Information Security Analysts

O*NET-SOC code: 15-1212.00

Plan, implement, upgrade, or monitor security measures for the protection of computer networks and information. Assess system vulnerabilities for security risks and propose and implement risk mitigation strategies. May ensure appropriate security controls are in place that will safeguard digital files and vital electronic infrastructure. May respond to computer security breaches and viruses.

Data source: BLSPublished: 2026-08
Very high· relative
LowFour relative bandsVery high
Group-level value
Scale, basis and source
Four relative bands (Low / Moderate / High / Very high)
831 detailed occupations in the BLS Employment Projections table. Assigned per National Employment Matrix (NEM) code, so occupations sharing a NEM code carry the same band
Source dataset (XLSX download)
Data source: AnthropicPublished: 2026-03
0.486
0.000Range of values carried here0.745
Scale, basis and source
Observed exposure index, 0–1 as published
Mapped onto O*NET tasks
Published per SOC 2018 occupation; every O*NET occupation with the same SOC 2018 code carries this value
Source dataset (CSV download)
Data source: ILOPublished: 2025
0.49
0.09Range of values carried here0.70
Group-level value
Scale, basis and source
Generative AI exposure index, 0–1 as published
Published per ISCO-08 unit group. Linked to this occupation, wholly or in part, by applying U.S. Bureau of Labor Statistics crosswalks (ISCO-08 to 2010 SOC, 2010 SOC to 2018 SOC) as published
Source dataset (PDF download)

What kind of figure this source publishes

The BLS category is a relative rank, not an absolute level, and it is not a first-hand measurement: it groups an occupation's percentile ranks across several published studies into four bands. It is not an employment or wage forecast, not a probability of adoption, and it does not separate automation from augmentation.

Task-level exposure

Exposed tasks only

12 rated tasks · 11 tasks with β ≥ 0.5 (91.7%)

β = direct exposure (E1) + 0.5 × exposure when tools are available (E2), per the source repository's definition.

Source unit: O*NET 27.2 tasks → O*NET 31.0 occupation code
1 rated task is not in the O*NET 31.0 task list; its score is kept as published for O*NET 27.2.

Source: OpenAI "GPTs are GPTs" exposure rubric
Release: gh-main-0471612
License: MIT License, Copyright (c) 2024 OpenAI

Tasks of O*NET-SOC 2010 occupation 15-1122.00 Information Security Analysts, linked to this occupation by the O*NET-SOC 2010 to 2019 crosswalk

Task (O*NET 20.1)	Claude.aiRaw / share %
Coordinate implementation of computer system plan with establishment personnel and outside vendors. 15-1122.00	0.053228.3
Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures. 15-1122.00	0.047725.4
Document computer security and emergency measures policies, procedures, and tests. 15-1122.00	0.038220.3
Encrypt data transmissions and erect firewalls to conceal confidential information as it is being transmitted and to keep out tainted digital transfers. 15-1122.00	0.01729.2
Develop plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure and to meet emergency data processing needs. 15-1122.00	0.01226.5
Monitor use of data files and regulate access to safeguard information in computer files. 15-1122.00	0.01065.6
Modify computer security files to incorporate new software, correct errors, or change individual access status. 15-1122.00	0.00864.6
Not observed on any surface — 5 task(s) — These tasks have no row in the source for this release. The 0 in the share row is a display-stage composition ratio; absence is what the — in the raw row states.
Train users and promote security awareness to ensure system security and to improve server and network efficiency.	—0
Confer with users to discuss issues such as computer data access needs, security violations, and programming changes.	—0
Monitor current reports of computer viruses to determine when to update virus protection systems.	—0
Review violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated.	—0
Maintain permanent fleet cryptologic and carry-on direct support systems required in special land, sea surface and subsurface operations.	—0

Values in this tab are predicted labels, not observations. Eloundou et al. (2023) published two rating regimes — human raters and GPT-4 — and the β shown here is derived from the GPT-4 rater basis alone; the same task can take a different value under the other regime. The unit and the meaning differ from the observed shares (%) in the other tabs, so do not place them on the same axis.

