SOC Analyst Salary Guide 2026

Last updated: September 18, 2026

By Tom Kenaley, President and Senior Partner, KORE1

In 2026 a SOC analyst’s base salary runs from about $58,000 for a new Tier 1 hire to roughly $145,000 for an experienced Tier 3, with most Tier 2 investigators paid $80,000 to $110,000. The $129,180 figure most salary pages quote is the federal median for every information security analyst, a much wider job code, and most Tier 1 offers land below that code’s 10th percentile.

Three or four times a quarter somebody forwards me the same Bureau of Labor Statistics page. Usually a CFO. Usually with one line typed above the link, some version of “Is this real?”

It’s real. It just describes a different job.

BLS files SOC analysts under code 15-1212, information security analysts, and in its May 2025 survey that code counted 190,650 people on U.S. payrolls. Plenty of them have never worked a monitoring shift. The same code holds the analyst clearing phishing alerts at 2 a.m. for a managed security provider in San Antonio. It also holds a security architect at a Seattle cloud company. I’d guess she hasn’t looked at a raw alert since 2019. Somewhere in Arlington a federal employee in the same code is writing access-control policy for an agency, and if you average those three people together you get an honest number, just not one you can put in an offer letter.

A hospital system in the Phoenix area ran into the opposite mistake this spring. They needed a Tier 2 analyst for overnight coverage, someone who could take an escalation from the Tier 1 on shift, pull the Microsoft Sentinel logs, and decide at 3 a.m. whether the CISO needed a phone call. Their HR team looked at the BLS page and decided it was inflated. Fair enough. So they pulled a “SOC analyst” average off a salary site instead, got $78,000, and posted that.

Forty-one applications came in over three weeks. Most were help desk technicians with a new Security+ and no incident work behind it. The two applicants who had actually run containment on a live ransomware case both wanted more than $95,000, and both asked what nights paid. The ad didn’t say. Nights paid nothing extra.

They reposted at $94,000 with a $6,000 overnight differential and hired at $97,000 about three weeks after that. Nobody on that team was careless. They priced the right title at the wrong tier.

Where I sit matters here, so I’ll say it. KORE1 runs SOC analyst staffing searches for a fee that usually moves with salary, which means a higher band never hurts us. Check me. Every outside figure below links to its source, and anything drawn from our own desk is labeled that way. If you’re an analyst reading this to plan your own next move, our SOC analyst career path guide was written for you. This one is written for whoever signs the offer letter.

What the Federal Number Actually Covers

A SOC analyst salary is the base pay for someone working inside a security operations center, watching alerts from tools like Splunk, Microsoft Sentinel, and CrowdStrike Falcon, triaging them, and escalating or containing the real incidents. It’s quoted by tier, from Tier 1 triage up through Tier 3 hunting, and it rarely lines up with the broader federal category.

Here is what BLS published for that broader category in May 2025. The right-hand column is my reading of which SOC seat usually earns each figure, based on the searches we run. BLS doesn’t make that claim. I do.

Source: BLS Occupational Employment and Wage Statistics profile, May 2025, SOC 15-1212. Mean annual wage $132,510. Median hourly wage $62.11.

Most of the real Tier 1 band sits under that 10th percentile. That’s the trouble with quoting the median to a hiring committee. Either the committee pays a triage seat like a senior one, which happens less often than people assume, or it decides the federal figure is padded and goes looking for the lowest number on the internet instead. Phoenix did the second thing. Plenty of companies do.

Demand isn’t cooling, either. The BLS Occupational Outlook Handbook expects information security analyst jobs to grow 21% over the decade ending in 2035, much faster than the average across all occupations, which works out to roughly 14,100 openings every year. None of those openings come with an experienced analyst attached. Supply hasn’t kept up.

Three Salary Sites, a $56,000 Spread

I pulled three public salary sites on September 18, 2026, and set them next to BLS. They disagree by a lot. They should, because they aren’t counting the same person.

