2024 US Cybersecurity Salary & Employment Study – which state has the best prospects?

In a world where data protection is becoming increasingly important, cybersecurity roles are at the heart of many companies’ employment strategies.

Often defined as “information security analysts,” these roles involve planning and implementing security measures that help protect an organization’s computer systems and networks. This includes installing software (such as firewalls and data encryption programs), investigating security breaches, and looking for potential vulnerabilities before they are exploited.

In 2023, the average salary for cybersecurity roles was $124,740 per year, over four percent more than in 2022 ($119,860). The number of people in these roles has grown by over seven percent (from 163,690 to 175,350). Over the next decade, the estimated job growth for these roles is over 31 percent (much higher than the average of 3 percent for all occupations).

So how is the job landscape for cybersecurity roles changing and how do the roles shape up on a state-by-state basis (including the District of Columbia and Puerto Rico)?

We compared data from the last couple of years to find out where you’ll get the highest salary, where the most jobs are, and the best long-term projections for cybersecurity roles. To provide these rankings, we analyzed ten different criteria, each of which was equally weighted to give us our overall scores.

How has the cybersecurity job market changed since 2022?

As you can see from the above chart, things have changed dramatically in some states. For example, Wyoming took a huge leap from 49th to second place, while the District of Columbia has plummeted through the rankings this year, going from fifth to 23rd. Wyoming’s sharp rise stems from the significant increase in a number of areas, including the difference to the state average annual salary (for all types of employment) and its impressive growth in cybersecurity employment over the last year. For the latter, Wyoming saw a whopping 400 percent yearly employment increase from 2022 (when 30 people were employed in the cybersecurity field) to 2023 (150 employees). This was the biggest change for all states.

Despite some states having seen some year-on-year declines, the overall averages paint a positive picture.

Average US-wide changes:

• Average annual salary for cybersecurity roles increased 4.07% from $119,860 (2022) to $124,740 (2023).
• # of people in cybersecurity roles increased 7.12% from 163,690 (2022) to 175,350 (2023).
• Employment per 1,000 people (the number of jobs–employment–in the given occupation per 1,000 jobs in the given area) increased by 5.62% from 1.014 (2022) to 1.071 (2023).
• 10-year growth projection for roles decreased by 1.65 % from 32.11% (2020-2030) to 31.58% (2022-2032).

Recent large-scale incidents, like Russian hackers stealing Microsoft’s source code, emphasize the importance of cybersecurity expertise. The job market looks set to continue growing for many years to come. But prospects look better in some states than others.

Annual salary

The biggest average salary increases for information security analysts were observed in Louisiana (32.99%), Wyoming (27.06%), Montana (23.22%), and South Carolina (16.39%). These increases coincide with state-specific initiatives, such as the 2023 Cybersecurity Awareness Campaign in Wyoming. The initiative emphasizes the importance of increased awareness and vigilance in response to evolving cyber threats.

One state that saw a significant decline in average salary for cybersecurity roles was Oregon (-5.69%). This was in spite of the fact that average salaries across all other types of employment increased for the state.

Number of people in roles

Although the average salary for information security analysts in Oregon has decreased, the number of people in these roles increased significantly (from 1,280 to 1,550). As more jobs have become available this forces the average salary down as employers don’t necessarily have to compete as hard to recruit potential candidates.

In Vermont, the number of cybersecurity roles took a pretty sharp nosedive of over 40 percent, falling from 220 to 130. The figures for employment per 1,000 jobs saw similar drastic changes in Vermont, dropping by over 34 percent.

Available job vacancies

According to figures from Indeed.com, we found the District of Columbia still has the highest number of cybersecurity roles currently available: 3,099. Due to it being the capital of the United States, it is no surprise that cybersecurity professionals are in such high demand.

Virginia still has the second-highest number of vacancies (1,868) followed by Maryland (1,458), and Texas (981). These are some of the most populous states, so the high volume of roles currently available is not surprising.

