Information Security Analyst Jobs
Information Security Analyst jobs are open across finance, healthcare, government, defense, and technology, at every level from entry-level to senior and lead, with specializations in cloud security, threat intelligence, and compliance. Find a role that fits from the openings below and apply directly.
Find JobsLooking for remote work? View remote information security analyst jobs →Student or new grad? View information security analyst internships →Overview
Showing 5 of 1,287+ Information Security Analyst jobs
- Create of Waivers or Risk Acceptance Memos to assist in the effective management of system risks
- Conduct an annual assessment in accordance with guidance in the DHS Information Security Performance Plan
- Review and update security authorization documents as needed, but at least annually
- Coordinate with the customer's Privacy, Records, and Information Governance Divisions related to compliance documentation and other requirements
- Conduct Contingency Plan tests at least annually and updating the plan
- Perform system self-assessments as part of the customer's Ongoing Authorization program
- Monitor and respond to Information Security Vulnerability Management (ISVM)/Patch Management
- Provide audit support for assigned systems (Financial, A-123, FISMA, internal, DHS, etc.), throughout the audit (Pre, During, and Post Audit)
- Maintain knowledge of inventory in accreditation boundary
- Proactively ensure security requirements are included in development cycle (Waterfall, Agile, SecDevOPs)
- Use DHS and mandated enterprise IA Compliance Tools.
- Devise a plan to certify and accredit their assigned Information system or information systems
- Ensure CM processes are followed to ensure that any changes do not introduce new security risks
- Manage system Information Security Vulnerability Management (ISVM) Compliance
- Respond to emerging requirements or policies as set by legislation, regulation or policy
- Participate in DevOps Sec (security integrated into Agile processes) requirements for assigned systems
- Support annual assessments in accordance with guidance in the DHS Information Security Performance Plan
- Five (5) to ten (10) years of IA experience is required; three (3) of which must be FISMA-related
- Bachelor's Degree in related IT Field or Bachelor's Degree may be substituted with four (4) additional years of FISMA- related experience, for a total of 9 to 14 years of experience
-
One of the following:
- Certified Information Systems Security Professional (CISSP)
- CompTIA Advanced Security Practitioner (CASP)
- Certified Information Systems Auditor (CISA)
- Certified Ethical Hacker (CEH)
- Certified Information Security Manager (CISM)
- Specialized knowledge of financial audit standards, classified system IA requirements and Privacy Act requirements
- Specialized knowledge and experience with the implementation of the NIST Special Publication (SP) 800 family of publications, particularly those associated with the Risk Management Framework
- Specialized knowledge and experience with evaluating system, network, or infrastructure security controls against requirements such as FISMA, FIPS, and NIST guidelines
- Knowledge and experience with the vulnerability scanning execution, assessment, and analysis
- Knowledge and experience with the operating system and network knowledge (i.e., Local Area Networks [LAN] and Wide Area Networks [WAN])
- Knowledge and experience with information security and assurance principles (e.g., Defense-in-depth) and associated supporting technologies
- Knowledge and experience with application security, database security, and network security
- Knowledge and experience with the implementation of the NIST Special Publication (SP) 800 family of publications, particularly those associated with the Risk Management Framework
- Experience with evaluating system, network, or infrastructure security controls against requirements such as FISMA, FIPS, and NIST guidelines
- Ability to assess and weigh current and evolving security threats in an operational environment
Preferred:
- Current experience providing ISSO support to CBP or DHS
- Experience supporting systems hosted in Cloud environments.
- Experience supporting systems in Agile and DevOps environments
Identity Statement
Steampunk is a Change Agent in the Federal contracting industry, bringing new thinking to clients in the Homeland, Federal Civilian, Health and DoD sectors. Through our Human-Centered delivery methodology, we are fundamentally changing the expectations our Federal clients have for true shared accountability in solving their toughest mission challenges. If you want to learn more about our story, visit http://www.steampunk.com.
We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law. Steampunk participates in the E-Verify program.
