The median cybersecurity salary in the U.S. hit $124,000 in 2025 — nearly double the national median for all occupations. But that number hides a massive spread: an entry-level SOC analyst in a mid-size city earns around $65,000, while a CISO at a Fortune 500 firm can clear $300,000. The difference almost always comes down to three things: your role, your certifications, and how long you've been doing it.
This guide breaks down cybersecurity salary ranges by role, shows which certifications actually move the number, and points you toward the fastest paths to the top of the pay scale.
Cybersecurity Salary by Job Title (2026 Data)
Not all cybersecurity jobs pay the same. "Cybersecurity" is a broad umbrella — the title on your business card matters more than the field itself.
Entry-Level Roles ($60K–$90K)
If you're starting out, expect to land in one of these:
- SOC Analyst (Tier 1/2): $62,000–$88,000. You're triaging alerts, running incident playbooks, and learning the tools. Most employers accept CompTIA Security+ here.
- IT Security Analyst: $68,000–$92,000. More generalist than a SOC role — policy, patching, basic vulnerability scans.
- Junior Penetration Tester: $70,000–$95,000. Hard to break into without a cert like CEH or OSCP, but the ceiling is much higher.
Mid-Level Roles ($95K–$140K)
- Penetration Tester / Ethical Hacker: $105,000–$145,000. OSCP or CEH typically required. Government contractors often pay a 15–20% premium.
- Cloud Security Engineer: $115,000–$155,000. The fastest-growing segment. AWS/Azure security certs plus CCSP command top dollar.
- Threat Intelligence Analyst: $98,000–$130,000. High demand from financial services and healthcare.
- Security Engineer: $110,000–$145,000. Builds and maintains security tooling — often a hybrid SWE + security background.
Senior & Leadership Roles ($140K–$300K+)
- Security Architect: $145,000–$195,000. Designs enterprise security programs. CISSP is nearly table stakes at this level.
- Director of Security / VP: $170,000–$240,000. Manages teams, owns the security roadmap, reports to C-suite.
- Chief Information Security Officer (CISO): $200,000–$350,000+. At large organizations, total comp (stock + bonus) often doubles base.
How Certifications Affect Cybersecurity Salary
Certifications are salary multipliers — but not all equally. A CompTIA Security+ will get you through the door. A CISSP or CISM can add $20,000–$40,000 to your annual salary compared to peers without it.
CompTIA Security+ (+$8K–$15K over uncertified)
The most widely required entry-level cert. Accepted by the DoD under Directive 8570, so it unlocks federal and government contractor roles that often pay more than comparable private sector jobs. If you're starting from zero, this is your first stop.
CEH (Certified Ethical Hacker) (+$10K–$20K)
The go-to cert for penetration testing roles. It's more recognized in enterprise hiring than OSCP, despite OSCP being more technically rigorous. Average CEH salary: $116,000.
CISSP (Certified Information Systems Security Professional) (+$20K–$40K)
Widely considered the gold standard for senior security professionals. Requires 5 years of experience and a 6-hour exam. Average CISSP salary: $141,000. Worth it for anyone targeting architect, director, or CISO roles.
CISM (Certified Information Security Manager) (+$15K–$35K)
ISACA's management-track cert. Beats CISSP in some financial and regulated industries where governance matters more than technical depth. Average CISM salary: $138,000.
CCSP (Certified Cloud Security Professional) (+$18K–$30K)
Cloud security is where the job growth is. CCSP holders average $140,000–$165,000, and demand is outpacing supply significantly.
Cybersecurity Salary by Location
Geography still matters significantly, even with remote work expanding access.
| Location | Median Cybersecurity Salary |
|---|---|
| San Francisco / Bay Area | $155,000–$185,000 |
| Washington D.C. / Northern Virginia | $130,000–$165,000 |
| New York City | $125,000–$160,000 |
| Seattle | $120,000–$155,000 |
| Austin / Dallas | $105,000–$140,000 |
| Chicago | $100,000–$135,000 |
| Remote (U.S.-based) | $100,000–$145,000 |
Northern Virginia (the "DMV" area) is worth calling out separately: it's home to the highest concentration of federal cybersecurity contracts in the country, and cleared (TS/SCI) roles routinely pay 20–30% above market rate for equivalent private sector work.
Top Courses to Boost Your Cybersecurity Salary
The fastest path to a higher cybersecurity salary is structured learning that leads directly to a cert or role. These courses are the ones worth your time.
