The number most people have heard is the Bureau of Labor Statistics one, and it is a trap if you are about to take your first SOC job. The BLS put the May 2025 median for information security analysts at $129,180 a year. That is the median for an occupation that includes the fifteen-year engineer writing detection rules at a bank. The tier 1 seat you are interviewing for pays about half of it.
I worked a help desk before I worked a SOC, and the gap between the two desks is the one number here I did not have to look up.
Tier 1: what the first seat pays
KORE1’s September 2026 SOC Analyst Salary Guide puts a new tier 1 hire at $58,000 to $75,000 base nationally, and $65,000 to $90,000 in a high-cost metro. Glassdoor’s 2026 page for the same title averages $70,860, though that page is built from a handful of submissions. The BLS floor is more useful: the lowest 10 percent of information security analysts earned under $75,090 in May 2025, and that bottom decile is mostly tier 1 people in their first year or two.
A realistic first offer lands in the sixties, low seventies in an expensive city. Six-figure entry offers come with a clearance, which we will get to.
Tier 2 and tier 3
Tier 2 is where the pay starts to resemble the headline. KORE1’s 2026 guide has most tier 2 investigators at $80,000 to $110,000, and $90,000 to $125,000 in high-cost metros. Glassdoor’s tier 2 page averages $85,926 in 2026. Indeed, which does not split by tier, averaged $106,587 across 460 SOC analyst salaries as of October 2026, with a range from $74,687 up to $152,110. That is the whole room, tier 1 through tier 3, with the senior people pulling the average up.
Tier 3, the incident responder who takes what tier 2 cannot close, runs $110,000 to $145,000 in KORE1’s 2026 guide, and $125,000 to $165,000 in the expensive cities. That is where the BLS May 2025 median of $129,180 lives. The same 2026 guide has detection engineers and threat hunters a step above, at $120,000 to $160,000. Tier 1 to tier 3 is roughly a doubling, and I have watched people cross it in about five years. What each tier does all day is in the tier 1, tier 2 and threat hunter breakdown.
What the night shift pays
A SOC runs around the clock, and in your first year the person on the console at 3 a.m. is often you. KORE1’s 2026 guide says that where employers pay a night differential it usually runs $5,000 to $8,000 a year, and recommends a tier 1 night seat in a mid-cost metro at $62,000 to $70,000 base plus a written differential of at least $5,000. The word written matters. I took a night rotation once on a verbal promise that the premium was standard, and standard turned out to mean it appeared on the third paycheck after I asked twice. Get it in the offer letter.
Nights are the fastest raise you can get without learning anything new. They also make you slower at the job by month eight, because nobody reads carefully at 4 a.m. Take them for the money and set a date for getting off them.
MSSP or in-house
An MSSP sells SOC coverage to many companies at once, and its tier 1 floor is where a lot of people start. KORE1’s 2026 guide, built from the searches the firm runs, has an MSSP seat paying $5,000 to $10,000 less than the same tier at an in-house corporate SOC. The trade is volume: an MSSP analyst sees more alert types across more environments in a year than an in-house analyst sees in three, and that resume gets you the in-house tier 2 job that pays the difference back. I would take the MSSP seat at 22 and the in-house seat at 26.
In-house, the BLS May 2025 industry medians show which buildings pay: information companies at $138,650 and finance and insurance at $130,630.
What moves the number fastest
Clearance is the biggest single lever. The 2026 Security Clearance Compensation Report from ClearanceJobs put average total compensation for cleared professionals at $126,125 in 2025, up almost 6 percent on the year. KORE1’s 2026 guide translates that for SOC work: an active TS/SCI adds $15,000 to $30,000 around Washington, more with a full-scope polygraph. Somebody has to sponsor you for it, which usually means a lower-paid tier 1 job at a defense contractor while the investigation runs.
Certs move the number less than people hope at the bottom and more in the middle. The same guide calls Security+ table stakes: no premium for holding it, lost interviews for lacking it. From tier 2 up, the same guide prices GCIH, GCIA or SC-200 at $5,000 to $10,000 in a negotiation. Whether Security+ is worth the exam fee has a short answer for a SOC applicant.
City is the lever everyone underestimates. The BLS May 2025 metro medians for information security analysts run from $176,120 in San Jose and $148,950 in the Washington area down to $118,970 in Tampa, a spread of almost $60,000 for the same occupation. Remote roles are usually benchmarked to the company’s home market, so ask which one.
Against help desk pay
The BLS put the May 2025 median for computer user support specialists, the help desk occupation, at $61,860, with the lowest 10 percent under $40,980 and the top 10 percent over $100,540. Against the information security analyst median of $129,180, the midpoints are about $67,000 apart. At the bottom the gap narrows: a help desk floor around $41,000 against a SOC floor around $75,000, which is still the largest single raise most people in IT ever take. Help desk pay climbs too, mostly by moving into desktop support or sysadmin work.
A help desk gives you the thing a SOC hires for: two years of comparing what a user said they did with what the logs say, which is most of tier 1 triage. The route across is in the help desk to SOC analyst guide.
To practice the console work before the interview, ServiceDesk Simulator has a second desk, the Security Simulator, in beta: a queue of alerts plus the tickets the help desk escalates, worked through a SIEM-style Alert Console and an Endpoint console with a process tree. The beta opens with a passcode, and the waitlist is on the Security Simulator page.