SalaryExpert’s senior number gives the game away. $79,634 for eight-plus years only makes sense if “SOC analyst” means a monitoring seat and nothing else, and an analyst who stays in that seat for eight years without moving into Tier 3 or engineering is rare, and honestly not who most employers are trying to hire. Most move up or out. Levels.fyi sits at the other end. Its company breakdowns start with Deloitte, Accenture, EY, and PwC, its top payers are Microsoft, Google, and Amazon, and its figure folds in stock.

Talent.com lands in between. Its $90,000 is the closest of the three to a working Tier 2 number. I still wouldn’t post it before deciding the tier.

The Bands We Quote, Tier 1 to SOC Manager

These are the bands we work from when a client asks what to post. They blend the aggregator data, the BLS percentiles above, and the offers our recruiters have watched get accepted or turned down over the past twelve months. Treat them as a starting point. The national column fits most of the country. The high-cost column fits San Jose, San Francisco, Seattle, and the cleared market around Washington.

The widest gap on that table isn’t between two tiers. It’s inside Tier 2. One Tier 2 reads alerts somebody else wrote. Another one rewrites the Splunk correlation searches every time they get noisy. She also wrote half the KQL hunting queries the night shift borrows in Sentinel, which is why she draws offers $15,000 to $20,000 above the first analyst, because she’s halfway to detection engineering already and every recruiter who calls her knows it. Her manager knows it too.

Bonuses are small in this work. SalaryExpert’s employer data puts the average at $2,843 on a $68,949 base, roughly 4%, and equity mostly shows up at software companies. Most SOC offers carry none. Base is the number that decides the search. For a band cut by one specific metro and tier, the KORE1 salary benchmark assistant will do it in about a minute.

Once a SOC grows past about a dozen analysts, the manager row starts to look like a different hire altogether, with budget and on-call escalation and a board slide every quarter, and we usually run it as security operations manager staffing rather than as a senior analyst search. The candidates differ.

Twenty-Four Metros, and the Index That Adjusts a Band

BLS publishes metro medians for the whole information security analyst code, and they’re the cleanest tool I know for moving a national band to a city. Divide the metro median by the national $129,180. Multiply the band by what you get. San Jose comes out at 1.36, which turns an $80,000 to $110,000 national Tier 2 band into roughly $109,000 to $150,000. Tampa comes out at 0.92. The whole thing takes a minute.

Source: BLS OEWS metropolitan estimates, May 2025, SOC 15-1212, pulled from the BLS public data API. Index is the metro median divided by the $129,180 national median.

The Washington metro employs 16,560 of these analysts, almost 9% of the national total and nearly one and a half times New York’s 11,330. That’s the federal government and the contractor base around it, and it’s why a cleared SOC search in Northern Virginia behaves like its own market. It is one. Raleigh surprised me. It sits fifth, ahead of New York. Los Angeles, including Orange County, lands almost exactly on the national figure.

Tampa is the odd one. It has 2,460 analysts, more than San Jose, and the lowest median on the list. My read, and it’s only a read, is that Tampa’s security workforce runs heavy on Tier 1 and Tier 2 seats at managed providers, which pulls the median down without making senior people there any cheaper to hire. Senior hires there aren’t discounted.

An MSSP in San Antonio called us last year after losing four of its eleven Tier 1 analysts in twelve months. Starting pay was $58,000. That’s fine for Tier 1 in that market. The trouble was month thirteen. Nothing happened. The pay stayed flat at the one-year mark, the work too, while contractor SOCs across town were paying $68,000 to $75,000 to anyone with eighteen months of ticket history and a clean background check. They added a twelve-month step to $66,000 and put a written path to Tier 2 in the offer letter. The following year they lost two.

Remote seats mostly price off the national column. Employers hiring remote rarely pay San Jose rates to someone living in Boise. Candidates know it.

