Security Analyst jobs: skills, pay and how to get hired
Contents
See open Security Analyst jobsScore your CV for these jobs
What a security analyst does
A security analyst works in or for a security operations centre, the SOC: the team that watches a company's logs and alerts around the clock. The analyst checks each alert, decides whether it is harmless or an attack, gathers what happened, and escalates or contains it. Between alerts the work is tuning detection rules, hunting for threats the tools missed, and writing up incidents so the company learns from them.
The analyst finds and answers attacks; the security engineer builds and hardens the defences, and the cloud engineer runs the platforms where more and more of the logs come from. Many SOCs sort analysts into tiers: tier one checks alerts, tier two investigates, tier three hunts and handles major incidents. The steps from junior analyst to CISO are in the career paths of this role.
The skills the ads ask for
We read a sample of the ads every day and count the skills they name. On a computer, hover a skill in the text to see its share; on a phone, the table has the same figures.
| Skill | What is expected |
|---|---|
| SIEM | Search and correlate logs in a SIEM, tune detection rules, and tell a real alert from noise. |
| Cybersecurity | The basics of attacks and defences: identity, networks, endpoints, cloud, email and the web. |
| Incident Management | Run an incident from first alert to closure: contain, communicate, recover and record. |
| Networking | Protocols, ports, DNS, proxies and firewalls well enough to read network logs and traffic. |
| EDR | Read what an endpoint tool saw on a laptop or server, isolate a machine, and collect evidence. |
| Linux | Find your way on a Linux server: processes, users, logs and what an attacker would change. |
| Windows Server | Windows events, Active Directory and group policy: where most office attacks leave traces. |
| ISO 27001 | The international standard for information security management, and the evidence an audit asks for. |
| Python | Short scripts to parse logs, call tool interfaces and automate repeated steps of triage. |
| Azure | Cloud sign-in and activity logs, identity risks and the security settings of a cloud tenant. |
| Threat Intelligence | Use reports on attackers and their methods to decide what to look for and what to block. |
| PowerShell | Read attacker scripts and write small ones for Windows checks and evidence collection. |
| Communication skills | Write an incident note that a manager understands and an engineer can act on, under time pressure. |
| English | The language of security tools, vendor advisories, threat reports and many SOC teams. |
| German | Asked for in most ads in Germany, Austria and Switzerland, for reports and talks with users. |
The tools come first: a SIEMSearch and correlate logs in a SIEM, tune detection rules, and tell a real alert from noise., the system that collects logs and raises alerts, and EDRRead what an endpoint tool saw on a laptop or server, isolate a machine, and collect evidence., endpoint detection and response on laptops and servers. Ads name the products side by side: Splunk, Microsoft Sentinel, QRadar or Elastic as SIEMs, and CrowdStrike, SentinelOne or Microsoft Defender for endpoints. Knowing one well and the ideas behind all of them is what counts.
The knowledge behind the tools: cybersecurityThe basics of attacks and defences: identity, networks, endpoints, cloud, email and the web. basics, networkingProtocols, ports, DNS, proxies and firewalls well enough to read network logs and traffic., WindowsWindows events, Active Directory and group policy: where most office attacks leave traces. and LinuxFind your way on a Linux server: processes, users, logs and what an attacker would change. systems, cloud logs from platforms such as AzureCloud sign-in and activity logs, identity risks and the security settings of a cloud tenant., incident handlingRun an incident from first alert to closure: contain, communicate, recover and record. and threat intelligenceUse reports on attackers and their methods to decide what to look for and what to block.. PythonShort scripts to parse logs, call tool interfaces and automate repeated steps of triage. or PowerShellRead attacker scripts and write small ones for Windows checks and evidence collection. help automate repeated steps, digital forensicsPreserve and examine evidence from disks, memory and logs so that the findings hold up later. matters in incident response roles, and ISO 27001The international standard for information security management, and the evidence an audit asks for. in companies that are certified against it. The personal skill named most is communicationWrite an incident note that a manager understands and an engineer can act on, under time pressure.: an incident note must be clear at three in the morning. EnglishThe language of security tools, vendor advisories, threat reports and many SOC teams. is the language of most security tools and reports, and GermanAsked for in most ads in Germany, Austria and Switzerland, for reports and talks with users. is asked for in most ads in German-speaking countries.
Where the jobs are, country by country
Each country below has its own figures: which cities have the most jobs in our list, whether the number is going up or down, how often ads offer remote or hybrid work, the titles used in the country, and pay ranges from published research, in the local currency.
Germany
Pay (Base salary)
- Entry level: €45,000 to €55,100 a year
- Mid-level: €55,100 to €65,900 a year
- Senior: €60,785 to €92,744 a year
Total pay: Payscale gives German security analysts bonuses of about €500 to €15,000 a year, from few salaries.
