# Information Security Analysts

US SOC code 15-1212. Markdown version of https://futurehistory.earth/timeline/15-1212

Also called: SOC analyst, Cybersecurity analyst, Security analyst, Infosec analyst, Cyber analyst.

## In brief

In May 2025, [BLS](https://www.bls.gov/oes/special-requests/oesm25nat.zip) counted **190,650** US information security analysts, with median pay of **$129,180** a year. Of the BLS counts since 2021, the May 2025 count is the highest. The earliest figure here is [an estimate](https://www.isc2.org/about) of **50,000** from 2000, not measured the same way as today's count. The last full technology era for information security analysts: Cloud-native security + supply-chain defense, 2020 to 2023.

## What the sources say

### Official outlook

BLS projects employment to grow 21% from 2025 to 2035. Source: [BLS Employment Projections 2025-35](https://data.bls.gov/projections/nationalMatrix?queryParams=15-1212&ioType=o).

### AI exposure studies

- **54.3%** of this job's tasks are exposed to large language models. Not a forecast of job losses. [Eloundou and others, 2023](https://github.com/openai/GPTs-are-GPTs/blob/main/data/occ_level.csv)

Data as of BLS OEWS May 2025; BLS Employment Projections 2025-35. BLS publishes these counts as yearly survey snapshots and cautions against reading them as a precise trend.

## Information Security Analysts employment and pay by year

- On record since: 1988
- Latest US employment: 190,650 (May 2025). Source: BLS OEWS May 2025 [2]
- Latest US median pay: $129,180 (May 2025). Source: BLS OEWS May 2025 [5]
- Outlook: +21% by 2035. Source: BLS Employment Projections 2025-35 [29]

### In other countries

The latest figure each country's statistics agency publishes for this job. Each uses its own occupation definition, survey basis and currency, so the numbers are not directly comparable with each other or with the US figures.

- **Canada** (NOC 21220)
  - Employment, 2020: 14,095. Source: Statistics Canada Census 2021 [3]. Statistics Canada Census of Population 2021: number of persons with employment income in NOC 21220 Cybersecurity specialists, Canada, reference year 2020. A recipients basis (anyone with employment income during the year), slightly broader than a point-in-time employed count. Statistics Canada Open Licence.
  - Median pay, 2020: C$98,000. Source: Statistics Canada Census 2021 [6]. Statistics Canada Census of Population 2021 (Table 98-10-0586): median employment income for NOC 21220 Cybersecurity specialists, Canada, reference year 2020, full-year full-time workers (the basis comparable to the US OEWS full-time median). Statistics Canada Open Licence.

### All 8 years of cited US data

| Year | US employment | Annual pay (median unless marked) | Source |
| --- | --- | --- | --- |
| 2000 | 50,000 (estimate) | n/a | Est., ISC2 [1] |
| 2019 | 125,570 | $99,730 | BLS OEWS May 2019 (employment) [2]; BLS OEWS May 2019 (pay) [4] |
| 2020 | 138,000 | $103,590 | BLS OEWS May 2020 [2] |
| 2021 | 157,220 | $102,600 | BLS OEWS May 2021 [2] |
| 2022 | 163,690 | $112,000 | BLS OEWS May 2022 (employment) [2]; BLS OEWS May 2022 (pay) [4] |
| 2023 | 175,350 | $120,360 | BLS OEWS May 2023 [2] |
| 2024 | 179,430 | $124,910 | BLS OEWS May 2024 [2] |
| 2025 | 190,650 | $129,180 | BLS OEWS May 2025 [2] |

## Sources (65)

### Employment series

1. [ISC2 — History and founding context; cybersecurity workforce estimates circa 2000 (secondary)](https://www.isc2.org/about), ISC2
2. BLS OEWS, national cross-industry estimates (flat file), Bureau of Labor Statistics. Editions: [2019](https://www.bls.gov/oes/special-requests/oesm19nat.zip), [2020](https://www.bls.gov/oes/special-requests/oesm20nat.zip), [2021](https://www.bls.gov/oes/special-requests/oesm21nat.zip), [2022](https://www.bls.gov/oes/special-requests/oesm22nat.zip), [2023](https://www.bls.gov/oes/special-requests/oesm23nat.zip), [2024](https://www.bls.gov/oes/special-requests/oesm24nat.zip), [2025](https://www.bls.gov/oes/special-requests/oesm25nat.zip)
3. [Statistics Canada, Census of Population 2021, Table 98-10-0586 (Employment income statistics by occupation unit group, NOC 2021), income reference year 2020](https://www150.statcan.gc.ca/t1/tbl1/en/tv.action?pid=9810058601), Statistics Canada

