Information Security Analysts

Career summary

Information security analysts work with companies to build secure computer systems. They question managers and staff about their current security methods. They find out what information the company wants to protect. They determine what information employees should be able to access.

Analysts install software that protects the information. They may also make changes to existing software. They test the system once changes are made to make sure it works. They train staff on how to use security software and properly use computers to prevent security problems.

Analysts may build firewalls if the data are available to people over the Internet. These electronic walls keep people outside of an organization from accessing the protected information. They may encrypt information so that it remains confidential. They monitor virus software and update it regularly.

Information security analysts write rules and procedures for employees to follow once the security system is in place. Each part of the security plan must be followed for it to be effective. Analysts in some companies coordinate security for vendors and customers in addition to employees.

Analysts may also be responsible for physically locking down the hardware. They may buy equipment to secure servers, monitors, and hard drives so they cannot be removed from buildings. Larger companies may purchase metal detectors or video cameras as part of their security plan.

Information security analysts monitor data logs that report all the activity on a system. They look for any strange activity in the records. Some programs alert employees when there is a problem. Analysts evaluate security breaks and determine if there are problems or errors. If there is a problem, analysts track where the break came from and shut off the access point.

Some analysts work for temporary agencies that contract their services to different companies.

Related careers

This career is part of the Information Technology cluster of careers.

Related careers include:

• Computer Engineers
• Computer Network Architects
• Computer Network Support Specialists
• Computer Systems Administrators
• Computer Systems Analysts
• Computer User Support Specialists
• Database Administrators
• Electrical and Electronics Engineers
• Engineering Technicians
• Validation Engineers
• Video Game Testers
• Web Developers

Job duties

Task list

The following list of tasks is specific to information security analysts.

• Talk with staff to learn information security needs.
• Train computer users about how to use computer systems securely and to promote efficiency.
• Develop plans to protect computer files.
• Modify files or write new software to limit access.
• Test system to ensure the programs are working and the security measures are in place.
• Write reports to document security procedures.
• Coordinate computer system plan with internal and external users.
• Monitor use of data files and regulate access to protected files.
• Assess and identify breaks in security. Investigate security breaks to locate the problem.
• Monitor and update virus software.
• Encrypt data and install firewalls to protect confidential information.

Common work activities

Information security analysts perform the following tasks. These tasks are common to many careers.

• Use computers
• Get information needed to do the job
• Identify objects, actions, and events
• Evaluate information against standards
• Process information
• Analyze data or information
• Update and use job-related knowledge
• Document and record information
• Communicate with supervisors, peers, or subordinates
• Make decisions and solve problems
• Monitor events, materials, and surroundings
• Explain the meaning of information to others
• Organize, plan, and prioritize work
• Think creatively
• Establish and maintain relationships
• Perform administrative tasks
• Develop goals and strategies
• Estimate sizes, quantities, time, cost, or materials needed
• Communicate with people outside the organization
• Judge the value of objects, services, or people
• Provide advice and consultation to others

Work requirements

Working conditions

In a typical work setting, information security analysts:

Interpersonal relationships

• Have a high level of contact with users, managers, and vendors.
• Communicate daily by telephone, e-mail, and in person. They occasionally write letters and memos.
• Are somewhat responsible for the work done by other workers.
• Often work as a part of team of computer professionals.

Physical work conditions

• Always work indoors.
• Work near others, such as when sharing office space.

Work performance

• Must be sure that all details are done and their work is exact. Errors could seriously endanger companies' data files.
• Regularly make decisions that strongly impact a client, company, and coworkers. They make most decisions without consulting a supervisor first.
• Set nearly all their daily tasks and goals without talking to a superior first.
• Must meet strict weekly deadlines.
• Work in a moderately competitive atmosphere.
• May repeat the same mental tasks.

Hours/travel

• Generally work a set schedule.
• Most work 40 hours per week.
• May work evenings or weekends to meet deadlines or solve problems.
• May travel to different companies within the city or nation if working as a consultant.

Physical demands

Information security analysts frequently:

• Sit for long periods of time.
• Use their hands to handle, control, or feel objects, tools, or controls.

It is important for information security analysts to be able to:

• See details of objects that are less than a few feet away.
• Understand the speech of another person.
• Speak clearly so listeners can understand.

