2021 US Cybersecurity Salary & Employment Study – which state has the best prospects?

US Cybersecurity Salary & Employment Study

In a world where data protection is becoming increasingly important, cybersecurity roles are at the heart of many companies’ employment strategies.

Often defined as “information security analysts,” these roles involve planning and implementing security measures that help protect an organization’s computer systems and networks. This includes installing software (such as firewalls and data encryption programs), investigating security breaches, and looking for potential vulnerabilities before they are exploited.

In 2019, the average salary for cybersecurity roles was $94,984 per year, 2.4% more than the average salary in 2018 ($92,789), and the number of people in these roles had grown by over 16% (from 108,440 to 125,950). Furthermore, over the next 10 years (2019 to 2029), the estimated job growth for these roles is 31 percent (much higher than the average of 4 percent).

So how is the job landscape for cybersecurity roles changing and how do the roles shape up on a state-by-state basis (including the District of Columbia and Puerto Rico)?

We compare data from the last couple of years to find out. And we reveal where the cybersecurity job hotspots are, including where you’ll get the highest salary, where the most jobs are, and where the best long-term projections for these roles are.

How has the cybersecurity job market changed from 2018 to now?

In 2019, we conducted this study for the first time. So how have things changed since then?

As you can see from the above chart, things have changed dramatically in some states. For example, Connecticut has plummeted through the rankings this year, going from 20th place to 50th, while Hawaii has shot up the rankings from 43rd to 9th. Connecticut’s sharp decline stems from drops in a number of areas, including the average salary, number of people in cybersecurity roles, number of job vacancies, and 10-year growth projection.

Although some states have seen some declines year-on-year, the overall averages paint a more positive picture with every area improving on the previous year’s data.

Average US-wide changes:

Average annual salary for cybersecurity roles: Increase of 2.37% from $92,789 (2018) to $94,984 (2019).
# of people in cybersecurity roles: Increase of 16.15% from 108,440 (2018) to 125,950 (2019).
Employment per 1,000 people: Increase of 12.4% from 0.72 (2018) to 0.81 (2019).
# of job vacancies currently available: Increase of 5.64% from 44,362 (2019) to 46,866 (2021).
10-year growth projection for roles: Increase of 7.62% from 0.27% (2016-2026) to 0.29% (2018-2028).

With recent and large-scale incidents, such as Hafnium targeting Microsoft Exchange servers, placing a huge emphasis on the key importance of cybersecurity infrastructure, the job market looks set to continue growing for many years to come. But there are certain states where the prospects look better than others.

Annual salary

The biggest average salary increases for information security analysts were observed in Puerto Rico (16.45%), Nevada (14.79%), Hawaii (14.63%), and Montana (14.6%). These increases could be facilitated by state-specific initiatives such as the multi-million dollar cybersecurity investment approved by Montana’s government, part of which was intended to help improve salaries in the industry.

One state that saw a significant decline in average salary for these roles was Rhode Island (-12.89%). This was in spite of the fact that average salaries across all types of employment increased for the state.

Number of people in roles

The number of people in information security analyst roles increased dramatically (by 68.63%) in North Carolina. The same figure took a pretty sharp nosedive of 40% in North Dakota, but it wasn’t very high there to begin with, tumbling from just 200 to 120. The figures for employment per 1,000 jobs saw similarly drastic changes in North Carolina and North Dakota.

Available job vacancies

The largest percentage increases in job vacancies tended to be in states that had a low number of openings to start with. For example, in Puerto Rico, the number increased 575% from 4 to 27. And South Dakota saw a 219.23% increase from 26 to 83 vacancies.

The state with the most drastic decline in vacancies was Delaware with the number of openings dropping from 653 to 163. The average salary in the state for these roles was already fairly high and saw a healthy increase, so it could be that employers were willing to pay more to get these roles filled.

Long-term growth projections

Perhaps the most interesting comparisons are the changes in long-term growth projections. It’s intriguing to see how much some of these have changed over time. Take Maryland, where the long-term growth projection for information security analyst roles has increased 417.74% from 7.61% to 39.40%. And prospects are looking similar in Massachusetts where projections have increased by 370.87% from 6.18% to 29.1%.

