Cybersecurity Salary in the US 2026: What Every Role Actually Pays

Cybersecurity Salary in the US is one of those searches that leaves you more confused than when you started. One site says $99,400. Another says $127,928. A third throws out $135,969 like it’s obvious. You’re not wrong to be frustrated. You just want to know if your offer is fair, and nobody’s giving you a straight answer.

Here’s the real problem. Most articles quote one platform, one number, and call it a day. That’s not research, that’s a guess dressed up as data. And if you’re about to negotiate an offer or decide whether a career switch is worth it, a guess can cost you thousands.

So I pulled the numbers from seven different sources, government data included, and cross-checked every figure by experience level, city, and certification. What follows isn’t one number. It’s the full picture, so you can walk into your next conversation actually knowing what you’re worth.

Average Cybersecurity Salary in the US (2026)

Start with the raw averages, since this is where average salary of cyber security in USA searches usually land. ZipRecruiter puts the national average cyber security analyst salary at $99,400 a year, or $8,283 a month. Indeed reports $104,934 for the same title.

Glassdoor, pulling from a much larger self-reported pool, lands at $127,928 with a typical range of $99,735 to $165,781. Robert Half’s 2026 staffing guide, built from actual hiring placements, brackets the role between $102,250 and $147,750.

Why the spread? Methodology. ZipRecruiter and Indeed scrape live postings, which skew toward starting offers. Glassdoor and PayScale rely on self-reported pay from people already in the role, capturing raises and tenure.

We ran into the same pattern researching software engineer salary transparency in job postings, and the reason sources disagree holds true across tech roles, not just security.

Salary by Experience Level: Entry, Mid, and Senior

Averages hide more than they reveal. What you earn depends heavily on where you sit in your career, whether the search was for cyber security salary us or average cyber security salary in us.

Entry-level analysts, especially SOC tier 1 roles, typically start between $65,000 and $85,000 according to 2026 data from staffing firm KORE1, though Salary.com’s job-posting scan shows a higher national average of $118,053.

The gap comes down to title inflation. A lot of “entry-level” postings quietly expect one to two years of hands-on SOC experience already.

Mid-career professionals with three to seven years earn $107,000 to $148,000 on average, per a 2026 Unihackers salary guide, with tier 3 threat hunters and detection engineers reaching $130,000.

Senior specialists and cleared engineers with ten or more years typically clear $130,000, with many landing between $150,000 and $185,000 once they hold a CISSP or comparable credential. Principal and staff-level engineers at large tech or financial firms can push base pay to $235,000 to $260,000, with total packages crossing $400,000.

If you’re mapping the move from junior to senior pay bands, our guide to realistic tech promotion timelines covers leveling strategy that applies just as directly to security as it does to engineering.

Experience Level	Years in Field	Typical Base Salary Range
Entry-Level (SOC Tier 1 / Analyst)	0 to 2	$65,000 to $118,000
Mid-Level (Analyst / Engineer)	3 to 7	$95,000 to $148,000
Senior (Engineer / Architect)	7 to 10	$130,000 to $185,000
Principal / Staff / Manager	10+	$185,000 to $260,000+

Information Security Analyst vs Cybersecurity Engineer: Same Field, Different Pay

The federal government tracks most of this field under one title, Information Security Analyst. The BLS puts the median annual wage at $124,910 as of May 2024, the most recent official release, and projects 29 percent job growth from 2024 to 2034, roughly seven times faster than the average occupation. That’s about 16,000 to 17,300 new openings a year, and the Information sector alone pays a median of $136,390.

But cybersecurity on the ground splits into very different jobs that just happen to share a paycheck category. A GRC analyst filling out compliance spreadsheets and a reverse engineer dissecting malware at 2am are both technically in cybersecurity, and one pays around $90,000 while the other clears $180,000.

Cybersecurity engineers specifically, the ones hardening infrastructure rather than just monitoring it, earn $110,000 to $165,000 for mid-to-senior roles.

We saw this same title confusion comparing software engineer and product manager compensation, where identical seniority levels pay very differently depending on the actual job. It also explains why cybersecurity engineer and DevOps salary comparisons keep coming up, since the two roles increasingly overlap around cloud infrastructure and employers haven’t standardized what to call, or pay, the people doing it.

Cybersecurity Salary in NYC and Other Major Metros

Location still moves the number, and cyber security jobs NYC salary searches confirm it. ZipRecruiter reports an average of $145,465 a year in New York City, or $12,122 a month. Glassdoor’s NYC figure runs slightly lower at $137,676 for the general title and $132,957 for cybersecurity analysts, with a typical range of $101,961 to $175,273.

Cybersecurity engineers in NYC average $157,556 per Salary.com, and managers average $171,239 based on PayScale data, with top earners crossing $230,000 in base pay alone.

