2). Other published measures for this occupation: human-rated α (LLM alone) 0.087 and γ (all LLM-assisted) 1; GPT-4-rated β 0.652. This measures how much of the work an LLM could touch, not how many jobs disappear.

Official statisticReport an error

Today, in this role

What's changing day to day for information security analysts

Three parts of your work where AI is already doing real lifting, and what stays yours.

AI is sitting alongside you hereReview AI-prioritized SIEM alert queues in Microsoft Sentinel or Splunk Enterprise Security, validating triage decisions made by the AI agent, escalating confirmed incidents, and closing false positives with documented rationale.

Review AI-prioritized SIEM alert queues in Microsoft Sentinel or Splunk Enterprise Security, validating triage decisions made by the AI agent, escalating confirmed incidents, and closing false positives with documented rationale.^[9],[10],[8]

Tools picking this up

Microsoft Security Copilot ↗Splunk Enterprise Security ↗CrowdStrike Charlotte AI ↗

Where your edge is

Build fluency in prompt-driven investigation: learn to ask the right natural-language questions inside Security Copilot and Charlotte AI to surface context the AI surface didn't show, and develop a disciplined false-positive taxonomy so you can tune alert logic over time.

AI is sitting alongside you hereMonitor cloud security posture using CSPM tools (Wiz, Orca, Prisma Cloud), reviewing AI-generated risk scores for misconfigured resources, enforcing compliance guardrails, and coordinating with DevOps to fix issues before they reach production.

Monitor cloud security posture using CSPM tools (Wiz, Orca, Prisma Cloud), reviewing AI-generated risk scores for misconfigured resources, enforcing compliance guardrails, and coordinating with DevOps to fix issues before they reach production.^[11],[2]

Tools picking this up

Wiz ↗

Where your edge is

Earn cloud-platform depth beyond the CSPM dashboard: understand the IAM, networking, and data-plane fundamentals behind the findings so you can distinguish critical-path misconfigurations from lower-priority hygiene issues that AI over-weights.

AI is sitting alongside you hereManage vulnerability backlogs using AI-assisted risk scoring, reviewing Tenable or Wiz findings ranked by real-world exploitability, coordinating patch prioritization with engineering teams, and tracking remediation SLAs.

Manage vulnerability backlogs using AI-assisted risk scoring, reviewing Tenable or Wiz findings ranked by real-world exploitability, coordinating patch prioritization with engineering teams, and tracking remediation SLAs.^[12],[11]

Tools picking this up

Wiz ↗Tenable One ↗

Where your edge is

Go beyond raw CVSS scores: learn to interrogate AI-generated exploitability ratings using threat intelligence context (active exploitation in the wild, asset criticality, blast radius) so you own the remediation priority decision rather than rubber-stamp the scanner output.

Where information security analysts go next

Natural next steps for someone with your foundation: not exits, evolutions.

Computer and Information Systems Managers
US median pay
$175,140 (May 2025)
BLS outlook 2025-35
+15.8%
Information Security EngineersNo timeline for this role yet
Computer Systems Engineers/ArchitectsNo timeline for this role yet

What each move takes

A direction you could grow

Computer and Information Systems Managers

Senior security analysts who build credibility with executive stakeholders during incident response and risk briefings often move into security management or CISO-track roles. The 2026 market shows rising demand for security managers who can set AI-tool adoption strategy, manage vendor relationships for agentic SOC platforms, and translate technical risk into board-level language.

What you'd add

· Security program governance: CISO-track skills, board reporting, security metrics and KPIs

ISACACertification· advanced

Certified Information Security Manager (CISM) ↗

$760

· AI tool adoption strategy: evaluating CrowdStrike Charlotte AI, Cortex XSIAM, and Security Copilot for SOC ROI

MIT Sloan School of ManagementCourse· advanced

AI Strategy for Business Leaders (Executive Education) ↗

$3200· 30 hrs

· Budget management: headcount planning, security tooling licensing, vendor negotiations

FinOps FoundationCertification· intermediate

FinOps Certified Practitioner (FOCP) ↗

$500· 20 hrs

· CISM or CISSP-ISSMP certification for management credibility

(ISC)²Certification· advanced

Certified Information Systems Security Professional (CISSP) ↗

$749

· Regulatory and compliance fluency: SOC 2, ISO 27001, DORA, NIST AI RMF

ServiceNowDocs· intermediate

ServiceNow GRC — Product Documentation and Learning ↗

Free

COSO / IIACertification· intermediate

COSO Enterprise Risk Management Certificate Program ↗

$1375· 13.5 hrs

What it takesA real upskill, but a natural one

Tools of the era

How has the work of information security analysts changed since 1972?

The tools that defined the work, one line per era. Select an era to see how it reshaped the work.