Entry level runs from the lower tenth of Payscale's range to StepStone's average; mid-level from that average to the top of StepStone's range, an estimate that does not say how many salaries it rests on; senior runs from Indeed's average for SOC analyst ads to the top of its range, from 284 salaries in job ads. Indeed's page for security analysts mixes in other security jobs and is not used.
Sources: StepStone (2026), Indeed: SOC analyst (Oct 2026), Payscale (Jan 2026).
Pay researched on 28 Oct 2026.
Titles and the rules: German ads say Security Analyst, SOC Analyst or IT-Sicherheitsanalyst. In Germany, the BSI, the German federal office for information security, receives reports from operators of critical infrastructure, called KRITIS, and from the firms that the German law implementing the EU's NIS2 directive covers; many German SOC teams work for such operators or for service providers that run security monitoring for them.
Language: most German ads ask for GermanAsked for in most ads in Germany, Austria and Switzerland, for reports and talks with users. next to EnglishThe language of security tools, vendor advisories, threat reports and many SOC teams., because reports and calls with users in Germany are often in German.
United States
Pay (Base salary)
- Entry level: $56,000 to $74,046 a year
- Mid-level: $75,535 to $107,000 a year
- Senior: $98,358 to $161,775 a year
Total pay: Payscale gives security analysts bonuses of about $1,000 to $11,000 and profit sharing of about $5,000 to $8,000 a year.
Entry level runs from the lower tenth of Payscale's range to its figure for one to four years of work; mid-level from its average to the upper tenth; senior from Indeed's average for security analyst ads to the top of its range. The BLS gives information security analysts, a group that includes engineers, a lowest tenth below $75,090 and a top tenth above $199,850 (May 2025).
Sources: Payscale (Aug 2026), Indeed (Oct 2026), BLS (May 2025).
Pay researched on 28 Oct 2026.
The rules: in the US, listed companies must disclose a material cybersecurity incident to the SEC, the US securities regulator, within four business days of deciding that it is material, so US analysts often feed facts to that decision. Many US teams build on the NIST frameworks, published by the US standards institute.
How the work is offered: US ads mostly offer full-time employment, often in shifts or with on-call duty; contract roles are common for incident response projects.
United Kingdom
Pay (Base salary)
- Entry level: £24,000 to £34,633 a year
- Mid-level: £34,717 to £51,359 a year
- Senior: £51,359 to £98,061 a year
Total pay: Payscale gives UK security analysts bonuses of up to about £8,000 a year.
Entry level runs from the lower tenth of Payscale's range to its figure for one to four years; mid-level from Payscale's average to Indeed's average for security analyst ads; senior from there to the top of Indeed's range, from 183 salaries. Payscale's UK page rests on 51 salaries.
Sources: Payscale (Sep 2025), Indeed (Oct 2026).
Pay researched on 28 Oct 2026.
The rules: in the UK, the NCSC, the UK's National Cyber Security Centre, publishes guidance and takes reports of significant incidents; firms in some UK sectors must also report to their own regulator under the UK's network and information systems rules, and personal data breaches go to the ICO, the UK data protection regulator.
Switzerland
Pay (Base salary)
- Entry level: CHF 77,000 to CHF 97,234 a year
- Mid-level: CHF 89,017 to CHF 129,060 a year
- Senior: CHF 122,499 to CHF 184,000 a year
Total pay: Payscale gives Swiss security analysts bonuses of up to about CHF 13,000 a year, from few salaries.
The Swiss figures are thin and rest on few salaries. Entry level runs from the lower tenth of Payscale's range to its figure for one to four years, a page last updated in 2024; mid-level is Lohncheck's range; senior runs from Lohnanalyse's average to its highest figure, from 17 salaries. Indeed's Swiss page mixes in other security jobs and is not used.
Sources: Payscale (Nov 2024), Lohncheck (2026), Lohnanalyse (Jul 2026).
Pay researched on 28 Oct 2026.
The rules: in Switzerland, operators of critical infrastructure must report cyberattacks to the BACS, the Swiss federal office for cybersecurity, within twenty-four hours. Many Swiss SOC roles are in banks, insurers and public bodies, and ask for German or French as well as English.
India
Pay (Base salary)
- Entry level: ₹2.94 lakh to ₹5.31 lakh a year
- Mid-level: ₹5.31 lakh to ₹10 lakh a year
- Senior: ₹7.43 lakh to ₹11.92 lakh a year
Total pay: Payscale gives security analysts in India bonuses of about ₹6,000 to ₹1.54 lakh a year.