It is not as important, but still necessary, for information security analysts to be able to:

• See details of objects that are more than a few feet away.
• Use fingers to grasp, move, or assemble very small objects.
• See differences between colors, shades, and brightness.
• Hold the arm and hand in one position or hold the hand steady while moving the arm.

Skills and abilities

Information security analysts need to:

Communicate

• Read and understand work-related materials.
• Understand spoken information.
• Understand written information.
• Write clearly so other people can understand.
• Listen to others and ask questions.
• Speak clearly so listeners can understand.

Reason and problem solve

• Combine several pieces of information and draw conclusions.
• Use reasoning to discover answers to problems.
• Notice when something is wrong or is likely to go wrong.
• Analyze ideas and use logic to determine their strengths and weaknesses.
• Follow guidelines to arrange objects or actions in a certain order.
• Recognize the nature of a problem.
• Develop rules that group items in various ways.
• Judge the costs and benefits of a possible action.
• Recognize when important changes happen or are likely to happen in a system.
• Understand new information or materials by studying and working with them.
• Concentrate and not be distracted while performing a task.
• Think of original, unusual, or creative ways to solve problems.
• Think of new ideas about a topic.
• Identify what must be changed to reach goals.

Manage oneself, people, time, and things

• Check how well one is learning or doing something.
• Manage the time of self and others.

Work with people

• Change behavior in relation to others' actions.

Work with things

• Inspect and evaluate the quality of products.
• Watch gauges, dials, and output to make sure a machine is working properly.

Perceive and visualize

• Identify a pattern (a figure, object, word, or sound) that is hidden in distracting material.
• Quickly and accurately compare letters, numbers, objects, pictures, or patterns.

Education and training

Educational programs

The programs of study listed below will help you prepare for the occupation or career cluster you are exploring.

Programs of study directly related to this occupation

• Computer Science
• Computer Systems Analysis
• Computer Systems Networking and Administration
• Cyber-computer Forensics and Counterterrorism
• Information Technology

Other programs of study to consider

• Computer Programming
• Computer Support Specialist
• Electronic Commerce
• Information Science
• Management Information Systems
• Webmaster and Web Management

Training

To work as an information security analyst, you typically need to:

• have a high school diploma;
• have a bachelor's degree in a computer-related field; and
• have one to five years of related work experience.

Education after high school

A bachelor’s degree in computer science, programming, or a related field is excellent preparation for this occupation. As the field of information security continues to grow, many schools are beginning to offer information security programs. Some employer's prefer a analysts to have a Master's of Business Administration (MBA) in information systems.

Work experience

An important part of preparing for this field is learning the latest technology. Some people learn through classes and others teach themselves. An ideal way to prepare for this field is to get a part-time job or internship. In these hands-on learning environments, you learn new tools as they are used in the field.

On-the-job training

Continuing education is very important in this field. Technology changes rapidly and specialists must stay up to date. Employers, hardware and software vendors, colleges and universities, and training institutes offer classes.

Military training

Some branches of the military train people to be computer systems specialists. Training lasts from seven to 13 weeks, depending on your specialty. Additional training occurs on the job.

Helpful high school courses

In high school, take classes that prepare you for college. A college preparatory curriculum  may be different from your state's graduation requirements .

You should also consider taking some advanced courses in high school. This includes Advanced Placement (AP) and International Baccalaureate (IB) courses if they are available in your school. If you do well in these courses, you may receive college credit for them. Advanced courses can also strengthen your college application.

Helpful electives to take in high school that prepare you for this career include:

• Computer Applications
• Computer Programming
• Computer Science
• Network Technology

The courses listed above are meant to help you create your high school plan. If you have not already done so, talk to a school counselor or parent about the courses you are considering taking.

You should also check with a teacher or counselor to see if work-based learning opportunities are available in your school and community. These might include field trips, job shadowing, internships, and actual work experience. The goal of these activities is to help you connect your school experiences with real-life work.

Join some groups, try some hobbies, or volunteer with an organization that interests you. By participating in activities you can have fun, make new friends, and learn about yourself. Maybe one of them will help direct you to a future career. Here are examples of activities and groups  that may be available in your high school or community.