Long-term growth projections

Perhaps the most interesting comparisons are the changes in long-term growth projections spanning 10 years from 2022 to 2032. It’s intriguing to see how much some of these have changed over time.

Over the past couple of years, these predictions have been positive in most states. However, this is the first time the number of information security analyst jobs is largely projected to decrease. This negative trend might be due to the fact that the projections have already reached their peak in the previous years, and we are intrigued to see if it will continue in the coming years.

Previously, in Wyoming, the number of information security analyst jobs was projected to increase by 50 percent from 2020 to 2030. But more recent estimates (from 2022 to 2032) now put the projected increase at around 33 percent. In California, the projected increase dropped from 13.30 to 9.50 percent over the same period of time.

On the other hand, the improvement in long-term growth projections was observed in Colorado (83.75%) and, especially, New Hampshire (300%) and Mississippi (995.45%). The makes sense in Mississippi, for example, especially when you consider that the number of people in these roles and employment per 1,000 jobs have both seen a significant rise (25% and 23% respectively).

The top-scoring states for cybersecurity roles

According to our research, Virginia is one of the best states to be an information security analyst. It was the highest-ranking state for the number of people currently in cybersecurity roles, as well as the employment per 1000 jobs. It was also the state with a large difference between the average salary for all types of employment vs. the average salary of an information security analyst. On top of that, it boasts a high average annual salary of $134,550 – nearly $10,000 higher than the US average for these roles.

Virginia did experience a drop in the long-term growth projection for cybersecurity roles (now at 30.80 percent compared to 52.40 percent two years ago), however, predictions like these are highly volatile due to the constantly evolving market. Besides, with such a high state average annual salary in the field and steady growth in salary and employment over the past five years, Virginia appears well-positioned to remain a significant hub for cybersecurity roles in the future.

Wyoming, Iowa, North Carolina, and Florida were the other four states that made up the top five. Wyoming had the highest one-year increase in employment and five-year increase in employment, both over 200 percent. Iowa was the only state in the top five to have a higher average annual salary than Virginia (with $143,960), which also makes it one of the best-paid states for information security analysts.

The highest-scoring states per category were:

1. Highest average annual salary – Washington – $148,090
2. Highest % difference to state average annual salary for all types of employment – Iowa – 87.40%
3. Highest number of people currently in these roles – Virginia – 18,460
4. Highest employment per 1,000 jobs – Virginia – 4.63
5. Highest number of jobs currently being advertised for – District of Columbia – 3,099
6. Best long-term projection for roles – Utah – 57.60% growth
7. Best 5-year increase in employment numbers (from 2016 to 2021) – Wyoming – 200%
8. Best 5-year increase in average annual salary (from 2016 to 2021) – Iowa – 73.38%
9. Best 1-year increase in employment numbers (from 2016 to 2021) – Wyoming – 400% growth
10. Best 1-year increase in average annual salary (from 2016 to 2021) – Louisiana– 32.99% growth

The lowest-scoring states for cybersecurity roles

At the bottom of our table was Vermont – It scored the lowest for the number of people currently in cybersecurity roles (130) and for the one-year increase in employment (-31.58%). Due to it being one of the smallest territories, Vermont’s low score is probably due to a lack of demand for these roles.

Maine, West Virginia, Alaska, and Puerto Rico were the other four states in the bottom five. All scored low for the number of people currently in these roles and job vacancies, and then across the board for most other categories. Puerto Rico, however, is expected to see a great increase in the number of cybersecurity jobs available–growing by 41.50 percent from 2022 to 2032.

West Virginia saw a large decline in employment over the last five years (down 22.22% for information security analysts). However, all of the bottom five states saw 1-year increases in annual salaries for information security analyst roles, which would be quite surprising if it weren’t for the high inflation rate across the United States.

