Most cyber security analysts in India earn between ₹5 LPA and ₹9 LPA in 2026. Freshers usually start at ₹4 to 6 LPA, mid-level engineers with three to six years earn ₹8 to 15 LPA, and senior architects and security leads reach ₹20 to 45 LPA. CISOs at large companies can cross ₹1 crore.
The biggest jumps in pay come when you move from monitoring work in a SOC into engineering roles like cloud security, application security or penetration testing, and when you clear a technical interview at a product company or global firm. A mock interview with an experienced security engineer is a quick way to find out whether you're ready for that jump.
Book a technical mock interview
5+ years in security? Book a senior-level mock
Cyber security salary by experience
[[table]]
Experience | Typical role | Salary (LPA)
0 to 1 yrs | SOC analyst L1 | 4 to 6
1 to 3 yrs | Security analyst | 5 to 9
3 to 6 yrs | Security engineer | 8 to 15
6 to 10 yrs | Senior engineer, lead | 15 to 30
10+ yrs | Architect, manager | 25 to 45
Leadership | CISO | 40 to 100+
[[/table]]
These ranges are total yearly pay (CTC) and come from AmbitionBox and Glassdoor data as reported in 2026 salary roundups. They're wide on purpose. A three-year engineer doing cloud security at a product company can earn double what a three-year SOC analyst earns at a services firm.
Pay stays modest for the first two or three years and then climbs quickly, because there are far fewer experienced security professionals in India than there are open roles.
[[mock-interview-banner]]
Cyber security salary by role
[[table]]
Role | Salary (LPA)
SOC analyst | 4 to 8
Cyber security analyst | 5 to 9
Security engineer | 10 to 18
Penetration tester | 8 to 20
Security consultant | 12 to 25
Cloud security engineer | 15 to 35
Application security engineer | 15 to 35
Security architect | 25 to 45
CISO | 40 to 100+
[[/table]]
A cyber security analyst monitors alerts, investigates incidents and writes reports. It's the most common entry point, and AmbitionBox data puts most analysts between about ₹3 lakh and ₹12 lakh a year.
Penetration testers and security consultants earn more because their work is harder to automate and often billed to clients. Cloud and application security engineers sit near the top of the band for their experience, since every company moving to the cloud needs them and few people have the skills. Architects and CISOs are paid for judgment and accountability as much as technical depth.
Salary by company type
[[table]]
Company type | Mid-level (LPA)
IT services (TCS, Infosys, Wipro) | 6 to 12
Big 4 consulting | 10 to 20
Banks and fintech | 12 to 25
Product companies and GCCs | 18 to 40
Security product firms | 20 to 45
[[/table]]
IT services firms hire the most freshers but pay the least. Product companies, global capability centres (GCCs) and security product firms pay much more, but they also run tougher technical interviews, often with a hands-on exercise and a system or threat-modelling round.
[[mock-interview-banner]]
Salary by city
[[table]]
City | Mid-level (LPA)
Bengaluru | 8 to 20
Hyderabad | 7 to 18
Mumbai | 7 to 18
Delhi NCR | 6 to 16
Pune | 6 to 15
[[/table]]
Bengaluru pays the most because it has the highest number of product companies and GCCs. Remote roles for global companies can pay above these ranges.
Cyber security certifications and salary
Certifications matter more in security than in most tech fields, because many employers and clients use them to shortlist candidates. Here are the ones that make the biggest difference to pay in India.
[[table]]
Certification | Issued by | Best for | Typical pay band (LPA)
CompTIA Security+ | CompTIA | Freshers | 4 to 8
CEH | EC-Council | Early career | 5 to 12
OSCP | OffSec | Pentesters | 10 to 25
CISSP | ISC2 | Senior roles | 20 to 45
CISM | ISACA | Managers | 20 to 40
AWS Security Specialty | AWS | Cloud security | 15 to 35
[[/table]]
The pay bands show what people holding each certification typically earn in India. The certification alone doesn't set the salary. Experience and role matter more, but the right certification helps you get shortlisted for better-paying roles.
CEH (Certified Ethical Hacker). The best-known entry certification in India, and many service companies and government-linked roles ask for it. It covers a broad range of attack techniques but is mostly theory, so pair it with hands-on practice.
OSCP (Offensive Security Certified Professional). A 24-hour hands-on exam where you have to break into real machines. It's much harder than CEH and is highly respected for penetration testing roles. Holders often move into the ₹10 to 25 LPA band quickly.
CISSP (Certified Information Systems Security Professional). A senior certification that needs five years of paid security work across its domains (four with a relevant degree or another approved credential). It's the one most often listed for architect, manager and CISO roles.
Certification fees change often and are usually listed in US dollars, so check the official sites (EC-Council, OffSec, ISC2) for the current price before you budget. Some Indian employers reimburse the cost.
[[mock-interview-banner]]
Skills that raise your salary
- Cloud security on AWS, Azure or GCP, including identity and access management
- Application security, threat modelling and secure code review
- Scripting in Python or Bash to automate investigations
- Penetration testing with real hands-on practice (labs, CTFs, bug bounties)
- Detection engineering with SIEM tools and writing detection rules
- Communication, since explaining risk to non-technical people is part of every senior role
What ₹8 LPA means in hand
CTC isn't what reaches your bank account. Here's a rough monthly breakdown for a ₹8 LPA cyber security analyst, assuming basic pay is 40% of CTC and the new tax regime.
[[table]]
Item | Per year
CTC | ₹8,00,000
Less employer PF and gratuity | ₹53,800
Less your PF | ₹38,400
Less professional tax | ₹2,400
Income tax | ₹0
In hand | About ₹7,05,400
[[/table]]
That works out to roughly ₹58,800 a month. Income tax is zero because taxable income after the ₹75,000 standard deduction stays under ₹12 lakh. Your actual number depends on your salary structure, so check your offer letter.
How to move into a higher pay band
If you're a fresher, get hands-on fast. Labs, capture-the-flag contests and a home lab show interviewers you can do the work, which matters more than a certificate alone.
If you're two to five years in and stuck in SOC work, pick a specialisation (cloud, application security or pentesting) and get the matching certification. Then target product companies and GCCs, where the same experience pays much more.
If you're senior, the jump to architect or lead roles depends on how you handle design and threat-modelling interviews and how clearly you explain risk to leaders. Practise those conversations out loud before the real interview.
Book a mock interview with an experienced engineer
FAQs
What is the average cyber security salary in India? Most cyber security analysts earn ₹5 to 9 LPA. Across all experience levels, pay ranges from about ₹4 LPA for freshers to ₹45 LPA for senior roles, and more for CISOs.
What is the cyber security fresher salary in India? Usually ₹4 to 6 LPA. Freshers with strong hands-on skills or internships can get more at product companies.
Which certification pays the most in cyber security? CISSP and CISM are linked to the highest-paying senior roles. For hands-on roles, OSCP has the biggest impact on pay.
Is CEH worth it in India? It helps freshers get shortlisted, especially at service companies. Pair it with hands-on practice, since interviews test real skills.
Which cyber security role pays the most? CISO, security architect, and cloud or application security engineer are the highest-paying roles.
Land a Higher-Paying Security Role: Take a Mock Interview
The gap between a ₹8 LPA offer and a ₹20 LPA one is often a single technical interview. Practise with an experienced engineer, get honest feedback on your answers, and go into your next interview prepared.
