The alarm goes off at 3:47 AM. A SOC analyst in a dimly lit operations center stares at a dashboard flashing red. Somewhere, someone is trying to break into a hospital's patient records. Within minutes, the analyst has triaged the alert, escalated the incident, and bought the organization enough time to patch the vulnerability. The attacker moves on to an easier target.
The patients never know. That is the reality of cybersecurity work quiet, relentless, and increasingly essential. Cybersecurity remains one of the most resilient career paths in technology, with strong pay and clear advancement paths. But the market is changing. AI is automating entry-level tasks, companies are struggling to fill senior roles, and compensation varies dramatically by specialization. This guide walks you through what cybersecurity professionals actually earn, what roles exist, and whether this career still makes sense in 2026.
Salary Overview (2026)
Cybersecurity salaries vary significantly by role, experience level, geographic location, and specialization. Below are realistic ranges for both the UK and US markets.
United Kingdom (Permanent Roles)
According to data from IT Jobs Watch covering the 6 months to June 2026, cybersecurity skills are highly sought after, ranking 9th among all permanent job skills with 7,984 permanent jobs citing cybersecurity .
| Experience Level / Role Type | Salary Range (GBP/year) | Median (GBP/year) |
|---|---|---|
| Entry-level / Junior | £30,000 – £40,000 | £60,000 (UK median for all cyber roles) |
| Mid-level | £40,000 – £60,000 | £52,500 (UK excl. London median) |
| Senior / Specialist | £60,000 – £80,000 | £80,000 (75th percentile) |
| Lead / Principal | £80,000 – £97,500+ | £97,500 (90th percentile) |
| CISO / Executive | £100,000 – £140,000+ | N/A |
London premium: The median salary for cybersecurity roles in London is £60,000, while outside London it drops to £52,500 . This represents a +4% year-on-year increase in the UK median, which now stands at £60,000 .
Remote work pay: Cybersecurity roles with remote or hybrid options command a median salary of £65,925 almost £6,000 more than the overall UK median suggesting that employers offer higher pay to attract remote talent .
United States (By Role)
Based on average salary data from Glassdoor (September 2025), cybersecurity roles show wide variation based on specialization :
| Role | Average Salary Range (USD/year) |
|---|---|
| Cybersecurity Analyst (SOC) | $57,000 – $170,000 |
| Penetration Tester / Red Team | $115,000 – $203,000 |
| Security Engineer | $128,000 – $202,000 |
| Security Architect | $177,000 – $286,000 |
| GRC Specialist | $88,000 – $192,000 |
| Incident Response Specialist | $78,000 – $184,000 |
| Cloud Security Engineer | $149,000 – $242,000 |
| Threat Hunter | $112,000 – $207,000 |
| Threat Intelligence Analyst | $112,000 – $201,000 |
| Secure Software Developer | $101,000 – $169,000 |
| Security Awareness Professional | $112,000 – $206,000 |
| Privacy Counsel | $166,000 – $274,000 |
US BLS growth projection: The Bureau of Labor Statistics projects 29% growth in information security analyst jobs from 2024 to 2034 much faster than average .
Contract / Interim Roles
The UK contract market for cybersecurity has been quieter in 2025-2026. Contract rates are trending downward, a trend that began during the pandemic. Primary drivers for contractor demand are spend-to-save initiatives (automation projects) and regulatory pressures like DORA and NIS2 .
Key contract market data :
- 40% of employers use contractors primarily for specific projects
- 23% use contractors for business-as-usual support
- Contract roles increasingly inside IR35 (UK tax legislation)
*"DORA and NIS2 were the two regulatory changes that generated demand for contractors. NIS2 represented a sea change, mandating stronger third-party security measures."*
— Jeff Mayger, Executive Consultant, Barclay Simpson
What Does a Cybersecurity Professional Actually Do?
Cybersecurity is not one career it is a collection of specialized fields . Here are the major career paths and what each involves.
1. Cyber Defense and Analysis (SOC Analyst)
Cyber defenders are at the forefront of a company's defenses. Junior analysts review alerts to determine if they are suspicious. Senior analysts handle escalated incidents, administer security tools, and communicate with the business .
Who thrives here: People with sharp attention to detail and critical thinking skills who can filter through hundreds of false alerts.
2. Penetration Testing / Red Teaming
Penetration testers simulate real-world attacks to expose vulnerabilities. They stay on top of the latest hacking techniques and use them to improve defenses .
