US Cybersecurity Salary & Employment Study

In a world where data protection is becoming increasingly important, cybersecurity roles are at the heart of many companies’ employment strategies.

Often defined as “information security analysts,” these roles involve planning and implementing security measures that help protect an organization’s computer systems and networks. This includes installing software (such as firewalls and data encryption programs), investigating security breaches, and looking for potential vulnerabilities before they are exploited.

In 2021, the average salary for cybersecurity roles was $113,270 per year, over 5 percent more than in 2020 ($107,580). The number of people in these roles has grown by nearly 14 percent (from 138,000 to 157,220). Over the next decade, the estimated job growth for these roles is 35 percent (much higher than the average of 5 percent for all occupations).

So how is the job landscape for cybersecurity roles changing and how do the roles shape up on a state-by-state basis (including the District of Columbia and Puerto Rico)?

We compared data from the last couple of years to find out where you’ll get the highest salary, where the most jobs are, and the best long-term projections for cybersecurity roles. To provide these rankings, we analyzed ten different criteria, each of which was equally weighted to give us our overall scores.

How has the cybersecurity job market changed from 2020 to now?

As you can see from the above chart, things have changed dramatically in some states. For example, Iowa has jumped from 25th to first place, while Nevada has plummeted through the rankings this year, going from third to 48th. Nevada’s sharp decline stems from drops in a number of areas, including the number of people in cybersecurity roles and its 1-year decrease in average salary. For the latter, Nevada saw a 14 percent decline in the yearly salary for information security analysts from 2020 ($108,870) to 2021 ($93,920). This was the biggest decline for all states.

Although some states have seen some year-on-year declines, the overall averages paint a more positive picture.

Average US-wide changes:

  • Average annual salary for cybersecurity roles increased 5.29% from $107,580 (2020) to $113,270 (2021).
  • # of people in cybersecurity roles increased 13.93% from 138,000 (2020) to 157,220 (2021).
  • Employment per 1,000 people (the number of jobs–employment–in the given occupation per 1,000 jobs in the given area) increased 24.69% from 0.81 (2020) to 1.01 (2021).
  • 10-year growth projection for roles increased 10.34% from 29% (2018-2028) to 32% (2020-2030).

Recent large-scale incidents, such as the Colonial Pipeline attack that crippled the major fuel supplier for over a week, emphasize the importance of cybersecurity expertise. The job market looks set to continue growing for many years to come. But prospects look better in some states than others.

Annual salary

The biggest average salary increases for information security analysts were observed in Iowa (44.29%), California (17.95%), South Carolina (17.19%), and Maryland (16.45%). These increases coincide with state-specific initiatives, such as an executive order that formalized the Cybersecurity Ecosystem Coordination Initiative in South Carolina. The program aims to create better-paid cybersecurity roles, encourage cyber organizations, and increase the cyber resources within the state.

One state that saw a significant decline in average salary for cybersecurity roles was Alaska (-10.11%). This was in spite of the fact that average salaries across all other types of employment increased for the state.

Number of people in roles

Although the average salary for information security analysts in Alaska has decreased significantly, the number of people in these roles more than doubled (from 70 to 210). This suggests the average salary decline could be due to saturation within these roles with increasing demand for the jobs lowering competition between employers.

In West Virginia, the number of cybersecurity roles took a pretty sharp nosedive of 32 percent, falling from 250 to 170. The figures for employment per 1,000 jobs saw similar drastic changes in West Virginia, dropping by nearly 27 percent.

Available job vacancies

This time around, we were unable to compare year-on-year figures for the number of job vacancies due to a change in sources.

This year, we pulled figures from Indeed.com. We found the District of Columbia has the highest number of cybersecurity roles currently available: 5,652. Due to it being the capital of the United States, it is no surprise that cybersecurity professionals are in such high demand.

Virginia had the second-highest number of vacancies (4,092) followed by Texas (3,259), and California (3,188). These are some of the most populous states, so the high volume of roles currently available is not surprising.

Long-term growth projections

Perhaps the most interesting comparisons are the changes in long-term growth projections spanning 10 years from 2020 to 2030. It’s intriguing to see how much some of these have changed over time.

Previously, in Wyoming, the number of information security analyst jobs was projected to increase by 20 percent from 2018 to 2028. But more recent estimates (from 2020 to 2030) now put the projected increase at 50 percent. In Vermont, the projected increase rose from 21.4 to 40 percent over the same period of time.