The lowest-scoring states per category were:

1. Lowest average annual salary – Puerto Rico – $59,430
2. Lowest % difference to state average annual salary for all types of employment – District of Columbia – 23.71%
3. Lowest number of people currently in these roles – Vermont – 130
4. Lowest employment per 1,000 jobs – Louisiana – 0.260
5. Lowest number of jobs currently being advertised for – Wyoming – 20
6. Worst long-term projection for roles – Wisconsin – 1.30% rise
7. Worst 5-year change in employment numbers (from 2018 to 2023) – West Virginia – 22.22% decline
8. Worst 5-year change in average annual salary (from 2018 to 2023) – Alaska – 0.37% growth
9. Worst 1-year change in employment numbers (from 2022 to 2023) – Vermont – 31.58 % decline
10. Worst 1-year increase in average annual salary (from 2022 to 2023) – Oregon – 5.69% decline

Which state should you head to for the best cybersecurity roles?

Initially, you may consider Washington thanks to the highest salary ($148,090). Alternatively, you might opt for the District of Columbia for its large number of job vacancies (3,099) and high salary ($134,810). Or, there’s California with its even more attractive average wage of $140,730, which is 12.05% higher than the state average, and 58.59% higher than CA’s average salary for all types of employment.

You could even look toward somewhere like Utah, which has the best long-term projections for these roles (57.6% growth over the next 10 years), offering even more job security. The only thing letting Utah down slightly is its salary ($108,540), but this is only 13.89 percent lower than the average ($124,740) across all states. Also, with a 25.06 percent increase in the annual salary over the last five years, it might not be long until you’re enjoying the same or better wage.

Ultimately, the majority of states offer great prospects for cybersecurity roles. All states except Vermont show at least some positive growth (when looking at the long-term projections) and each and every state has an average cybersecurity salary that’s above the state average for all types of employment.

Methodology and limitations

To figure out how well (or poorly) these roles were represented in each state, we used ten different criteria, each of which was equally weighted to give us our overall scores. These were:

• The average state annual salary for cybersecurity roles
• The % difference of the annual salary for cybersecurity roles to the average annual salary of all types of employment in each state
• The number of people employed in cybersecurity roles in the state
• The number of people in cybersecurity roles per 1,000 jobs (the number of jobs–employment–in the given occupation per 1,000 jobs in the given area)
• The number of cybersecurity roles currently being advertised for by the state
• The long-term projections for cybersecurity roles in each state (over a 10-year period)
• The 5-year change in employment numbers (from 2018 to 2023) in each state
• The 5-year change in average annual salaries (from 2018 to 2023) in each state
• The 1-year change in employment numbers (from 2022 to 2023) in each state
• The 1-year change in average annual salaries (from 2022 to 2023) in each state

To score each criterion, we gave each state a point based on where it appeared between the highest- and lowest-scoring states. The state that received the best score for a criterion got 100 points, while the lowest-scoring stats received a zero. Then, all of the states in between these two figures were ranked on a percentile basis to give them their scores.

To achieve the total score we averaged the state’s score across all ten of the categories.

Some states were subject to limitations:

For example, Wyoming didn’t recognize “information security analysts” as roles for their average salaries. Therefore, we used the closest roles available – ”computer system analysts”.

The states of Kansas, Maryland, Puerto Rico, and Montana also failed to provide information security analyst data for long-term projections and therefore also used computer systems analysts. This time around, Maine did provide scores for Information Security Analysts compared to using computer systems analysts last time.

For employment per 1,000 jobs, 2023 figures were unavailable for Montana, so instead, figures were taken from the 2022 release.

For Montana’s figures in the 5-year growth calculations, we used the number of people employed and the corresponding annual average salary from 2021, as the relevant information for 2022 was not yet available.

Many of these limitations are due to how new these roles are. We also used “cybersecurity” as a search term on indeed.com to cover the various titles these information security analyst roles come with. For example, while a company may refer to the role as a “cybersecurity engineer,” the state would place this under the “information security analysts” bracket when presenting its figures for employment.

Researcher: Danka Delić