Who thrives here: Creative, out-of-the-box thinkers who love challenges and proving how clever they are.
3. Governance, Risk, and Compliance (GRC)
GRC specialists evaluate risks and develop security standards, procedures, and controls. They are the ones with answers on how things should be done, ensuring the organization is ready for audits and assessments .
Who thrives here: Great communicators with exceptional stakeholder and risk management skills who can get people to buy into their vision .
4. Incident Response and Forensics
Incident responders are the firefighters of cybersecurity. At the first indication of an attack, they jump in to identify, analyze, and shut it down. Afterwards, they conduct post-mortems to share lessons learned .
Who thrives here: People who can stay calm during a crisis with strong attention to detail .
5. Security Engineering and Architecture
Security engineers and architects design ways to defend digital assets from threats. Security engineers focus on design and enablement, while architects focus on design and strategy .
Who thrives here: Systems thinkers who can come up with creative ways to solve cybersecurity and organizational problems .
6. Cloud Security
Cloud security specialists secure cloud platforms and services, automate existing processes, and continuously upskill in cutting-edge cloud solutions .
Who thrives here: People with a passion for technology who keep up with the latest cloud services and solutions .
7. Threat Hunting
Threat hunters proactively search internal telemetry for adversary behavior instead of relying on alerts. They come up with hypotheses based on threat intelligence and set out to prove or disprove them .
Who thrives here: Critical thinkers who question assumptions and can paint a larger picture from fragmented evidence .
8. Threat Intelligence
Threat intelligence involves collecting and curating intelligence from outside sources to drive detection and strategy—figuring out what an organization should be worried about .
Who thrives here: Research lovers and those curious about what bad actors are up to .
"Cybersecurity is much bigger than just pentesters and SOC analysts. Protecting the world's people, systems, and data from cyberattacks takes an army: that means policy experts, lawyers, secure software developers, cybersecurity architects, and more."
— Pluralsight, 2026 Cybersecurity Career Guide
Work Environment
Job Benefits and Remote Working
Remote and hybrid working is the most valued benefit among cybersecurity professionals. In a Barclay Simpson survey, 57% of cyber professionals identified it as their most valued benefit—up from 41% the previous year .
Current remote working patterns among cyber professionals :
- Fully remote: 37%
- 4 days remote: 17%
- 3 days remote: 22%
- 2 days remote: 17%
- 1 day remote: 4%
- Full-time in office: 3%
Employee sentiment: 65% of cyber professionals said they would be willing to change jobs to get their desired remote working pattern .
Employer outlook: 93% of employers anticipate their current hybrid/remote working models will remain a long-term feature .
UK vs. US context: In the UK, employers have been pushing for more office days. Many candidates reported being under pressure to reduce their home-working days .
Which Benefits Do Cyber Professionals Value Most?
| Benefit | % of Candidates |
|---|---|
| Remote working | 57% |
| Annual bonus | 16% |
| Flexible working | 16% |
| Company share options/scheme | 4% |
| Private healthcare | 4% |
| Training allowance | 3% |
Education and Requirements
Formal Qualifications
There is no single entry route into cybersecurity .
Relevant degree subjects :
- IT
- Cyber security
- Computer science
- Information technology
- Network engineering
- Forensic computing
- Software engineering
- Mathematics, physics, or other STEM subjects
"A degree isn't always essential, but it can provide a strong foundation. Many employers now value applied knowledge and problem-solving ability as much as academic results, particularly when combined with certifications or hands-on experience."
— Morson Talent, 2026 Skills and Qualifications Guide
Professional Certifications
Certifications remain a key way to validate skills and progress. With a range of certifications available, it is important to focus on those that genuinely apply to your specialism .
Entry-level certifications :
- CompTIA Security+ – Global benchmark for IT security fundamentals
- Systems Security Certified Practitioner (SSCP) – Typically requires one year of experience, proving technical skills across topics including risk identification and cryptography
Mid-level certifications :
- CompTIA CySA+ – Cybersecurity analyst certification
- CompTIA PenTest+ – Penetration testing certification
- Certified Ethical Hacker (CEH) – Ethical hacking credential
Senior / leadership certifications :
- Certified Information Systems Security Professional (CISSP) – Benchmark certification for senior, consultant, and leadership-level roles; candidates usually have several years of experience. Recognized as a prestigious credential and one of the requirements of ISO/IEC Standard 17024
- Certified Information Security Manager (CISM) – Designed for professionals with at least five years' experience, placing emphasis on strategy, risk management, and organizational security leadership
- Certified Information Systems Auditor (CISA) – Requires passing the exam and five years of relevant experience (with up to three years offset by education or other certifications); covers information systems auditing, control, and security
Skills Needed
Technical knowledge matters, but it is no longer enough on its own. Employers increasingly look for professionals who can translate complex risks into clear actions .