Entry level runs from the lower tenth of Payscale's range to its average; mid-level from that average to the upper tenth, which Payscale rounds; senior from Indeed's average to the top of its range, from few salaries.
Sources: Payscale (Apr 2026), Indeed (Oct 2026).
Pay researched on 28 Oct 2026.
The rules: in India, CERT-In, India's national computer emergency response team, asks firms to report listed kinds of cyber incidents within six hours of noticing them. Many SOC roles in India sit in managed security service providers that monitor clients around the world in shifts.
Reporting rules and certificates
When an incident is serious, the law may set a clock. In the EU, the GDPR asks for a personal data breach to be reported to the data protection authority within seventy-two hours where feasible, and the EU's NIS2 directive asks firms it covers for an early warning within a day; EU banks and insurers report major incidents under the EU's DORA rules. The US, the UK, Switzerland and India have rules of their own, named in their sections below. The analyst's part is to record times and facts so the people who decide can meet these deadlines. This is a summary for orientation, not legal advice; the company's lawyers and data protection officer decide what applies.
Certificates appear in many ads and are named here side by side: CompTIA Security+ and CySA+, GCIH from GIAC for incident handling, and OSCP from OffSec for offensive skills. Some ads name one, others none; the alerts you handled and the incidents you worked on count for more than a list of certificates.
Your CV for a security analyst job
A security analyst's CV is read twice: by hiring software that matches the ad's words, and by a SOC lead who wants to know which tools you used, which incidents you handled, and how you think. Give both: the keywords and the evidence.
Use the keywords the ads use
- Name the tools and tasks as the ad does: "SIEM", "EDR", "incident response", "threat hunting", "alert triage", and the products you used. The skills table above shows which keywords the ads use most.
- Say what you monitored: how many systems or users in rough terms, which kinds of logs, and whether it was one company or many clients.
- Write a certificate you are still working on as "in progress" with the exam date, next to the work it supports.
- A home lab, capture-the-flag events or write-ups count for a first role; give a link to public write-ups if you have them.
Prove each skill
A security line proves itself with what changed: an attack stopped early, noise cut so real alerts were seen, an incident closed faster, a rule that caught something new.
| Skill | Weak line | Strong line, with proof |
|---|---|---|
| SIEMSearch and correlate logs in a SIEM, tune detection rules, and tell a real alert from noise. | Monitored the SIEM. | Tuned the noisiest detection rules in the SIEM; false positives fell by half and the night shift cleared its queue. |
| EDRRead what an endpoint tool saw on a laptop or server, isolate a machine, and collect evidence. | Worked with EDR tools. | Isolated an infected laptop through the EDR console within minutes of the alert; the malware did not spread. |
| Incident responseRun an incident from first alert to closure: contain, communicate, recover and record. | Handled security incidents. | Led the first response to a phishing campaign: blocked the sender, reset affected accounts and wrote the report the same day. |
| Threat huntingUse reports on attackers and their methods to decide what to look for and what to block. | Did threat hunting. | Hunted for a newly reported attack method in our logs; found one old foothold that the tools had missed. |
| AutomationShort scripts to parse logs, call tool interfaces and automate repeated steps of triage. | Wrote scripts. | Automated the enrichment of alerts with user and device details; triage of each alert became faster. |
Keep confidential details out: no client names, internal addresses or details of open weaknesses.
How we read our data
- The jobs: the security analyst jobs in our job search (security, SOC, cyber security, information security and threat analysts, and the German title IT-Sicherheitsanalyst), matched by their titles the way the search matches them. Our list is not the whole market, so we give shares and rankings, never counts.
- The skills: every day we read a sample of these ads and count the skills in them with a fixed word list. Only the counts are kept, never the text of an ad.
- Pay: from published salary research, each source named with its date, as a range from entry level to senior. Our ads are not used for it.
- Dates: every figure is worked out again each day and shows the day it was worked out.
Frequently asked questions
- What does a security analyst do?
- Watches a company's systems for attacks, checks alerts, investigates what is real, and leads the first response to an incident.
- What is the difference between a security analyst and a security engineer?
- The analyst detects and answers attacks; the engineer designs, builds and hardens the defences. Many people do both over a career.
- Do I need a certificate to start?
- No law asks for one. Some ads name CompTIA Security+ or CySA+; a home lab, practice platforms and clear write-ups help as much for a first role.
- Is the work done in shifts?
- Often, because a SOC watches around the clock. Some teams cover nights with on-call duty or with a partner in another time zone.
- What should a security analyst's CV show first?
- The tools you used, the kinds of alerts and incidents you handled, and what changed because of your work.
More on the security analyst role
The cvscored team
See open Security Analyst jobsScore your CV for these jobs
Related roles
Jobs from Arbeitnow and the Bundesagentur für Arbeit