Task (O*NET 27.2)	βE1 + 0.5 × E2
Confer with users to discuss issues such as computer data access needs, security violations, and programming changes. O*NET Task ID 5315	1.0
Modify computer security files to incorporate new software, correct errors, or change individual access status. O*NET Task ID 5317	1.0
Encrypt data transmissions and erect firewalls to conceal confidential information as it is being transmitted and to keep out tainted digital transfers. O*NET Task ID 5321	1.0
Document computer security and emergency measures policies, procedures, and tests. O*NET Task ID 5322	1.0
Train users and promote security awareness to ensure system security and to improve server and network efficiency. O*NET Task ID 5313	0.5
Develop plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure and to meet emergency data processing needs. O*NET Task ID 5314	0.5
Monitor current reports of computer viruses to determine when to update virus protection systems. O*NET Task ID 5316	0.5
Coordinate implementation of computer system plan with establishment personnel and outside vendors. O*NET Task ID 5318	0.5
Monitor use of data files and regulate access to safeguard information in computer files. O*NET Task ID 5319	0.5
Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures. O*NET Task ID 5320	0.5
Review violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated. O*NET Task ID 5323	0.5
Show 1 more task ▾Show less ▴
Maintain permanent fleet cryptologic and carry-on direct support systems required in special land, sea surface and subsurface operations. O*NET Task ID 5324	0.0

β = E1 + 0.5 × E2 · E1 = tasks where direct LLM access alone cuts time by at least 50%, E2 = tasks where software built on top of an LLM cuts time by at least 50%. Values take only 0 / 0.5 / 1.0.

Data sources & licenses — O*NET®, Anthropic Economic Index, Eloundou et al. (2023): see full notices on the Credits page

All O*NET 31.0 task statements (11)

All O*NET 31.0 task statements for this occupation (English, as published; task type core or supplemental). Exposure values are not listed here; they are in the table above, next to each task statement as worded in the O*NET version each source used.

Task (O*NET 31.0)	Type
Train users and promote security awareness to ensure system security and to improve server and network efficiency.	Core
Develop plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure and to meet emergency data processing needs.	Core
Confer with users to discuss issues such as computer data access needs, security violations, and programming changes.	Core
Monitor current reports of computer viruses to determine when to update virus protection systems.	Core
Modify computer security files to incorporate new software, correct errors, or change individual access status.	Core
Coordinate implementation of computer system plan with establishment personnel and outside vendors.	Core
Monitor use of data files and regulate access to safeguard information in computer files.	Core
Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures.	Core
Encrypt data transmissions and erect firewalls to conceal confidential information as it is being transmitted and to keep out tainted digital transfers.	Core
Document computer security and emergency measures policies, procedures, and tests.	Core
Review violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated.	Core

Employment outlook (BLS)

Employment, 2025: 193K
Projected employment, 2035: 233K
Change (2025–35): +21%
Median annual wage, 2025: $129,180
Typical education needed for entry: Bachelor's degree

lowest $30,890median wage across 825 detailed occupations, BLS EP 2025–35highest $559,030

Source: U.S. Bureau of Labor Statistics, Employment Projections 2025–35 — Employment by detailed occupation, 2025 and projected 2035

Korea classification links (KSCO)

Links from the current release of the Korea Occupation Direct Crosswalk v1.1, made by AI Changing Work. Relation values are read from the O*NET-SOC occupation side.

KSCO code	KSCO title	Relation	Status
22320	정보 보안 전문가	Same scope	confirmed
22211	정보통신기술 컨설턴트	Related, not a match	confirmed

Relation and status definitions(kr-direct v1.1)

ILO occupational description

AI Changing Work links the ISCO-08 unit groups below to this occupation by applying the U.S. Bureau of Labor Statistics crosswalks (2018 SOC to 2010 SOC, 2010 SOC to ISCO-08) as published, without case-by-case selection; each link may be whole or partial.

ISCO-08 2529Database and Network Professionals Not Elsewhere Classified

The definition, tasks and examples below are the ILO's description of that unit group, not of this occupation.

This unit group includes database and network professionals not classified elsewhere in Minor Group 252: Database and Network Professionals. For instance, the group includes information and communications technology security specialists.

Tasks

In such cases tasks would include -
(a) developing plans to safeguard computer files against accidental or unauthorized modification, destruction or disclosure and to meet emergency data processing needs;
(b) training users and promoting security awareness to ensure system security and to improve server and network efficiency;
(c) conferring with users to discuss issues such as computer data access needs, security violations, and programming changes;
(d) monitoring current reports of computer viruses to determine when to update virus protection systems;
(e) modifying computer security files to incorporate new software, correct errors or change individual access status;
(f) monitoring use of data files and regulate access to safeguard information in computer files;
(g) performing risk assessments and executing tests of data processing system to ensure functioning of data processing activities and security measures;
(h) encrypting data transmissions and erecting firewalls to conceal confidential information as it is being transmitted and to keep out tainted digital transfers.

Example occupations

Data miner · Digital forensic specialist · Security specialist (ICT)

Sources: ILO ISCO-08 — details: Credits

ESCO occupational vocabulary

Each entry below is matched to this occupation in the published ESCO-O*NET Crosswalk (version 1, 2022). The match types are that crosswalk's; the wording is AI Changing Work's.