Key skills for cybersecurity roles :
- Strong analytical skills and the ability to spot patterns, anomalies, and threats
- Confidence in decision-making, particularly under pressure
- The ability to prioritize and respond quickly to incidents and tight deadlines
- A logical, methodical approach with strong attention to detail
- Clear communication skills, including explaining risk to non-technical audiences
- A strong understanding of data protection, privacy, and regulatory requirements
- Curiosity and a continuous learning mindset, essential in a fast-moving field
Career Advancement
Progression Paths
The typical ladder :
- Entry-level (SOC analyst, junior roles) → 12-24 months
- Mid-level (security analyst, specialist) → 3-7 years
- Senior / Specialist (security engineer, architect, penetration tester) → 5-9+ years
- Lead / Principal → 8-12+ years
- CISO / Executive → 12+ years
Career-changers: Cybersecurity is a popular option for career-changers from IT, engineering, data, military, and even non-technical backgrounds. Transferable skills such as risk awareness, logical thinking, and stakeholder communication are highly relevant, particularly for GRC-focused roles .
The Entry-Level Challenge
AI is significantly reshaping the cybersecurity workforce. According to the 2026 SANS/GIAC Cybersecurity Workforce Research Report, only 4% of organizations report that entry-level roles are hard to fill, yet these roles—SOC analysts, threat intelligence analysts, and incident responders—are likely the very positions being automated first .
Key data points on AI-driven role changes :
- 32% of companies are cutting SOC and security analyst roles due to AI automation
- 26% are cutting threat intelligence analysts
- 22% are cutting incident response personnel
"Every single technology organization seems to be largely abandoning the concept of hiring entry-level personnel, which are the sort of people where you would cultivate that mastery. We are effectively forfeiting or abdicating expertise to the technology, and then that requires us to trust the technology completely."
— Jeff Pollard, VP and Principal Analyst, Forrester
The AI skills shift: 97% of IT security hiring managers are actively seeking candidates with at least one AI-related skill .
New roles emerging: "Vulnerability operations" is an emerging career path that did not exist before AI-driven discovery tools .
Career Path Clarity
Career path ambiguity is a growing problem. SANS found that 32% of companies said unclear career paths were an obstacle to hiring—up from just 9% the previous year. It was also the third-ranked retention obstacle, cited by 31%. Only 24% of companies reported having well-defined, clearly communicated career paths .
"I tell people, you got to quit the job and then come back and reapply for the same organization at the higher-paid job."
— Rob T. Lee, Chief AI Officer and Chief of Research, SANS Institute, describing how HR cap raises at 10%
Job Outlook (2026)
Overall outlook: The cybersecurity job market is strong but evolving. 83% of employers of cybersecurity professionals plan to recruit in 2026 .
Candidate Confidence
Candidate confidence has dipped. In a Barclay Simpson survey :
| Confidence Level | 2025 | 2024 |
|---|---|---|
| Very confident | 21% | 34% |
| Somewhat confident | 52% | 47% |
| Not at all confident | 27% | 19% |
Employer Challenges
Employers are struggling to find skilled talent. In a Barclay Simpson survey, 88% of employers said finding skilled talent was challenging .
Top challenges in hiring :
- Compensation challenges: 83%
- Insufficient technical/regulatory knowledge: 56%
- Remote working policies: 44%
Key Drivers and Trends
Strongest growth areas :
- Cloud security
- AI security
- IAM and zero trust
- Security engineering
- GRC and cyber risk
Budget increases: 90% of organizations increased their IT security budgets in 2026 a record high for the CyberEdge report with an average increase of 5.6% .
Ransomware reality: 64% of organizations experienced a ransomware attack in the past year. Of those victimized, the percentage paying a ransom increased from 41% to 55% .
AI skills demand: 97% of IT security hiring managers are seeking candidates with at least one AI-related skill. Meanwhile, 80% of IT security professionals believe AI will significantly reduce the number of people required to perform their current roles .
"AI is no longer an emerging technology in cybersecurity—it is a defining force. Organizations are simultaneously leveraging AI for defense while contending with adversaries who are weaponizing it, creating a rapidly evolving and highly dynamic threat environment."
