That sentence costs conversions and buys trust, so it goes first.
The pay gap between infrastructure work and security work is real, it’s large, and it’s documented by the Bureau of Labor Statistics. But the way most people describe it — quote the median, imply it’s a starting salary, let the reader do the wishful math — sets up a disappointment that shows up about four months into a job search.
Here’s the honest version of the money question.
The gap, in BLS numbers
All figures below are US median annual wages, May 2024, from the Bureau of Labor Statistics Occupational Outlook Handbook. Same source, same vintage, so the comparison is fair.
| Role | Median annual wage (May 2024) |
|---|---|
| Computer user support specialist (help desk) | $60,340 |
| Computer network support specialist | $73,340 |
| Network and computer systems administrator | $96,800 |
| Computer systems analyst | $103,790 |
| Database administrator / architect | $123,100 |
| Information security analyst | $124,910 |
| All US occupations, for reference | $49,500 |
Two things in that table matter more than the top line.
The distance from help desk to security is roughly double. That’s not a rounding difference or a cost-of-living artifact. It’s a structural difference in what the market pays for.
The distance from sysadmin to security is about $28,000. Smaller, and that’s the more honest comparison for most people reading this. If you already run infrastructure, you’re not looking at a doubling. You’re looking at a meaningful step up plus a much steeper ceiling above it.
There’s a third thing in that table that nobody points at: the occupations below the security line are shrinking. BLS projects computer support specialist employment to decline 3% and network and systems administrators to decline 4% from 2024 to 2034. Information security analysts are projected to grow 29% over the same period. The pay gap and the growth gap point the same direction.
What the median is not
The $124,910 figure is a median across the entire occupation — including people with ten years in security, principal engineers, and analysts in the highest-paying metros. It is not an entry number, and any page that implies otherwise is selling you something.
What’s realistic when you move in from IT:
- The first security role is frequently lateral or close to it — sometimes a modest step up, occasionally flat, and yes, occasionally a small step back if you’re jumping sectors or geographies at the same time.
- The gain shows up in the second and third moves, not the first. Two to four years in, the trajectory separates hard from the one you were on.
- Geography swings the number enormously. BLS metro-level data shows security analyst medians ranging from the low $80,000s to the high $170,000s depending on the market.
If the first move being lateral kills the idea for you, that’s a legitimate answer and it’s better to reach it now than in month nine of applying. What it buys is a different curve, not an immediate raise.
The part that actually answers “lucrative advancement”
Here’s the thing most IT professionals don’t know about security compensation, and it’s the reason the trajectory looks the way it does.
You do not have to become a manager to keep earning more.
In a lot of infrastructure organizations, the ladder runs out. Senior sysadmin is the top of the technical track, and the next raise requires managing people — which plenty of excellent engineers actively don’t want. That’s the ceiling that makes year eight feel like year four.
Security is structured differently. The technical individual-contributor track keeps going:
- SOC analyst → senior analyst → detection engineer → detection engineering lead
- Security engineer → senior engineer → security architect
- Cloud security engineer → cloud security architect → principal
- Vulnerability management → threat and exposure management → offensive-informed defense
- Technically-grounded GRC → risk lead → security program owner
Each of those steps carries a real compensation band, and none of them requires a direct report. The advancement path is clear because the field has been forced to build one — the alternative was watching its best technical people leave for management roles they’d be worse at.
That is what “lucrative advancement path” actually means. Not a fast first offer. A ladder that doesn’t run out.
What moves your number
Four things, roughly in order of leverage.
Specialization. Generalist security roles pay the band. Cloud security, identity and machine-identity security, detection engineering, and application security pay above it, because the supply of people who can do them well is thinner. Your existing IT domain usually points at which specialization is cheapest for you to reach — a cloud engineer’s shortest path to a premium is cloud security, not SOC.
Sector. Finance, healthcare, defense, and federal contracting pay differently for identical titles, and the ones with regulatory exposure generally pay more. Federal and defense-adjacent work also runs on DoD 8140 qualification logic, which rewards a specific certification-plus-work-role mapping rather than a general resume.
Clearance. A security clearance is a durable compensation premium in the DC metro and defense contracting generally. If you’ve served or already hold one, that’s leverage most candidates can’t manufacture.
Demonstrated judgment. The reason two candidates with identical certifications get different offers is that one of them can walk an interviewer through how they’d decide what to protect first in an environment they’ve never seen. That’s the thing that gets priced, and it’s the hardest to fake.
Note what’s not on that list as a primary driver: certifications. They matter — they get you past screening filters and they’re mandatory for some federal roles. But a certification is a key to the room, not a number on the offer letter. Buying three of them before choosing a target role is the most common and most expensive mistake in this transition. Pick the seat first, then buy the key that opens it.
What high pay does not mean
- It does not mean a fast first offer. “Fast-tracked” describes the trajectory over several years, not the timeline to a first security job.
- It does not mean $124,910 in year one. See above. It’s a whole-occupation median.
- It does not mean the field is immune to budget pressure. ISC2’s 2025 Workforce Study documented hiring freezes, budget cuts, and frozen promotions running alongside the talent shortage. Both are true simultaneously.
- It does not mean remote roles pay metro rates. Remote security postings attract national competition and increasingly price to a national band rather than a San Francisco one.
- It does not mean a certification produces a raise. Certification salary surveys published by vendors show correlation, not causation — the people who hold advanced certifications also tend to have the experience that actually commands the pay.
What it does mean: the market pays a durable premium for people who can reduce real risk, and the ladder above that entry point is longer and steeper than the one you’re standing on now.
How you get priced as a defender instead of as support
The gap between the two columns in that BLS table isn’t intelligence and it isn’t effort. It’s whether you can look at an environment and make defensible decisions about what to protect, from what, with which control, and in what order.
At Blue Team Academy that’s structured as the Threat & Control Method — four steps, applied to any environment:
- Inventory — establish what exists, what’s critical, and what already protects it. Output: an asset inventory.
- Threats — determine what can go wrong, how, caused by whom or what, and which risks matter most. Output: a threat model.
- Controls — find the gaps, select the right controls, turn security decisions into a plan. Output: a security plan.
- Scale — apply the same reasoning across other technologies, environments, and scenarios. Output: a repeatable decision process.
The steps are easy to state. The judgment inside them — how to prioritize, when a control costs more operationally than the risk it removes, what to defend first when you can’t defend everything — is what interviewers are actually probing, and it’s what separates the two salary bands.
Read the full breakdown: the Threat & Control Method explained.
The compensation story isn’t complicated, and it doesn’t need to be oversold. The market pays more for defensive judgment than for keeping systems running, and it keeps paying more as that judgment deepens. You already have the infrastructure half. The rest is direction.
Cybersecurity is not rocket science.
See how the path works. The program is built around turning the IT experience you already have into defensive security judgment — using the Threat & Control Method, applied to environments that look like the ones you already run.
Want the numbers and the market read on a regular basis? Keep IT Safe is the Blue Team Academy newsletter for IT professionals moving into defensive security — practical breakdowns, no hype, no hard sell. Subscribe to Keep IT Safe.