Some notable declines in long-term growth projections were observed in Nevada (-66%) and New Hampshire (-72.94%). The latter makes sense when you consider that the number of people in these roles and employment per 1,000 jobs have both seen declines (-9.62% and -6.29% respectively).

The top-scoring states for cybersecurity roles

According to our research, Iowa is the best state to be an information security analyst. It was the state with the biggest difference between the average salary for all types of employment vs. the average salary of an information security analyst. It was also the highest-ranking state for its 5-year increases in employment figures and annual salary, as well as its 1-year increase in annual salary. It also boasts a high average annual salary of $125,650– over $12,000 higher than the US average for these roles.

Iowa does have a lower number of people employed in these roles (1,280). This is to be expected when compared to the likes of Virginia which is more heavily populated. That said, the number of people employed per 1,000 jobs was also low in Iowa with just 0.865. But, with such a high average annual salary in Iowa and with cybersecurity roles projected to grow nearly 48 percent from 2020 to 2030, it seems Iowa could be a new hub for cybersecurity roles in years to come.

Virginia, Maryland, Florida, and the District of Columbia were the other four states that made up the top five. Virginia scored the highest for the number of people in cybersecurity roles, employment per 1,000 people, and the number of job vacancies (4,092). Maryland was the only state in the top five to have a higher average annual salary than Iowa (with $126,110).

The top 5 states at a glance

RankScoreStateAverage Annual Salary# of People Currently in These RolesEmployment per 1,000 of Jobs# of Job Vacancies Currently AvailableLong-Term Growth Projection for Roles by 2030 (from 2020)5-Year Increase in Employment # (%)5-Year Increase in Annual Salary (%)
164.49Iowa$125,650.001,2800.86527647.70190.9169.18
260.39Virginia$121,940.0016,9304.514,09236.8046.5815.65
350.24Maryland$126,110.007,3302.8792,01636.7065.0920.30
449.17Florida$102,850.009,3601.0081,89752.0094.5921.80
548.53District of Columbia$124,980.002,1303.2145,65236.60150.590.91

The highest-scoring states per category were:

  • Highest average annual salary – California – $135,200
  • Highest % difference to state average annual salary for all types of employment – Iowa – 84.29%
  • Highest number of people currently in these roles – Virginia – 16,930
  • Highest employment per 1,000 jobs – Virginia – 4.51
  • Highest number of jobs currently being advertised for – District of Columbia– 5,652
  • Best long-term projection for roles – Utah – 59.40% growth
  • Best 5-year increase in employment numbers (from 2016 to 2021) – Iowa – 190.91%
  • Best 5-year increase in average annual salary (from 2016 to 2021) – Iowa – 69.18%
  • Best 1-year increase in employment numbers (from 2016 to 2021) – Vermont – 120% growth
  • Best 1-year increase in average annual salary (from 2016 to 2021) – Iowa – 46.41% growth

The lowest-scoring states for cybersecurity roles

At the bottom of our table was Puerto Rico–it scored the lowest for average annual salary ($51,600), and then low across the board for all other categories. Due to it being one of the smallest territories, Puerto Ricos’ low score is probably due to a lack of demand for these roles.

Maine, North Dakota, Wyoming, and Nevada were the other four states in the bottom five. All scored low for their average salaries and for the number of people currently in these roles. Wyoming, however, is expected to see a great increase in the number of cybersecurity jobs available–growing by 50 percent from 2020 to 2030.

North Dakota saw a large decline in employment over the last five years (down 38.10% for information security analysts). However, employment for all occupations has also decreased there by 1.24 percent (from 400,040 jobs to 395,060). Similarly, all of the bottom five states saw 1-year decreases in annual salaries for information security analyst roles.

The bottom 5 states at a glance

RankScoreStateAverage Annual Salary# of People Currently in These RolesEmployment per 1,000 of Jobs# of Job Vacancies Currently AvailableLong-Term Growth Projection for Roles by 2030 (from 2020)5-Year Increase/Decrease in Employment # (%)5-Year Increase in Annual Salary (%)
5215.86Puerto Rico$51,600.003400.4084512.706.2514.72
5116.33Maine$85,730.002800.47364-0.4017.442.95
5017.86North Dakota$83,830.001300.3254323.10-38.1012.10
4917.87Wyoming$72,990.00400.1622250.00-17.655.14
4820.09Nevada$93,920.004400.33824117.007.3213.31