ICT resilience managerESCO 2529.4This occupation is narrower
ICT resilience managers research, plan and develop models, policies, methods, techniques and tools that enhance an organisation's cyber security, resilience and disaster recovery.
ICT security administratorESCO 2529.5Overlapping, not the same
ICT security administrators plan and carry out security measures to protect information and data from unauthorised access, deliberate attack, theft and corruption.
ICT security managerESCO 2529.7Overlapping, not the same
ICT security managers propose and implement necessary security updates. They advise, support, inform and provide training and security awareness and take direct action on all or part of a network or system.

Source: European Commission, DG EMPL — ESCO API 2026-08-08 (bridge v1.2.1)

License: CC BY 4.0 (EU Reuse Notice)

View original

ESCO reuse terms and the modification notice are in Credits.

France classification links (ROME)

AI Changing Work's links between this occupation and ROME 4.0 job profiles, judged with AI models. Relations are read from this occupation's side. Links marked “provisional” were adopted on the judgments of two judges from the same model family (Claude) alone, or by an operator rule applied to their judgments, so they rest on weaker evidence than confirmed links.

ROME code	ROME title (French)	Relation
M1817	Administrateur / Administratrice sécurité informatique	This occupation is broader
M1819	Technicien / Technicienne en cybersécurité	This occupation is broader
M1856	Expert / Experte en cybersécurité	This occupation is broader
M1883	Analyste SOC (Security Operations Center)	This occupation is broader
K1732	Spécialiste des systèmes de communication opérationnels	Related, not a match
K1906	Délégué / Déléguée à la protection des données - Data Protection Officer	Related, not a match
M1846	Ingénieur / Ingénieure Cybersécurité Datacenter	Related, not a match
M1849	Administrateur / Administratrice de messagerie	Related, not a matchprovisional

Source: France Travail — Répertoire Opérationnel des Métiers et des Emplois (ROME 4.0), version 61, last updated 15 June 2026 (https://www.data.gouv.fr/datasets/repertoire-operationnel-des-metiers-et-des-emplois-rome). Licence Ouverte 2.0.

ROME codes and titles are reproduced unchanged; the links to O*NET-SOC occupations are AI Changing Work's own judgment and are not a France Travail correspondence.

(AI Changing Work link release: fr-direct v1)

Spain classification links (CNO-11)

AI Changing Work's links between this occupation and CNO-11 occupations, judged with AI models. Relations are read from this occupation's side.

CNO-11 code	CNO-11 title (Spanish)	Relation
2729	Especialistas en bases de datos y en redes informáticas no clasificados bajo otros epígrafes	This occupation is narrowerprovisional

Source: Instituto Nacional de Estadística (INE), National Classification of Occupations 2011 (CNO-11, Royal Decree 1591/2010) — www.ine.es · Licensed CC BY 4.0. CNO-11 codes and Spanish titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not an INE correspondence.

(AI Changing Work link release: es-direct v1)

Germany classification links (KldB)

AI Changing Work's links between this occupation and KldB occupations, judged with AI models. Relations are read from this occupation's side.

KldB code	KldB title (German)	Relation
43383	Berufe in der IT-Netzwerktechnik, IT-Koordination, IT-Administration und IT-Organisation (sonstige spezifische Tätigkeitsangabe) - komplexe Spezialistentätigkeiten	This occupation is broaderprovisional
43384	Berufe in der IT-Netzwerktechnik, IT-Koordination, IT-Administration und IT-Organisation (sonstige spezifische Tätigkeitsangabe) - hoch komplexe Tätigkeiten	This occupation is broaderprovisional

Source: © Statistik der Bundesagentur für Arbeit — Klassifikation der Berufe 2010 – überarbeitete Fassung 2020, https://statistik.arbeitsagentur.de. KldB codes and titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own mapping (eigene Zuordnung) and are not a Bundesagentur für Arbeit correspondence.

(AI Changing Work link release: de-direct v1)

Japan classification links (JSCO)

AI Changing Work's links between this occupation and JSCO occupations, judged with AI models. Relations are read from this occupation's side.

JSCO code	JSCO title (Japanese)	Relation
105	システム運用管理者	This occupation is narrower

Source: Ministry of Internal Affairs and Communications (MIC), Japan Standard Occupational Classification (Dec. 2009, MIC Notification No. 555). JSCO codes and Japanese titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not a MIC correspondence.

(AI Changing Work link release: jp-direct v1)

Sources, licenses and AI Changing Work's modification and translation notices for this page: Credits & sources