Cybersecurity Analyst

Four roles under one heading

This page covers a family rather than a single job, because Florida teaches them together and people move between them.

⚠⚠ A caveat about the last three, and it matters if you go looking for their numbers. Penetration testing, security engineering and digital forensics are O*NET detail occupations sitting under the federal aggregate 15-1299 Computer Occupations, All Other. All three therefore report the identical employment (472,000), openings (31,300) and median wage ($116,580) — those are the aggregate's figures, not the specialism's. Do not read $116,580 as “the penetration tester wage”; the federal system simply does not count them separately.

What the core job actually is

O*NET, on information security analysts: develop plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure; monitor current reports of computer viruses to determine when to update virus protection systems; encrypt data transmissions and erect firewalls to conceal confidential information; perform risk assessments and execute tests of data processing system; modify computer security files to incorporate new software, correct errors, or change individual access status.

⚠ Notice how much of that is administration and documentation. Security work in practice is policy, patching discipline, access reviews, audit evidence and arguing for budget — punctuated by incidents. The version in the advertising is the incident; the job is mostly the rest.

The numbers, and they are good

• O*NET (2024–34): 182,800 employed, growth much faster than average (7% or higher), 16,000 openings a year, median $129,180 (2025).
• BLS OOH (2025–35): 192,900 jobs, growth 21%, much faster than average, employment change +40,600, entry a bachelor's degree.

✅ 21% is the highest growth rate of any computing path on this site — against 10% for software development and a projected decline for network and systems administration. And the pay is close to software development's ($129,180 against $135,980) for a job with a shorter and cheaper route in.

⚠⚠⚠ But it is not a starting point, and this is the most important thing on the page

Security is marketed to beginners harder than almost any other technical field, and the federal handbook quietly contradicts the marketing: many analysts come from IT departments, having worked as network and computer systems administrators, with less than five years of related experience typical before the security role.

⚠⚠ The reason is not gatekeeping. You cannot defend infrastructure you have never operated: you will not spot anomalous traffic on a network whose normal you have never watched, you will not scope an incident on systems you cannot administer, and you will not write a workable policy for an environment you have not run. Every credible route into this field passes through operations.

⚠ What that means in practice, for a Florida student:

• Do not take a security certificate as a first credential and expect an analyst job. It happens, but it is the exception and it usually happens to people who already had a technical job.
• Do take the operations route deliberately — networking or IT, then a support or administration job, then security. It feels slower and it is substantially faster to an actual security role.
• Or do the security degree and get your hands on systems alongside it — a campus help-desk job, a home lab, a volunteer sysadmin role for a small nonprofit. The degree plus nothing is the combination that disappoints.

⚠⚠ Florida teaches this mostly in CLOCK HOURS

35 Florida public institutions award security credentials and produced 1,063 in the 2023 award year — St Petersburg College alone accounts for 359. But look at how it is actually delivered.

⚠⚠⚠ The clock-hour courses reach two to three times as many institutions as the credit-bearing ones. They stack into occupational completion points, they prepare you for the same vendor examinations, and they are faster and cheaper. They carry no college credit. If a bachelor's is anywhere in your plan — and for security management and government work it usually is — that difference is the whole decision, and no one raises it at enrolment.

Necessary skills

• Systems and networking, operationally. Not as theory — as things you have configured, broken and fixed.
• Reading logs and spotting the anomaly. The core analytical skill, and it depends entirely on knowing what normal looks like.
• Scripting. Python or PowerShell, for the automation that makes monitoring and response tractable.
• Writing for non-technical readers. Risk assessments, incident reports and the case for spending money are most of what a senior analyst produces.
• Legal and evidentiary care, especially for forensics: evidence handling, chain of custody, and the fact that you may be deposed on it.
• Ethical discipline. Penetration testing is authorised intrusion, and the authorisation is what separates it from a felony. Programmes that are casual about scope and written permission are teaching you a dangerous habit.

Advice

⚠⚠ Sequence operations first, or alongside. If you are starting from nothing, the networking and systems administration programme is the more reliable first step — 56 Florida institutions teach it, and 27 of the 35 that teach security also teach it, so at most colleges you are choosing an order rather than a school.

⚠ Decide the credit question before you enrol, because Florida's security instruction skews heavily to clock hours and the two forms look identical from the outside.

⚠ Plan the certifications, and plan them in order. Employers in this field screen on them more than on the degree. Ask any programme which examinations it prepares you for, whether the examination fee is included, and what its pass rate is.

And get something real to defend. A home lab, a small nonprofit's network, a capture-the-flag team, a campus security club. In a field where the credential is easy to buy and experience is the actual gate, demonstrable hands-on work is what distinguishes an application — and it is the one thing you can start this week.