### Wage series

4. [BLS OEWS May 2019 — 15-1212 Information Security Analysts median annual wage](https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm), Bureau of Labor Statistics
5. BLS OEWS, national cross-industry estimates (flat file), Bureau of Labor Statistics. Editions: [2020](https://www.bls.gov/oes/special-requests/oesm20nat.zip), [2021](https://www.bls.gov/oes/special-requests/oesm21nat.zip), [2023](https://www.bls.gov/oes/special-requests/oesm23nat.zip), [2024](https://www.bls.gov/oes/special-requests/oesm24nat.zip), [2025](https://www.bls.gov/oes/special-requests/oesm25nat.zip)
6. [Statistics Canada, Census of Population 2021, Table 98-10-0586 (Employment income statistics by occupation unit group, NOC 2021), income reference year 2020](https://www150.statcan.gc.ca/t1/tbl1/en/tv.action?pid=9810058601), Statistics Canada

### Tool eras

7. [Anderson Report (1972) — "Computer Security Technology Planning Study," USAF ESD-TR-73-51 (DTIC AD0758206)](https://apps.dtic.mil/sti/citations/AD0758206), US Air Force / Defense Technical Information Center
8. [Wikipedia — Computer security (historical overview)](https://en.wikipedia.org/wiki/Computer_security), Wikipedia
9. [Wikipedia — McAfee (founding and VirusScan, 1987)](https://en.wikipedia.org/wiki/McAfee), Wikipedia
10. [Wikipedia — Morris Worm (1988)](https://en.wikipedia.org/wiki/Morris_worm), Wikipedia
11. [Wikipedia — Firewall (computing) — DEC SEAL as first commercial firewall, 1989](https://en.wikipedia.org/wiki/Firewall_%28computing%29), Wikipedia
12. [Wikipedia — Transport Layer Security (SSL/TLS history)](https://en.wikipedia.org/wiki/Transport_Layer_Security), Wikipedia
13. [Wikipedia — Snort (software) — released 1998, Martin Roesch](https://en.wikipedia.org/wiki/Snort_%28software%29), Wikipedia
14. [Wikipedia — Sarbanes-Oxley Act (2002) — mandated IT internal controls audit](https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act), Wikipedia
15. [IBM — QRadar SIEM product page (successor to Q1 Labs QRadar, originally released 2001)](https://www.ibm.com/products/qradar-siem), IBM
16. [Wikipedia — Splunk (founded 2003)](https://en.wikipedia.org/wiki/Splunk), Wikipedia
17. [Wikipedia — Stuxnet (discovered 2010)](https://en.wikipedia.org/wiki/Stuxnet), Wikipedia
18. [Mandiant — APT1: Exposing One of China's Cyber Espionage Units (February 2013)](https://www.mandiant.com/resources/reports/apt1-exposing-one-of-chinas-cyber-espionage-units), Mandiant
19. [Wikipedia — CrowdStrike (founded 2011, Falcon EDR)](https://en.wikipedia.org/wiki/CrowdStrike), Wikipedia
20. [Gartner — Security Orchestration, Automation and Response (SOAR) market definition](https://www.gartner.com/en/information-technology/glossary/security-orchestration-automation-and-response-soar), Gartner
21. [Wikipedia — WannaCry ransomware attack (May 2017)](https://en.wikipedia.org/wiki/WannaCry_ransomware_attack), Wikipedia
22. [Wikipedia — LockBit (ransomware-as-a-service, 2019)](https://en.wikipedia.org/wiki/LockBit), Wikipedia
23. [Wikipedia — 2020 United States federal government data breach (SolarWinds supply chain attack, December 2020)](https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach), Wikipedia
24. [Wiz — Cloud Security Posture Management (CSPM) product overview](https://www.wiz.io), Wiz
25. [CrowdStrike Charlotte AI — 40+ hrs/week triage savings, 70% investigation effort reduction](https://www.crowdstrike.com/en-us/platform/charlotte-ai/), CrowdStrike
26. [Microsoft Security Copilot — general availability April 2024](https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot), Microsoft
27. [ISC2 2025 Cybersecurity Workforce Study — AI adoption, skills gaps, 4.8M workforce gap](https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study), ISC2
28. [Mandiant M-Trends 2026 — initial access handoff collapsed to 22 seconds in 2025](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026), Mandiant / Google

### Forecasts and exposure studies

29. [BLS Employment Projections 2025-35, National Employment Matrix: 15-1212 Information security analysts (2025: 192.9 thousand; 2035: 233.4 thousand; +21.0%)](https://data.bls.gov/projections/nationalMatrix?queryParams=15-1212&ioType=o), Bureau of Labor Statistics
30. [Eloundou, Manning, Mishkin & Rock (2023), "GPTs are GPTs", occupation-level exposure data occ\_level.csv (O\*NET-SOC 15-1212.00, human-rated β 0.543)](https://github.com/openai/GPTs-are-GPTs/blob/main/data/occ_level.csv), OpenAI