Things to know

Most employers prefer security analysts who have formal college training, although knowledge about computer security issues is the most important criteria. Many employers also require a bachelor's degree; however, some may require only an associate degree. Most employers require related work experience. Some employers hire information security analysts who may have a lot of experience but little formal training. Employers often hire the candidate who knows the technology the company is using. Some employers prefer analysts who are certified.

Employers also look for information security analysts who can think logically and communicate well with others. Analysts must be able to communicate with managers, in-house users, and off-site users. Analysts must be able to do a number of tasks at once. They also must be able to pay attention to details. Employers look for analysts who can work both independently and on a team.

Costs to workers

Some workers join a professional association, which may have annual dues.

Licensing/certification

Information security analysts can obtain voluntary certification from the hardware and software manufacturers who offer certification programs on their products. Many employers require certification for employment.

Job listings

Listed below are links to job categories from the National Labor Exchange that relate to this career. Once you get a list of jobs, you can view information about individual jobs and find out how to apply. If your job search finds too many openings, or if you wish to search for jobs outside of Washington, you will need to refine your search.

• Computer Security Specialists 

To get a listing of current jobs from the WorkSource system, go to the WorkSource website .

Wages

Wages vary by employer and project difficulty. For example, large companies usually pay more than small companies. In addition, analysts are usually paid more for working on high-security projects. Manufacturing companies tend to pay more than government agencies.

Most information security analysts who work full time receive benefits. Benefits may include health insurance and a retirement plan. They may also include vacation and sick leave. Some employers offer stock in their company or pay for continuing education courses. Self-employed information security analysts must provide their own insurance.

Employment and outlook

Washington outlook

The table below provides information about the number of workers in this career in various regions. It also provides information about the expected growth rate and future job openings.

National employment

About 17% of information security analysts are self-employed.

Information security analysts positions are found throughout the nation. Larger cities have more companies that hire these workers. Larger companies also hire more security analysts. Small companies may be more likely to hire someone on a temporary or part-time basis, or as a consultant.

Major employers:

• Computer systems design companies
• Telecommunications services
• Finance and insurance agencies
• Business management companies

National outlook

Demand is very strong for this occupation. Cyber attacks have increased and many companies need to make sure their customer data is secure. The government also hires many information security analysts to make sure IT systems are safe. Demand for security analysts has also increased as the health care industry moves to electronic medical records.

Job prospects will be best for those with experience, especially in a related area such as database management.

Other resources

American Society for Industrial Security 
1625 Prince Street
Alexandria, VA 22314
703.519.6200

Association for Computing Machinery 
1601 Broadway, 10th Floor1
New York, NY 10019-7434
800.342.6626
212.626.0500

Association for Women in Computing - Puget Sound Chapter 
3743 S. 170th Street
Sea-Tac, WA 98188

Computing Research Association 
1828 L Street, NW, Suite 800
Washington, DC 20036-4632

Computing Technology Industry Association 
3500 Lacey Road, Suite 100
Downers Grove, IL 60515
630.678.8300

IEEE Computer Society 
2001 L Street NW, Suite 700
Washington, DC 20036
202.371.0101

Information Systems Audit and Control Association 
847.253.1545

Information Technology Industry Council 
1101 K Street NW, Suite 610
Washington, DC 20005
202.737.8888

Institute for Certification of Computing Professionals (ICCP) 
244 S Randall Road #116
Elgin, IL 60123
847.299.4227

International Association for Computer Information Systems 
405.744.8632

Security Industry Association 
8405 Colesville Road, Suite 500
Silver Spring, MD 20910
301.804.4700

Technology Student Association 
1904 Association Drive
Reston, VA 20191-1540
888.860.9010

The International Association of Computer Investigative Specialists 
25 Catoctin Cir. SE, #2411
Leesburg, VA 20177

References

Career cluster

• Information Technology

Career path

• Conventional (Business Operations)

O*Net  occupation

• Information Security Analysts (15-1122.00) 

O*Net job zone 

• Job Zone 4 - Considerable preparation needed. A minimum of two to four years of work-related skill, knowledge, or experience is needed for these occupations.

DOT occupations

• Computer Security Coordinator (033.162-010) 
• Computer Security Specialist (033.362-010) 
• Data Recovery Planner (033.162-014) 

Holland occupational cluster

• Conventional/Investigative/Realistic

COPSystem

• Science Professional