Federal Agencies Outbid Hospitals by $40,000

Industry moves the number too, sometimes more than the city does. Same code, same May 2025 survey, national medians.

A hospital SOC and a federal agency SOC can be hiring the same Tier 2 in the same city, and the gap between their industry medians is $40,810. Hospitals know it. Their budgets rarely move. They lose people to banks and contractors constantly, and the Phoenix system from the top of this page had already lost its previous overnight analyst to a defense contractor in Chandler. State government sits at the bottom, at $97,590, which is why so many state SOCs lean on contractors and managed providers for nights.

MSSPs mostly land inside computer systems design, where the median is $132,410. Don’t read that as MSSP pay. That category also holds every security consultant and architect working at an IT services firm. On the searches we run, an MSSP seat pays $5,000 to $10,000 less than the same tier at an in-house corporate SOC, and candidates take the discount because they see thirty client environments in a year instead of one. They learn fast.

Nights, Weekends, and the Differential Nobody Posts

Round-the-clock coverage is where SOC pay stops behaving like other IT pay. Nights cost more. Keeping a single seat filled 24 hours a day, 7 days a week takes roughly five people once you count vacations, training, and turnover, and our guide to hiring a SOC analyst walks through that headcount. What I want to cover here is what those people expect to be paid for it.

Where employers pay a night differential, it usually runs $5,000 to $8,000 a year. Plenty pay nothing. They call it shift flexibility, or they put it in the job ad as “must be available for rotating shifts” and leave the number out, and that is precisely the posting experienced analysts skip. Anyone who’s done two years of overnights on a 2-2-3 rotation reads that line and asks one question. What does it pay? I’ve watched Tier 2 analysts accept $5,000 less for a straight day schedule. More than once. They sleep better.

On-call is its own line item. A Tier 3 carrying the pager one week in four expects either a stipend or a base that already accounts for it. When neither exists, resentment builds. It usually boils over around the third Saturday lost to an incident.

Clearance, Certifications, and the Premiums That Hold Up

Not every credential moves an offer. Some do, a lot. Here’s how they sort out on our desk.

• An active TS/SCI adds $15,000 to $30,000 to a SOC offer around Washington, more with a full-scope polygraph, and the same pattern shows up in Colorado Springs and Huntsville. It’s the largest single premium in this job. It’s also the one you can’t manufacture quickly, since a new investigation takes months.
• Security+? Table stakes. It counts toward DoD 8140 qualification for defense work, and it’s a common screen everywhere else, so it earns no premium, but a missing one costs candidates interviews.
• GCIH, GCIA, and Microsoft’s SC-200 are worth something from Tier 2 up, typically $5,000 to $10,000 in a negotiation, mostly because they prove hands-on hours.
• Hands-on Splunk Enterprise Security or Sentinel content work, the kind that shows up in a candidate’s own detections rather than on a certificate, beats all three.

ISC2’s 2025 Cybersecurity Workforce Study, which surveyed 16,029 security professionals worldwide in July and August 2025, found that 29% of respondents say their organizations can’t afford to hire staff with the skills they need, and 10% say the right people are out there but priced beyond reach. That second group worries me more. They did the hard part. Knowing exactly who you need and losing them on price is a slower, more expensive way to stay understaffed.

Hourly Rates for Contract SOC Work

BLS puts the median hourly wage for the whole category at $62.11. Contract SOC work sits below that at Tier 1 and above it once you’re paying for hunting or detection engineering. Here are typical W-2 pay rates on the contract searches we run, before any staffing markup. A Tier 1 contractor earns about $30 to $40 an hour. Tier 2 is more like $40 to $55. By Tier 3 you’re paying $55 to $72, and a detection engineer or incident responder brought in for one short, specific engagement runs $65 to $85, higher again when the work is cleared and the timeline is a week.