### Historical notes

31. [Anderson Report (1972) — "Computer Security Technology Planning Study," USAF ESD-TR-73-51 (DTIC AD0758206)](https://apps.dtic.mil/sti/citations/AD0758206), US Air Force / Defense Technical Information Center
32. [ACM — "Reflections on Trusting Trust," Communications of the ACM, Vol. 27, No. 8 (August 1984)](https://dl.acm.org/doi/10.1145/358198.358210), ACM
33. [ISC2 — About ISC2 (founding history)](https://www.isc2.org/about), ISC2
34. [Wikipedia — Morris Worm (1988)](https://en.wikipedia.org/wiki/Morris_worm), Wikipedia
35. [Wikipedia — Sarbanes-Oxley Act (2002)](https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act), Wikipedia
36. [Wikipedia — Stuxnet](https://en.wikipedia.org/wiki/Stuxnet), Wikipedia
37. [Mandiant — APT1 Report (February 2013)](https://www.mandiant.com/resources/reports/apt1-exposing-one-of-chinas-cyber-espionage-units), Mandiant
38. [BLS — 2018 Standard Occupational Classification](https://www.bls.gov/soc/2018/major_groups.htm), Bureau of Labor Statistics
39. [Wikipedia — 2020 United States federal government data breach (SolarWinds supply chain attack)](https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach), Wikipedia
40. [DARPA — AI Cyber Challenge (AIxCC) overview](https://aicyberchallenge.com), DARPA

### Predecessors & successors

41. [BLS OOH — Network and Computer Systems Administrators (15-1244), successor to the 2010 SOC 15-1071 category that blended network-ops and security work](https://www.bls.gov/ooh/computer-and-information-technology/network-and-computer-systems-administrators.htm), Bureau of Labor Statistics
42. [Wikipedia — Computer security (history section) — early security personnel were often programmers seconded into security roles](https://en.wikipedia.org/wiki/Computer_security), Wikipedia
43. [NSA — Information Assurance Directorate history; career-transition pipelines from military SIGINT to civilian infosec roles](https://www.nsa.gov/about/history/), NSA

### Present-day analysis

- [O\*NET 30.3 — Information Security Analysts (15-1212.00)](https://www.onetonline.org/link/summary/15-1212.00), accessed 2026-05-23
- [ISC2 2025 Cybersecurity Workforce Study — AI adoption, skills gaps, workforce shortage](https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study), accessed 2026-05-23
- [CrowdStrike Charlotte AI — 40+ hrs/week triage savings, 70% investigation effort reduction](https://www.crowdstrike.com/en-us/platform/charlotte-ai/), accessed 2026-05-23
- [Palo Alto Networks — 2025: Year of the Autonomous SOC, XSIAM cuts manual work 75%](https://www.paloaltonetworks.com/blog/security-operations/2025-the-year-of-the-autonomous-soc-the-year-of-xsiam/), accessed 2026-05-23
- [Microsoft Security Copilot — Security Analyst Agent, deep multi-step investigations](https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot), accessed 2026-05-23
- [Mandiant M-Trends 2026 — Frontline incident investigation data, advanced persistent threat trends](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026), accessed 2026-05-23
- [Eloundou et al. 2024 — GPTs are GPTs (Science)](https://arxiv.org/abs/2303.10130), accessed 2026-05-23
- [Dropzone AI — SOC Analyst Career Path & Salary Guide 2026 (AI-assisted investigations 45% faster)](https://www.dropzone.ai/resource-guide/soc-analyst-career-path-salary-guide-2026-ai-powered-edition), accessed 2026-05-23
- [Microsoft — Security Copilot Security Analyst Agent conducts deep multi-step investigations across Sentinel telemetry](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/security-copilot-in-defender-empowering-the-soc-with-assistive-and-autonomous-ai/4503047), accessed 2026-05-23
- [Splunk Enterprise Security 8.2 — Triage Agent evaluates, prioritizes, and explains alerts](https://www.thefastmode.com/technology-solutions/44515-splunk-enterprise-security-8-2-gets-agentic-ai-features-for-faster-threat-detection-response), accessed 2026-05-23
- [Wiz SecOps Agent — automatically investigates threats, delivers AI-driven verdicts, each with full investigation trail](https://www.wiz.io/blog/wizdom-product-launches-2025), accessed 2026-05-23
- [Tenable VPR reduces actionable patch list by 40–50% vs. raw CVSS sorting](https://www.luniq.io/en/resources/blog/qualys-vs-tenable-vs-rapid7-best-vulnerability-scanner-for-engineering-firms-in-2026), accessed 2026-05-23

How to read these figures: https://futurehistory.earth/methodology. Every figure links to its own source; gaps stay gaps.