Physical access controls + mainframe password systems
The first generation of computer security was about physical locks and logical access codes. Mainframe security meant controlling who could sit at a terminal, enforcing password policies, and auditing access logs printed on greenbar paper. The 1972 Air Force Anderson Report formalized this era's threat taxonomy: the "threat monitoring" paradigm, where security meant watching access and audit trails rather than the network perimeter that did not yet exist.
First commercial antivirus (McAfee VirusScan, 1987) + first firewalls
The Brain virus (1986) and the Morris Worm (1988) made antivirus software and network perimeter defense into commercial products. John McAfee released VirusScan as shareware in 1987; G Data released the first commercial antivirus in the same year. DEC SEAL (1989) is widely cited as the first commercial firewall. This era created the "antivirus + firewall" two-layer security model that would dominate corporate IT for the next two decades and produced the first dedicated security product vendors.
Effect on the work
The Morris Worm response directly created the CERT Coordination Center at Carnegie Mellon (1988), the first institutional role for coordinated security response, and the (ISC)² credentialing body (also 1988), which would certify the profession's first specialists.
SSL/TLS + PKI + IDS (Snort, 1998)
The browser era forced a new layer onto the security stack: cryptographic authentication for public internet transactions. Netscape's SSL 2.0 (1995) and its successor TLS (RFC 2246, 1999) created the certificate authority industry. Simultaneously, Martin Roesch released Snort in 1998: an open-source network intrusion detection system that would become the most widely deployed IDS in the world and the foundation of a generation of security analysts's monitoring workflows.
SIEM (QRadar 2001, Splunk 2003) + compliance-driven security
September 11, 2001 triggered a cascade of federal security legislation (the USA PATRIOT Act, FISMA 2002, Homeland Security Act 2002) that mandated formal security programs across government contractors and financial institutions. The Sarbanes-Oxley Act (2002) required public companies to document and audit IT controls. These compliance mandates created demand for information security professionals at organizations that had never hired one. Q1 Labs released QRadar in 2001; Splunk was founded in 2003. The SIEM category, Security Information and Event Management, gave analysts their first unified log-aggregation and correlation platform.
Effect on the work
SOX compliance (2002) is widely credited with driving a first wave of corporate security hiring. Many organizations hired their first dedicated information security analyst specifically to satisfy SOX audit requirements.
APT-era defense (Stuxnet 2010 → Mandiant APT1 report 2013)
Stuxnet (discovered June 2010) was the first publicly known cyberweapon designed to cause physical damage to industrial infrastructure: a joint US-Israeli operation targeting Iranian uranium centrifuges. It changed what the information security profession understood itself to be defending against. The Mandiant APT1 report (February 2013) publicly attributed a sustained campaign against more than a hundred US organizations to a specific unit of the Chinese People's Liberation Army: the first major public attribution of state-sponsored industrial espionage. Together these events created the "advanced persistent threat" (APT) category, gave analysts new threat intelligence frameworks (kill-chain, diamond model), and drove demand for threat hunters as distinct from perimeter monitors.
SOAR + EDR/XDR (Phantom 2014, CrowdStrike Falcon 2013)
The volume of security alerts grew faster than analyst headcount. Security Orchestration, Automation, and Response (SOAR) platforms (Phantom [2014], Demisto [2016], both eventually acquired by Splunk and Palo Alto) automated repetitive enrichment and response workflows so analysts could focus on genuine decisions. CrowdStrike launched in 2011 and its Falcon endpoint detection and response platform reached mainstream enterprise adoption around 2016-18, replacing signature-based antivirus with behavioral detection. The analyst role shifted from "watching logs" to "investigating behavioral detections and tuning automated playbooks."
Ransomware as a service (WannaCry 2017, LockBit 2019)
WannaCry (May 2017) and NotPetya (June 2017) paralyzed global logistics at Maersk, FedEx, and the UK National Health Service: organizations that had not thought of themselves as high-value targets. These were not sophisticated APT campaigns; they were opportunistic ransomware spread via an NSA-developed exploit, EternalBlue, leaked by the Shadow Brokers. Ransomware-as-a-service platforms (REvil, LockBit from 2019 onward) industrialized the attack model, making destructive intrusions accessible to organized criminal groups. Every mid-market company became a potential victim, and every mid-market company that had deferred security hiring reconsidered.
Effect on the work
The ransomware era (2017-2022) is the clearest driver of the 125,570 (2019) → 163,690 (2022) employment surge. ISC2's workforce gap estimates doubled during this period as insurance carriers began requiring documented security programs for cyber-liability coverage.
Cloud-native security (CSPM, CNAPP) + supply-chain defense
The SolarWinds breach (December 2020) (in which attackers compromised a software update mechanism used by thousands of organizations including nine US federal agencies) demonstrated that traditional perimeter defense was structurally inadequate against software supply-chain attacks. Cloud Security Posture Management (CSPM) tools (Wiz, Orca, Prisma Cloud) emerged as the primary tool class for securing cloud infrastructure. The analyst role acquired a new vocabulary: IAM misconfiguration, cloud workload protection, shift-left security, software composition analysis. The former "network security analyst" was expected to know AWS IAM as fluently as they had once known firewall ACLs.
AI-augmented SOC (CrowdStrike Charlotte AI, Microsoft Security Copilot 2024)
CrowdStrike announced Charlotte AI at the RSA Conference in April 2023; Microsoft Security Copilot reached general availability in April 2024, integrated into Defender and Sentinel. Both products changed the analyst's daily workflow in the same direction: AI handles Tier-1 alert triage (enrichment, correlation, false-positive filtering) and the analyst reviews AI-generated findings rather than raw log data. CrowdStrike claimed Charlotte AI saved analysts many hours per week on average and reduced investigation effort by 70%. Palo Alto's XSIAM platform reported 75% reduction in manual SOC work. At the same time, AI-enabled attackers grew faster: Mandiant's M-Trends 2026 report found attacker initial-access-to-lateral-movement time had collapsed to seconds in documented 2025 incidents. The arms race accelerated on both sides simultaneously.
Effect on the work
ISC2 2025 Cybersecurity Workforce Study: most practitioners believe AI creates MORE demand for specialized cyber skills; global workforce gap estimated at 4.8 million unfilled positions. The productivity gains from AI are being absorbed by a larger attack surface, not a smaller workforce.