- Create of Waivers or Risk Acceptance Memos to assist in the effective management of system risks
- Conduct an annual assessment in accordance with guidance in the DHS Information Security Performance Plan
- Review and update security authorization documents as needed, but at least annually
- Coordinate with the customer's Privacy, Records, and Information Governance Divisions related to compliance documentation and other requirements
- Conduct Contingency Plan tests at least annually and updating the plan
- Perform system self-assessments as part of the customer's Ongoing Authorization program
- Monitor and respond to Information Security Vulnerability Management (ISVM)/Patch Management
- Provide audit support for assigned systems (Financial, A-123, FISMA, internal, DHS, etc.), throughout the audit (Pre, During, and Post Audit)
- Maintain knowledge of inventory in accreditation boundary
- Proactively ensure security requirements are included in development cycle (Waterfall, Agile, SecDevOPs)
- Use DHS and mandated enterprise IA Compliance Tools.
- Devise a plan to certify and accredit their assigned Information system or information systems
- Ensure CM processes are followed to ensure that any changes do not introduce new security risks
- Manage system Information Security Vulnerability Management (ISVM) Compliance
- Respond to emerging requirements or policies as set by legislation, regulation or policy
- Participate in DevOps Sec (security integrated into Agile processes) requirements for assigned systems
- Support annual assessments in accordance with guidance in the DHS Information Security Performance Plan
- Five (5) to ten (10) years of IA experience is required; three (3) of which must be FISMA-related
- Bachelor's Degree in related IT Field or Bachelor's Degree may be substituted with four (4) additional years of FISMA- related experience, for a total of 9 to 14 years of experience
-
One of the following:
- Certified Information Systems Security Professional (CISSP)
- CompTIA Advanced Security Practitioner (CASP)
- Certified Information Systems Auditor (CISA)
- Certified Ethical Hacker (CEH)
- Certified Information Security Manager (CISM)
- Specialized knowledge of financial audit standards, classified system IA requirements and Privacy Act requirements
- Specialized knowledge and experience with the implementation of the NIST Special Publication (SP) 800 family of publications, particularly those associated with the Risk Management Framework
- Specialized knowledge and experience with evaluating system, network, or infrastructure security controls against requirements such as FISMA, FIPS, and NIST guidelines
- Knowledge and experience with the vulnerability scanning execution, assessment, and analysis
- Knowledge and experience with the operating system and network knowledge (i.e., Local Area Networks [LAN] and Wide Area Networks [WAN])
- Knowledge and experience with information security and assurance principles (e.g., Defense-in-depth) and associated supporting technologies
- Knowledge and experience with application security, database security, and network security
- Knowledge and experience with the implementation of the NIST Special Publication (SP) 800 family of publications, particularly those associated with the Risk Management Framework
- Experience with evaluating system, network, or infrastructure security controls against requirements such as FISMA, FIPS, and NIST guidelines
- Ability to assess and weigh current and evolving security threats in an operational environment
Preferred:
- Current experience providing ISSO support to CBP or DHS
- Experience supporting systems hosted in Cloud environments.
- Experience supporting systems in Agile and DevOps environments
Identity Statement
Steampunk is a Change Agent in the Federal contracting industry, bringing new thinking to clients in the Homeland, Federal Civilian, Health and DoD sectors. Through our Human-Centered delivery methodology, we are fundamentally changing the expectations our Federal clients have for true shared accountability in solving their toughest mission challenges. If you want to learn more about our story, visit http://www.steampunk.com.
We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law. Steampunk participates in the E-Verify program.
Information Security Analyst Jobs by Experience Level
Top Cities Hiring Information Security Analysts
Explore information security analyst openings in the cities hiring most right now.
See All 1,287+ Information Security Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsInformation Security Analyst Job Market
Who's Hiring
- General Dynamics Information Technology30
- Lockheed Martin28
- Booz Allen Hamilton24
- Peraton19
- MANTECH18
Top Industries Hiring
- Consulting & Professional Services
- Education
- Technology & Software
- Healthcare & Medical Services
- Automotive
What Employers Look For
The qualifications that appear most often in information security analyst jobs.