— Steve Piper, Founder and CEO, CyberEdge Group
Is It Worth It?
Cybersecurity remains one of the most resilient career paths in tech, but the nature of work is changing.
The upsides:
- High and growing demand for skilled professionals
- Competitive pay, especially for specialized roles
- Strong remote and hybrid working options
- Clear career progression with certifications
- 90% of organizations are increasing security budgets
- Meaningful work protecting people and organizations
- Wide variety of specializations to match different interests
The downsides:
- Entry-level roles are being automated by AI
- Candidate confidence is lower than previous years
- Contract market has been slow
- Career paths are often unclear only 24% of companies have well-defined paths
- Entry-level SOC tasks are increasingly automated
- Continuous learning is essential the field evolves constantly
Who this career is for:
- People who enjoy problem-solving and critical thinking
- Those who can stay calm under pressure
- Lifelong learners who keep up with evolving threats and technology
- Good communicators who can translate complex risks to non-technical audiences
- People who enjoy variety cybersecurity is rarely repetitive
Who this career is not for:
- People expecting a "learn it once and done" career
- Those who dislike continuous learning and rapid change
- Anyone seeking a low-stress, predictable 9-to-5 role
- People who cannot handle the responsibility of protecting critical systems
The bottom line: Cybersecurity remains an excellent career choice for 2026 for the right person. The pay is strong, demand is high, and the field offers genuine variety and purpose. However, the entry-level market is being disrupted by AI automation, making it harder than ever to get that first role. Specialization is key—cloud security, AI security, IAM, and security engineering offer the strongest opportunities . The professionals who combine technical skills with business understanding and continuous learning will thrive .
"It's likely to change what you do. I don't think it'll eliminate entry positions wholesale."
— Jon France, CISO, ISC2, on AI's impact on entry-level cybersecurity roles
FAQ
Q: How much do cybersecurity professionals earn in the UK?
The UK median salary for cybersecurity roles is £60,000. Outside London, the median drops to £52,500. Entry-level roles typically start between £30,000 – £40,000, while senior roles can exceed £80,000 .
Q: How much do cybersecurity professionals earn in the US?
Salaries vary widely by role. SOC analysts earn $57,000 – $170,000, security engineers earn $128,000 – $202,000, and security architects can earn $177,000 – $286,000. Cloud security engineers typically earn $149,000 – $242,000 .
Q: Do I need a degree to work in cybersecurity?
Not necessarily. While a degree can provide a strong foundation, many employers now value certifications and hands-on experience just as highly. Entry routes include IT support roles, apprenticeships, and certifications like CompTIA Security+ or SSCP .
Q: Which cybersecurity certifications are most valuable?
Entry-level: CompTIA Security+, SSCP. Mid-level: CySA+, PenTest+, CEH. Senior/Leadership: CISSP, CISM, CISA. CISSP is widely considered the benchmark for senior and leadership roles .
Q: Is AI going to replace cybersecurity jobs?
Partially. AI is automating entry-level SOC tasks 32% of companies are cutting SOC analyst roles due to AI. However, roles requiring judgment, architecture, investigation, and communication remain hard to automate. The nature of work is changing, not disappearing .
Q: What cybersecurity roles are most in demand?
Cloud security, AI security, IAM and zero trust, security engineering, and GRC offer the strongest opportunities in 2026 .
Q: Can I work from home in cybersecurity?
Yes. 37% of cybersecurity professionals work fully remote, and 93% of employers expect hybrid/remote models to continue long-term. Remote roles often pay more the median remote salary in the UK is £65,925 compared to £60,000 overall .
Q: Is cybersecurity still a good career in 2026?
Yes. 90% of organizations increased their security budgets in 2026, 83% of employers plan to recruit, and BLS projects 29% growth in the US. Specialization is key entry-level roles are the most vulnerable to automation .
About This Analysis
Data in this article is aggregated from IT Jobs Watch (UK permanent job market data, 6 months to June 2026), Barclay Simpson's 2026 Salary Survey & Recruitment Trends Guide, Pluralsight's 2026 cybersecurity career guide (salary data sourced from Glassdoor), the 2026 SANS/GIAC Cybersecurity Workforce Research Report, the CyberEdge Group 2026 Cyberthreat Defense Report, and Morson Talent's 2026 skills and qualifications guide. Salary figures represent base compensation in either GBP (UK data) or USD (US data) and may vary significantly by geographic location, years of experience, and employer type.
0 Comments