Certified Information Security Manager (CISM)

Employment of information security analysts is projected to grow 32 percent from 2018 to 2028, much faster than the average for all occupations.

Demand for information security analysts is expected to be very high. Cyberattacks have grown in frequency, and analysts will be needed to come up with innovative solutions to prevent hackers from stealing critical information or creating problems for computer networks.

Banks and financial institutions, as well as other types of corporations, will need to increase their information security capabilities in the face of growing cybersecurity threats. In addition, as the healthcare industry expands its use of electronic medical records, ensuring patients’ privacy and protecting personal data are becoming more important. More information security analysts are likely to be needed to create the safeguards that will satisfy patients’ concerns.

Employment of information security analysts is projected to grow 55 percent in computer systems design and related services from 2018 to 2028. The increasing adoption of cloud services by small and medium-sized businesses and a rise in cybersecurity threats will create demand for managed security services providers in this industry.

The median annual wage for information security analysts was $99,730 in May 2019. The median wage is the wage at which half the workers in an occupation earned more than that amount and half earned less. The lowest 10 percent earned less than $57,810, and the highest 10 percent earned more than $158,860.

In May 2019, the median annual wages for information security analysts in the top industries in which they worked were as follows:

Most information security analysts work full time. Information security analysts sometimes have to be on call outside of normal business hours in case of an emergency. Some work more than 40 hours per week.

Information security analysts plan and carry out security measures to protect an organization’s computer networks and systems. Their responsibilities are continually expanding as the number of cyberattacks increases.

Duties

Information security analysts typically do the following:

• Monitor their organization’s networks for security breaches and investigate a violation when one occurs
• Install and use software, such as firewalls and data encryption programs, to protect sensitive information
• Prepare reports that document security breaches and the extent of the damage caused by the breaches
• Conduct penetration testing, which is when analysts simulate attacks to look for vulnerabilities in their systems before they can be exploited
• Research the latest information technology (IT) security trends
• Develop security standards and best practices for their organization
• Recommend security enhancements to management or senior IT staff
• Help computer users when they need to install or learn about new security products and procedures

IT security analysts are heavily involved with creating their organization’s disaster recovery plan, a procedure that IT employees follow in case of emergency. These plans allow for the continued operation of an organization’s IT department. The recovery plan includes preventive measures such as regularly copying and transferring data to an offsite location. It also involves plans to restore proper IT functioning after a disaster. Analysts continually test the steps in their recovery plans.

Information security analysts must stay up to date on IT security and on the latest methods attackers are using to infiltrate computer systems. Analysts need to research new security technology to decide what will most effectively protect their organization.