Part of Tech & Data · see all 28 roles →

Different role?

See the same long-arc view for your own profession.

Browse the directory by industry, or search by title or SOC code.

Browse all roles

Information Security Analysts employment and pay by year

On record since1988

Latest US employment190,650 (May 2025)Source: BLS OEWS May 2025Official statisticReport an error

Latest US median pay$129,180 (May 2025)Source: BLS OEWS May 2025Official statisticReport an error

Outlook+21% by 2035Source: BLS Employment Projections 2025-35Official statisticReport an error

In other countries

The latest figure each country's statistics agency publishes for this job. Each uses its own occupation definition, survey basis and currency, so the numbers are not directly comparable with each other or with the US figures.

Canada (NOC 21220)
Employment, 2020
14,095, Statistics Canada Census 2021 Official statistic Report an errorStatistics Canada Census of Population 2021: number of persons with employment income in NOC 21220 Cybersecurity specialists, Canada, reference year 2020. A recipients basis (anyone with employment income during the year), slightly broader than a point-in-time employed count. Statistics Canada Open Licence.
Median pay, 2020
C$98,000, Statistics Canada Census 2021 Official statistic Report an errorStatistics Canada Census of Population 2021 (Table 98-10-0586): median employment income for NOC 21220 Cybersecurity specialists, Canada, reference year 2020, full-year full-time workers (the basis comparable to the US OEWS full-time median). Statistics Canada Open Licence.

View all 8 years of cited US data, each linked to its source

Year	US employment	Annual pay (median unless marked)	Source	Report
2000	50,000	n/a	Est., ISC2 Researched context	Report
2019	125,570	$99,730	BLS OEWS May 2019 (employment) Official statisticBLS OEWS May 2019 (pay) Official statistic	Report
2020	138,000	$103,590	BLS OEWS May 2020 Official statistic	Report
2021	157,220	$102,600	BLS OEWS May 2021 Official statistic	Report
2022	163,690	$112,000	BLS OEWS May 2022 (employment) Official statisticBLS OEWS May 2022 (pay) Official statistic	Report
2023	175,350	$120,360	BLS OEWS May 2023 Official statistic	Report
2024	179,430	$124,910	BLS OEWS May 2024 Official statistic	Report
2025	190,650	$129,180	BLS OEWS May 2025 Official statistic	Report

Embed this timeline on your site

Free for any site. Paste this where the timeline should appear; it stays interactive, every datapoint stays cited, and it sets no cookies on your page. How embedding works

<iframe src="https://futurehistory.earth/embed/15-1212"
  width="100%" height="430" style="border:0"
  title="Information Security Analysts, a Future History timeline"
  loading="lazy"></iframe>
<p style="font-size:13px;margin:4px 0 0"><a href="https://futurehistory.earth/timeline/15-1212">Information Security Analysts: jobs and pay over time</a>, from Future History</p>

See all roles in Tech & Data

Where information security analysts go next

Computer and Information Systems Managers

Physical access controls + mainframe password systemsPhysical access controls + mainframe pa…1972–1988

First commercial antivirus (McAfee VirusScan, 1987) + first firewallsFirst commercial antivirus1987–1995

SSL/TLS + PKI + IDS (Snort, 1998)SSL/TLS + PKI + IDS1995–2001

SIEM (QRadar 2001, Splunk 2003) + compliance-driven securitySIEM2001–2010

APT-era defense (Stuxnet 2010 → Mandiant APT1 report 2013)APT-era defense2010–2016

SOAR + EDR/XDR (Phantom 2014, CrowdStrike Falcon 2013)SOAR + EDR/XDR2014–2020

Ransomware as a service (WannaCry 2017, LockBit 2019)Ransomware as a service2017–2022

Cloud-native security (CSPM, CNAPP) + supply-chain defenseCloud-native security2020–2023

AI-augmented SOC (CrowdStrike Charlotte AI, Microsoft Security Copilot 2024)AI-augmented SOC2023–present

Information Security Analysts employment and pay by year

In other countries

More in Tech & Data