Financial services pays the strongest premium in the city, with Glassdoor showing median total pay of $128,323 for analysts at finance firms versus $107,946 in government roles.

One thing shifting the equation is the return-to-office push across finance and big tech, where several large firms now require in-office presence for roles handling sensitive data. We covered this in our piece on return-to-office policies for engineers, and the same pattern is now showing up in security hiring, with a modest pay edge for on-site candidates over fully remote ones.

What Actually Moves the Number: Certifications, Cloud Security, and Clearance

Three factors move your paycheck more than years on the job alone.

Certifications. CISSP holders earn a median of $164,000, a $25,000 to $35,000 premium over otherwise identical uncertified candidates. OSCP, the hands-on offensive security exam, averages $130,000 with top red team consultants clearing $200,000.

CISM sits around $150,000 for governance and risk roles. Even the entry-level Security+ credential adds $15,000 to $20,000 over an uncertified resume, and it’s required for a lot of government contract work.

Cloud security. This is the fastest-growing specialization in the field. Certifications like CCSP or AWS Security Specialty add up to a 25 percent salary premium, and cloud security or incident response specialists command $15,000 to $32,000 above generalist engineer pay.

Clearance. A Top Secret clearance adds roughly $20,000 to typical offers, mostly because clearances are slow and expensive to obtain, so employers pay a premium to skip the 12 to 18 month wait.

Total Compensation vs Base Salary

Base salary is only part of the picture, and treating it as the whole picture is how people leave money on the table. Most mid-to-senior cybersecurity roles layer on an annual bonus, often 5 to 15 percent of base, plus benefits that meaningfully change effective pay: health coverage, 401k matching, certification reimbursement, and remote work stipends.

Software engineering roles handle total compensation the same way, and the categories worth negotiating overlap almost completely. Our breakdown of software engineer benefits and perks covers the same territory, certification budgets, PTO, and equity, that shows up in a strong cybersecurity offer.

If a recruiter quotes a number without mentioning bonus structure or benefits value, ask. It’s a normal question, and it can add 10 to 20 percent to what you’d otherwise assume you’re getting.

Freelance and Contract Cybersecurity Income

Freelance cybersecurity work has grown fast as companies outsource specialized, project-based tasks instead of hiring full time. Rates vary by specialization. General freelance consultants average $63 to $144 an hour depending on platform and experience.

Specialized consultants doing cloud security reviews, application security audits, or offensive security work charge $175 to $400 an hour, pushing past $500 for red team engagements. Fractional CISO work, where a security leader works part time across multiple companies, runs $9,000 to $30,000 a month.

This mirrors what we found researching freelance software engineer income, where specialization and reputation matter more than raw years once you’re outside the standard W-2 structure. The ceiling is higher freelance, but so is the month-to-month variability.

How Cybersecurity Pay Stacks Up Against Software Engineering

Cybersecurity professionals often ask how their pay compares to software engineers at similar seniority. It depends heavily on level and specialization, but the two fields track closer than people assume.

Our full breakdown of software engineer salary in the United States shows national averages in a similar band to mid-career cybersecurity engineers, though senior software engineers at top-tier tech companies can pull ahead on equity.

If you’re weighing a move between fields, our overview of what it’s like to work as a software engineer in the US is a useful side-by-side read. Where cybersecurity has an edge is stability, since security hiring doesn’t slow the way general software hiring sometimes does, because breach risk doesn’t take a break.

The firms on our list of top software engineering employers are almost all aggressive cybersecurity hirers too, which says a lot about how these functions compete for the same budget.

Common Myths About Cybersecurity Pay

Myth 1: Any certification guarantees a six-figure job. Security+ clears HR filters but rarely moves pay past $65,000 to $85,000 alone. The real jump comes from CISSP, OSCP, or a cloud certification paired with hands-on experience.

Myth 2: Remote cybersecurity jobs pay the same everywhere. Many companies still tie remote offers to location, and workers based near NYC or DC often out-earn remote peers in lower cost-of-living states by 15 to 20 percent.

Myth 3: Cybersecurity always out-earns software engineering. At the senior and staff level, software engineers at major tech firms frequently out-earn cybersecurity engineers once equity is factored in, though the gap narrows for cloud security specialists.

Myth 4: You need a four-year degree to break in. Many SOC and analyst postings now list “or equivalent experience or certification,” and Security+ plus a home lab project can substitute for a degree, especially for tier 1 roles.

Frequently Asked Questions

A Quick Note on the Data

Every figure here comes from named platforms current as of 2026: BLS, Glassdoor, ZipRecruiter, Indeed, PayScale, Salary.com, and Robert Half’s 2026 guide, plus recent research from KORE1 and Unihackers. Nothing was estimated or invented, and where sources disagreed, both figures are shown.

If you’ve negotiated a cybersecurity offer recently or landed a certification that moved your pay, we’d like to hear how it played out. Real offers tell you more than any survey.