Foundations of Cybersecurity — Coursera
Google's foundational cybersecurity course, ideal if you're pivoting from a non-technical background. It maps directly to the entry-level skills hiring managers look for in SOC analyst and IT security roles — the jobs that serve as the on-ramp to a six-figure cybersecurity salary.
Cybersecurity Assessment: CompTIA Security+ & CySA+ — Coursera
Covers both Security+ and CySA+ exam domains in one track, which is the fastest way to pass both exams and hit the pay floor for mid-level analyst roles. Getting both certs typically adds $15,000–$25,000 versus Security+ alone.
IBM and ISC2 Cybersecurity Specialist Professional Certificate — Coursera
Co-branded with ISC2 (the organization behind CISSP), this certificate aligns with ISC2's CC (Certified in Cybersecurity) exam — a free entry-level credential that's becoming a standard screening requirement. Strong for career changers who want institutional credibility fast.
Computer Science for Cybersecurity — edX
For those who want to move toward security engineering (the $115K–$145K mid-tier), understanding the CS fundamentals behind the attacks is essential. This course fills that gap if your background is in IT operations or business rather than software development.
Generative AI Cybersecurity & Privacy for Leaders — Coursera
AI is reshaping every security role — threat detection, phishing generation, vulnerability scanning. This specialization is valuable for anyone targeting senior or director roles, where understanding the AI threat surface is becoming a hiring differentiator that commands higher cybersecurity salary offers.
Cybersecurity for Business Specialization — Coursera
Bridges the gap between technical security knowledge and business communication — a skill that separates engineers who stay at $130K from those who move into security leadership at $180K+. Recommended for anyone 3–5 years into their cybersecurity career who's aiming at management.
FAQ
What is the average cybersecurity salary in the U.S.?
The BLS reports the median annual wage for information security analysts at $124,000 as of 2025. However, this median understates total compensation — many mid-to-senior roles include bonuses, equity, and benefits that push total comp 15–25% above base salary.
Can you make $200K in cybersecurity?
Yes, but it typically requires one of three paths: (1) a senior individual contributor role like Principal Security Engineer at a large tech company, (2) a security leadership position (Director, VP, CISO) at a mid-to-large organization, or (3) specialized consulting or contracting work in high-clearance federal roles. Most people hit $200K+ with 10–15 years of experience and at least one senior certification (CISSP, CISM, or CCSP).
Which cybersecurity certification has the highest salary?
CISSP consistently tops certification salary surveys, with average base pay around $141,000. CCSP follows closely at $140,000–$165,000. However, certifications amplify your experience — a CISSP with 10 years beats a CISSP with 3 years by $40,000+ in most salary surveys.
Is cybersecurity a good career for salary growth?
It's one of the best. The BLS projects 33% job growth through 2033 — much faster than average. Unlike some tech fields where salary growth plateaus, cybersecurity has a clear ladder from $65K entry level to $300K+ CISO, and each rung requires demonstrable skills that justify the pay jump.
How long does it take to reach a $100K cybersecurity salary?
With a relevant degree and Security+ cert, most people hit $85K–$100K within 2–3 years. Without a degree, it typically takes 3–5 years using a cert-first path (Security+ → CySA+ or CEH). Bootcamp graduates with strong portfolios have done it in 18 months, but that's the fast end of the distribution.
Do cybersecurity salaries differ between government and private sector?
Government base salaries are often lower than private sector equivalents, but cleared roles (Secret/TS/SCI) typically add 15–30% via clearance premiums, and total compensation including pension, health benefits, and stability makes government competitive. Contracting (working for a firm that contracts to government) often splits the difference — private sector pay with cleared work.
Bottom Line
A cybersecurity salary of $100,000+ is realistic within 3–5 years for most people who pursue it deliberately. The playbook is straightforward: start with CompTIA Security+ to break into the field, spend 2–3 years in an analyst or operations role, then branch into either the technical track (penetration testing, cloud security, security engineering) or the management track (CISM, CISO pathway) based on where your strengths are.
The certifications that genuinely move salary — CISSP, CCSP, CISM — are not beginner credentials. Stack them once you have 3–5 years of hands-on experience and you'll see the biggest return. If you're just starting, the Google Cybersecurity course and the Security+ & CySA+ track are the most direct routes to your first role.
The field is not slowing down. Every organization that runs software is a potential employer, and there's a documented shortage of 3.4 million cybersecurity professionals globally. That gap keeps salaries high and hiring competitive — in your favor.