Contract fits SOC work better than most people expect. Projects end. A SIEM migration from Splunk to Sentinel has a finish line. So does rebuilding a detection library after a red team exercise, or covering nights while a permanent search runs. ISC2’s study found 17% of organizations brought in temporary contractors to cover skills gaps, next to 20% that outsourced the work and 19% that used a third-party provider. When the seat is permanent but the fit is uncertain, contract-to-hire lets both sides see a few months of real shifts first. For the bounded projects, straight contract staffing is usually cheaper than a permanent headcount you’ll carry after the migration is done.

The SOC Pay Questions on Our Desk This Year

Can a SOC analyst actually make $200,000?

A few do, but almost never with “SOC analyst” still on the business card.

The BLS 90th percentile for the whole information security analyst code is $199,850, and the people at that level are SOC managers, detection engineering leads, and cleared Tier 3 analysts on programs around Washington. At Microsoft, Google, and Amazon, Levels.fyi shows cybersecurity analyst total comp at or above $200,000, stock included. That’s real money. Few SOC analysts ever see it.

MSSP or an in-house SOC, which one pays more?

Short answer: in-house, usually by $5,000 to $10,000 at the same tier on the searches we run.

Industry swamps that difference, though. A hospital SOC and a software company SOC sit $40,000 apart at the median. Pick your comparison carefully.

What should a night-shift Tier 1 offer include in 2026?

$62,000 to $70,000 base in a mid-cost metro, plus a written night differential of at least $5,000.

Put the schedule in the posting, exactly. Say whether it’s a fixed overnight, a 2-2-3 rotation, or four tens, and say how often weekends come around. Tier 1 candidates with a year of nights behind them will compare three offers side by side on those details, and the one that’s vague loses, even at a few thousand dollars more. We’ve watched finalists walk. Sleep matters. So does knowing which Saturdays they’ll have.

Does a fully remote SOC seat pay less?

Remote seats get priced off the national column instead of the most expensive metro, so they usually come in a little lower.

Most fully remote SOC work sits at MSSPs and MDR providers. MSSPs pay less anyway. Anything touching classified systems is on-site, full stop, and a lot of banks and health systems want at least some days in the building.

Is AI triage going to flatten SOC pay?

Not for the analysts who tune it.

AI was the top skills need in the ISC2 2025 study, cited by 41% of respondents, ahead of cloud security at 36%. Our clients say the same. I expect fewer pure alert-clearing seats over the next few years, and the ones that remain will look more like Tier 2 from the first day. The analyst who can tell an AI triage tool why its verdict was wrong, and fix the rule that fed it, is exactly the person whose pay I’d expect to keep climbing. The one who only closes what the tool hands over is in a harder spot. I could be wrong about the timeline. I’d still bet on the direction.

How big a raise does a SOC analyst expect after a year?

57% of the security professionals ISC2 surveyed in 2025 got a raise between 1% and 9% last year, and 20% got nothing at all.

Only 20% saw more than 10%. That’s a global figure across security roles, not SOC-only, and 31% of respondents named insufficient pay as a problem with the job. In our experience the raise that actually moves a SOC analyst is the tier change, which tends to come every two to three years. Promotions pay. Write that step into the offer letter. People read it. The San Antonio MSSP did, and it cut its Tier 1 losses in half.

Price the Shift Before the Title

The order you set these numbers in matters more than any single figure on this page. Tier comes first, because a Tier 2 who writes detections and a Tier 1 who clears phishing alerts are different hires with different markets. Then the shift, since nights without a differential cost you the second-best candidate right away and the best one about a year later. Then the metro index. The federal median goes last, and honestly it can mostly stay in the drawer.

Pay decides who stays, too. 92% of the people KORE1 places are still in the job twelve months later, and in security operations, where a strong Tier 1 can add $30,000 to their market value in three years, the band is doing a lot of that work.

If you’ve got a SOC req with a number already on it, send it to one of our cybersecurity recruiters before it posts. We’ll tell you which tier it actually reads as. The SOC analyst job description template handles the posting itself, and our SOC analyst interview questions cover the loop once people start applying.