Some notable declines in long-term growth projections were observed in Mississippi (-81.92%) and Montana (-77.41%). The latter makes sense when you consider that the number of people in these roles, employment per 1,000 jobs, and the number of vacancies have all seen significant declines (-8.33%, -13.46%, and -14.95%, respectively).

The top-scoring states for cybersecurity roles

According to our research, Virginia is the best state in which to be an information security analyst. It was the highest-ranking state for the number of people currently employed in these roles, employment per 1,000 jobs, and the number of job vacancies currently available. It also received a high score for its average annual salary.

However, there were some weak points to Virginia’s cybersecurity landscape. Since 2014, the average salary and number of people employed in these roles have grown at a slower pace than in many other states. But this is perhaps due to the vast number of roles already available, and it doesn’t seem to dampen the long-term projections for these roles (45.4 percent growth from 2018 to 2028).

Texas, Nevada, Maryland, and North Carolina were the other four states that made up the top five. Texas and Nevada both performed better than Virginia with recent salary increases over both one- and five-year periods. However, only cybersecurity analysts in New York ($121,750), New Jersey ($121,570), and District of Columbia ($119,160) receive a higher average salary ($122,000) than those in Virginia ($111,780).

The top 5 states at a glance

Rank	Score	State	Average Annual Salary	# of People Currently in These Roles	Employment per 1,000 of Jobs	# of Job Vacancies Currently Available	Long-Term Growth Projection for Roles by 2028 (from 2018)	5-Year Increase in Employment #	5-Year Increase in Annual Salary
1	70.79	Virginia	$114,760	15,010	3.87	5,213	45.40%	46.15%	9.61%
2	60.67	Texas	$108,810	10,430	0.84	3,406	38.20%	69.04%	21.70%
3	54.39	Nevada	$102,770	500	0.36	171	50.00%	72.41%	45.84%
4	54.09	Maryland	$108,300	5,860	2.17	3,379	39.40%	94.04%	7.22%
5	55.06	North Carolina	$101,130	6,020	1.35	1,571	35.80%	98.68%	16.09%

The highest-scoring states per category were:

Highest average annual salary – New York – $121,750
Highest % difference to state average annual salary for all types of employment – New Mexico – 79.84%
Highest number of people currently in these roles – Virginia – 15,010
Highest employment per 1,000 jobs – Virginia – 3.87
Highest number of jobs currently being advertised for – Virginia – 5,213
Best long-term projection for roles – Utah – 59.30% growth
Best 5-year increase in employment numbers (from 2014 to 2019) – District of Columbia – 192.75%
Best 5-year increase in average annual salary (from 2014 to 2019) – Nevada – 45.84%
Best 1-year increase in employment numbers (from 2018 to 2019) – North Carolina – 68.63% growth
Best 1-year increase in average annual salary (from 2018 to 2019) – Nevada – 14.79% growth

The lowest-scoring states for cybersecurity roles

At the bottom of our table was Vermont—it scored fairly low for average annual salary, the number of jobs currently available, and its one-year increase in employment and annual salary. This is probably due to a lack of demand for these roles within Puerto Rico. However, when we look at the long-term growth projection for roles by 2028, things do look like they could get better. While there was a decrease in employment (-7.96%) over the past year, the projected 10-year forecast predicts growth of 21.40%. Average salary decreased slightly (-1.41%) in the past year but the average salary for these roles is 48.09% higher than the state average.

Louisiana, Connecticut, Alaska, and Wyoming were the other four states in the bottom five. Louisiana and Wyoming followed a similar pattern to Vermont in terms of having low salaries, and have both seen declines in employment over the past five years. In Alaska, there’s low demand, and annual salaries have seen a one-year decline, while in Connecticut, both employment and average salaries have decreased over the year. That said, all but Louisiana are expected to see significant growth in the number of available roles within the next 10 years.

The bottom 5 states at a glance

Rank	Score	State	Average Annual Salary	# of People Currently in These Roles	Employment per 1,000 of Jobs	# of Job Vacancies Currently Available	Long-Term Growth Projection for Roles by 2026 (from 2016)	5-Year Increase in Employment #	5-Year Increase in Annual Salary
48	27.24	Wyoming	$79,010	50	0.17	31	6.10%	85.71%	9.69%
49	26.11	Alaska	$97,000	70	0.21	74	11.50%	50.72%	7.92%
50	25.74	Connecticut	$101,530	850	0.51	393	34.09%	9.09%	15.22%
51	24.93	Louisiana	$75,250	600	0.31	301	22.70%	53.33%	24.95%
52	24.42	Vermont	$83,490	120	0.38	49	23.99%	84.21%	-9.82%

The lowest-scoring states per category were:

Lowest average annual salary – Puerto Rico – $49,420
Lowest % difference to state average annual salary for all types of employment – District of Columbia – 28.10%
Lowest number of people currently in these roles – Wyoming – 50
Lowest employment per 1,000 jobs – Wyoming – 0.17
Lowest number of jobs currently being advertised for – Puerto Rico – 27
Worst long-term projection for roles – Vermont – 1% decline
Worst 5-year change in employment numbers (from 2014 to 2019) – Wyoming – 82.76% decline
Worst 5-year change in average annual salary (from 2014 to 2019) – Idaho – 0.69% decline
Worst 1-year change in employment numbers (from 2018 to 2019) – North Dakota – 40% decline
Worst 1-year increase in average annual salary (from 2018 to 2019) – Rhode Island – 12.89% decline

Which state should you head to for the best cybersecurity roles?

Initially, you may consider Virginia thanks to its vast number of current roles and great salary. Or, you might opt for New York with its even more attractive salary ($121,750) that’s 24.7% higher than the average information security analyst salary ($94,984) and 62.22% higher than NY’s average salary (for all types of employment).

You could even look toward somewhere like Utah, which has the best long-term projections for these roles, offering even more job security. The only thing letting Utah down is its salary ($88,480) which is 7.09% lower than the average for information security analysts. But with a 10.52% increase in the annual salary over the last 5 years, it might not be long until you’re enjoying the same or better salary.

Ultimately, the majority of states offer great prospects for cybersecurity roles. All states except Louisiana show at least some positive growth (when looking at the long-term projections) and each and every state has an average cybersecurity salary that’s above the state average for all types of employment.

Our methodology: how did we find the best and worst states for cybersecurity roles?

To figure out how well (or poorly) these roles were represented in each state, we used ten different criteria, each of which was equally weighted to give us our overall scores. These were:

The average state annual salary for cybersecurity roles
The % difference of the annual salary for cybersecurity roles to the average annual salary of all types of employment in each state
The number of people employed in cybersecurity roles in the state
The number of people in cybersecurity roles per 1,000 jobs
The number of cybersecurity roles currently being advertised for by the state
The long-term projections for cybersecurity roles in each state (over a 10-year period)
The 5-year change in employment numbers (from 2014 to 2019) in each state
The 5-year change in average annual salaries (from 2014 to 2019) in each state
The 1-year change in employment numbers (from 2018 to 2019) in each state
The 1-year change in average annual salaries (from 2018 to 2019) in each state

To score each criterion, we gave each state a point based on where it appeared between the highest- and lowest-scoring states. The state that received the best score for a criterion got 100 points, while the lowest-scoring stats received a zero. Then, all of the states in between these two figures were ranked on a percentile basis to give them their scores.

To achieve the total score we averaged the state’s score across all ten of the categories.

Some states were subject to limitations:

The states of Arizona, Kentucky, Louisiana, and Puerto Rico didn’t recognize “information security analysts” as roles in their 10-year projections. Therefore, we used the closest roles available—“computer system analysts.” These were only used for the long-term projection scores. Despite giving us low scores they did seem to reflect the demand for cybersecurity roles within these states.

For Wyoming’s 2014 figures (utilized in the 5-year growth calculations), we used the number of people employed in computer systems analyst roles and the corresponding annual average salary, as the relevant information for information security analysts wasn’t available at this time.

Many of these limitations are due to how new these roles are. And this is why we also used “cybersecurity” as the search term on Monster.com so as to cover the various titles these information security analyst roles come with. For example, while a company may refer to the role as a “cybersecurity engineer,” the state would place this under the “information security analysts” bracket when presenting its figures for employment.

Researcher: Charlotte Bond