The lowest-scoring states per category were:

  • Lowest average annual salary – Puerto Rico – $51,600
  • Lowest % difference to state average annual salary for all types of employment – District of Columbia – 23.83%
  • Lowest number of people currently in these roles – Wyoming – 40
  • Lowest employment per 1,000 jobs – Wyoming – 0.162
  • Lowest number of jobs currently being advertised for – Wyoming – 22
  • Worst long-term projection for roles – Maine – 0.4% decline
  • Worst 5-year change in employment numbers (from 2016 to 2021) – North Dakota – 38.10% decline
  • Worst 5-year change in average annual salary (from 2016 to 2021) – Alaska– 6.82% decline
  • Worst 1-year change in employment numbers (from 2020 to 2021) – West Virginia – 26.09% decline
  • Worst 1-year increase in average annual salary (from 2020 to 2021) – Nevada – 13.73% decline

Which state should you head to for the best cybersecurity roles?

Initially, you may consider Iowa thanks to its high salary and high long-term projections. Or, you might opt for the District of Columbia for its large number of job vacancies (5,652) and high salary ($124,980). Or, there’s California with its even more attractive average salary of $135,200, which is 17.65% higher than the average information security analyst salary ($113,270) and 65.48% higher than CA’s average salary for all types of employment.

You could even look toward somewhere like Utah, which has the best long-term projections for these roles, offering even more job security. The only thing letting Utah down slightly is its salary ($100,580), but this is only 11.2 percent lower than the average ($113,270) across all states. But with a 19.03 percent increase in the annual salary over the last five years, it might not be long until you’re enjoying the same or better salary.

Ultimately, the majority of states offer great prospects for cybersecurity roles. All states except Maine show at least some positive growth (when looking at the long-term projections) and each and every state has an average cybersecurity salary that’s above the state average for all types of employment.

Methodology and limitations

To figure out how well (or poorly) these roles were represented in each state, we used ten different criteria, each of which was equally weighted to give us our overall scores. These were:

  • The average state annual salary for cybersecurity roles
  • The % difference of the annual salary for cybersecurity roles to the average annual salary of all types of employment in each state
  • The number of people employed in cybersecurity roles in the state
  • The number of people in cybersecurity roles per 1,000 jobs (the number of jobs–employment–in the given occupation per 1,000 jobs in the given area)
  • The number of cybersecurity roles currently being advertised for by the state
  • The long-term projections for cybersecurity roles in each state (over a 10-year period)
  • The 5-year change in employment numbers (from 2016 to 2021) in each state
  • The 5-year change in average annual salaries (from 2016 to 2021) in each state
  • The 1-year change in employment numbers (from 2020 to 2021) in each state
  • The 1-year change in average annual salaries (from 2020 to 2021) in each state

To score each criterion, we gave each state a point based on where it appeared between the highest- and lowest-scoring states. The state that received the best score for a criterion got 100 points, while the lowest-scoring stats received a zero. Then, all of the states in between these two figures were ranked on a percentile basis to give them their scores.

To achieve the total score we averaged the state’s score across all ten of the categories.

In this update, we had to change the source for the number of vacancies Monster.com to Indeed.com. This was due to a lack of data from monster.com. However, as each state is scored based on where it ranks in relation to the states with the highest and lowest number of vacancies, this doesn’t affect the overall scoring.

Some states were subject to limitations:

Vermont and Wyoming didn’t recognize “information security analysts” as roles for their average salaries. Therefore, we used the closest roles available–” computer system analysts”.

The states of Maine, Montana, Puerto Rico, and Wisconsin also failed to provide information security analyst data for long-term projections and therefore also used computer systems analysts. This time around, Arizona did provide scores for Information Security Analysts compared to using computer systems analysts last time.

For employment per 1,000 jobs, 2021 figures were unavailable for California and Wyoming so instead, figures were taken from the 2020 release.

For Wyoming and Maine’s 2016 figures (utilized in the 5-year growth calculations), we used the number of people employed in computer systems analyst roles and the corresponding annual average salary, as the relevant information for information security analysts wasn’t available at this time.

Many of these limitations are due to how new these roles are. We also used “cybersecurity” as a search term on indeed.com to cover the various titles these information security analyst roles come with. For example, while a company may refer to the role as a “cybersecurity engineer,” the state would place this under the “information security analysts” bracket when presenting its figures for employment.

Researcher: Charlotte Bond