- Bachelor's degree in computer science, information security, or a related technical field
- Proficiency with SIEM platforms such as Splunk, Microsoft Sentinel, or IBM QRadar
- Hands-on experience with vulnerability scanning tools like Nessus, Qualys, or Rapid7
- Knowledge of security frameworks including NIST CSF, ISO 27001, and CIS Controls
- One or more certifications such as CompTIA Security+, CISSP, CEH, or CISM
- Experience supporting incident response, threat detection, or security operations center workflows
Tips for Your Information Security Analyst Job Search
Tailor your resume to the threat model
Hiring managers scan for specific attack surfaces you've defended. Call out the environments you've secured, whether cloud-native, on-prem, or hybrid, and name the frameworks you've worked within, like NIST CSF or ISO 27001, rather than listing tools alone.
Certify strategically before you apply
CompTIA Security+, CISSP, and CEH appear in a large share of postings, but the right cert depends on the seniority level. Entry-level roles often list Security+ as a baseline, while senior and cloud-focused roles increasingly ask for CCSP or AWS Security Specialty.
Apply early to roles that fit
Migrate Mate lists information security analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Filter openings by industry vertical
Security requirements differ sharply by sector. A fintech role will stress PCI DSS and fraud detection, while a healthcare opening will emphasize HIPAA controls and PHI handling. Targeting your search by industry helps you find postings where your specific compliance experience is a direct match.
Prepare for a technical screening round
Most information security analyst interviews include a hands-on component: a SIEM log analysis exercise, a vulnerability triage scenario, or a case study on an incident response workflow. Practice articulating your methodology out loud, not just your conclusions, because interviewers are evaluating how you reason under uncertainty.
Negotiate using total compensation context
When discussing offers, ask explicitly about on-call expectations, certification reimbursement, and budget for security tooling, since these vary widely across organizations and affect your real workload. Security teams with thin tooling often mean longer manual investigation hours, which is worth factoring in before you accept.
Information Security Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most information security analysts?
The companies hiring the most information security analysts right now include General Dynamics Information Technology, Lockheed Martin, and Booz Allen Hamilton, with the largest share of openings in Virginia, Maryland, and California, based on current listings on Migrate Mate as of November 2026. Demand is concentrated in sectors with high compliance obligations, including financial services, healthcare, and federal contracting.
How many information security analyst jobs are remote?
About 64% of information security analyst openings are fully remote or hybrid as of November 2026, though the share varies significantly by sub-role. Governance, risk, and compliance positions and threat intelligence analyst roles tend to be more remote-friendly, while SOC analyst and network security roles more often require on-site access to classified systems or physical infrastructure.
How do you become an information security analyst?
Start with a degree in computer science, information technology, or cybersecurity, or complete a recognized bootcamp with hands-on lab work. Earn a foundational certification like CompTIA Security+ to establish baseline credibility with hiring managers. Build practical experience through a help desk, IT support, or junior sysadmin role, then move into a SOC analyst or security operations position before stepping into a full analyst title.
Can you get hired as an information security analyst with little experience?
Yes, entry-level information security analyst roles exist, especially at managed security service providers and in large enterprise SOC teams that hire analysts to monitor alerts and escalate incidents. Candidates with no professional experience improve their chances by completing home lab projects, earning Security+ or Google Cybersecurity Certificate credentials, and contributing to capture-the-flag competitions, which give hiring managers concrete evidence of hands-on ability.
What does the information security analyst interview process look like?
Most processes start with a recruiter or HR screen focused on your background and role fit, followed by a technical interview where a security engineer or hiring manager tests your knowledge of threat detection, log analysis, and incident response. Many employers add a practical exercise, such as reviewing a SIEM alert or walking through a phishing investigation. Final rounds typically involve a panel with the security team lead and sometimes a cross-functional stakeholder from IT or compliance.
Where can I find and apply to information security analyst jobs?
You can find and apply to information security analyst jobs on Migrate Mate, which lists current openings from employers across the United States. Search the listings to find roles that match your experience level, specialization, and preferred location, then apply directly to each one that fits.
See All 1,287+ Information Security Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs