What it actually takes to become a Cyber Security Analyst in Australia
Median $127,972 a year. Four ways in, taught at 17 Australian institutions — what each route costs and what the work is really like.
What the job actually is
Cyber security work is less like hacking in films and more like careful, continuous defence. Analysts monitor systems for suspicious activity, investigate alerts, fix vulnerabilities, test defences and help organisations recover from incidents. Much of the job is reading logs, writing reports and explaining risk to people who are not technical. Most people move into security after a few years in IT, networking or software. Opinion
Security operations centres
Teams monitoring and responding to threats around the clock. Estimate
Consultancies
Penetration testing, audits and incident response for clients. Estimate
Government and defence
Federal agencies and defence employ large security teams, often needing security clearances. Estimate
Banks and large companies
In-house security teams protecting systems and data. Estimate
Specialties
Security operations
Monitoring and responding to alerts. Estimate
Penetration testing
Authorised testing of systems for weaknesses. Estimate
Governance, risk and compliance
Policies, audits and standards. Estimate
Incident response and forensics
Investigating and recovering from attacks. Estimate
Cloud security
Securing cloud platforms. Estimate
A week, not a day
There is no typical day. There is a typical week, and it is uneven by design.
| Block | Roughly | What it looks like |
|---|---|---|
| Monitoring and investigation | 35% | Reviewing alerts and logs. |
| Remediation and hardening | 20% | Fixing vulnerabilities and configuring defences. |
| Reports and documentation | 20% | Writing findings for technical and non-technical readers. |
| Meetings and advice | 15% | Explaining risk and working with IT teams. |
| Learning | 10% | Keeping up with new threats and tools. |
Is it right for you?
An honest self-test. The filter is rarely passion — everyone has that.
Strong signs of fit
- You are curious about how systems work and how they break. Opinion
- You are patient with detail and enjoy investigating. Opinion
- You keep learning without being told to. Opinion
Warning signs
- You expect constant excitement. Much of the work is routine monitoring and documentation. Opinion
- You dislike shift work; monitoring roles often run around the clock. Opinion
- You expect to start in security straight from school. Many roles want IT experience first. Opinion
- You are uncomfortable with the responsibility of protecting critical systems. Opinion
Soft skills
- Analytical thinking
- Clear reporting
- Communicating risk
- Calm in incidents
Technical skills
- Networking
- Operating systems
- Security monitoring tools
- Scripting
- Cloud platforms
Demand, pay and the next twenty years
What changes over the next twenty years
- AI is likely to be used by both attackers and defenders, changing what analysts do. Forecast
- Regulation of how organisations protect data is likely to tighten. Forecast
- Demand for cloud and operational technology security is likely to grow. Forecast
A fast-growing technology field
About 3,300 extra people were employed in this group over the last year. Verified fact
About these figures
Jobs and Skills Australia groups cyber security specialists with database and systems administrators, so these figures cover all three. Verified fact
No licence; certifications and clearances matter
Employers look for industry certifications and, for government work, security clearances. Opinion
Credentials that matter
Industry certifications are widely used to show skills at each career stage. Estimate
Many government and defence roles require Australian citizenship and a security clearance. Estimate
Every route in
Tap a route to open it. The tag shows how commonly that route actually delivers the target role — not how hard the study is.
- Complete a cyber security or IT degree with a security major. Estimate
- Start in a graduate, help desk or security operations role. Estimate
- Work in IT support or networking, then move into security with certifications. Estimate
- TAFE certificates and diplomas lead to entry roles and can give credit into degrees. Estimate
- Defence and federal agencies run cyber traineeships and graduate programs. Estimate
The sequence that actually matters
The qualification varies wildly across people who reach this role. The sequence barely varies at all.
| Stage | Typical age | What you are buying | How people get stuck here |
|---|---|---|---|
| Training | 18 to 21 | Fundamentals of networks, systems and security | Skipping networking and operating system basics. |
| First IT or security role | 21 to 24 | Real-world experience | Expecting a senior security title straight away. |
| Analyst | 23 to 28 | Hands-on security work and certifications | Not building scripting and cloud skills. |
| Specialist or manager | 28 and over | Leading teams or a specialism | Losing technical skills too early. |
Pathways compared
Compare them on what they cost you, not just where they end. The last column matters most — it is where the pathway leaves you if the target role never arrives.
| Pathway | Live example | Years | Study cost | Difficulty | Biggest risk | If it doesn’t work out |
|---|---|---|---|---|---|---|
| Cyber security degree | Common Estimate | 3 years Estimate | About $29,600 at 2027 rates, deferrable Estimate | Moderate | Graduating without practical skills | IT, networking, software |
| IT work plus certifications | Common among practitioners Estimate | 4 to 6 years Estimate | Low; certifications cost a few hundred to a few thousand dollars Estimate | Self-driven | Slower start | Broad IT roles |
Experience that runs alongside study
This matters more than marks. Every one of these is available before you graduate.
Capture the flag competitions
Security challenge competitions build practical skills and get noticed by employers. Estimate
Government and bank graduate programs
Structured graduate intakes in security. Estimate
Security internships
Short placements with consultancies and security teams. Estimate
Security community meetups
Local security groups and conferences welcome students. Estimate
Entry ranks vary widely
Macquarie's Bachelor of Cyber Security had a lowest selection rank of 75.20 and UTS's Bachelor of Cybersecurity 84.00 in January Round 1 2026. Verified fact
What matters more
Practical skills, competitions and certifications often matter more to employers than the rank you entered with. Opinion
Where you can study this
Two questions decide this table: do you want a specialist network from year one, or maximum optionality if you leave the field?
| Institution | State | Course | Selection rank | Duration | Study modes | Placement | What it’s good at |
|---|---|---|---|---|---|---|---|
| Macquarie University Macquarie University | NSW | Bachelor of Cyber Security | 75.20, UAC lowest selection rank for January Round 1 2026 Verified fact | 3 years | full-time | No mandatory placement recorded inside the degree. | A named cyber security degree with a strong security research group. Opinion |
| Technical and Further Education Commission Liverpool | NSW | Bachelor of Information Technology (Cyber & Network Security) | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | No mandatory placement recorded inside the degree. | TAFE NSW's degree, with a practical focus. Opinion |
| UNSW Sydney Kensington | NSW | Bachelor of Cyber Security | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | No mandatory placement recorded inside the degree. | A research-intensive school; UAC lists two codes at very different ranks, so check which applies. Opinion |
| University of Technology Sydney (UTS) Haymarket | NSW | Bachelor of Cybersecurity | 84.00, UAC lowest selection rank for January Round 1 2026 Verified fact | 3 years | full-time | No mandatory placement recorded inside the degree. | A city campus with industry links. Opinion |
| Western Sydney University Parramatta | NSW | Bachelor of Cyber Security and Behaviour | 76.10, UAC lowest selection rank for January Round 1 2026 Verified fact | 3 years | full-time | The register records 180 hours of required work component for this course, so there is a placement or practical element inside the degree. 180 hours Verified fact | Combines technical security with the human side of attacks. Opinion |
| Griffith University Nathan | QLD | Bachelor of Cyber Security | 67.00, indicative only: UAC January Round 1 2026 reports no Year 12 offers at this course code Verified fact | 3 years | full-time | No mandatory placement recorded inside the degree. | A Queensland cyber security degree. Opinion |
| TAFE Queensland Coomera | QLD | Bachelor of Engineering Technologies (Cyber Security) | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | The register records 84 hours of required work component for this course, so there is a placement or practical element inside the degree. 84 hours Verified fact | A TAFE degree with a technical focus. Opinion |
| Adelaide University Adelaide | SA | Bachelor of Cyber Security | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | The register records 300 hours of required work component for this course, so there is a placement or practical element inside the degree. 300 hours Verified fact | South Australia's cyber security degree, close to defence employers. Opinion |
| Flinders University Adelaide | SA | Bachelor of Cybersecurity | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | The register records 270 hours of required work component for this course, so there is a placement or practical element inside the degree. 270 hours Verified fact | An Adelaide program with defence industry links. Opinion |
| Chisholm Institute Dandenong | VIC | Bachelor of Information Technology (Cyber Security) | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | No mandatory placement recorded inside the degree. | A TAFE degree with a practical focus. Opinion |
| Deakin University (Deakin) Burwood | VIC | Bachelor of Cyber Security | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | The register records 912 hours of required work component for this course, so there is a placement or practical element inside the degree. 912 hours Verified fact | The register records 912 hours of required work component, with an honours version listed. Opinion |
| La Trobe University Bundoora | VIC | Bachelor of Cybersecurity | 59.70 to 65.60 across course codes, UAC lowest selection rank for January Round 1 2026 Verified fact | 3 years | full-time | No mandatory placement recorded inside the degree. | UAC lists two codes for it. Opinion |
| Monash University Clayton | VIC | Bachelor of Cybersecurity | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | The register records 720 hours of required work component for this course, so there is a placement or practical element inside the degree. 720 hours Verified fact | The register records 720 hours of required work component. Opinion |
| RMIT University (RMIT) Melbourne | VIC | Bachelor of Cyber Security | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | No mandatory placement recorded inside the degree. | A city-centre program with industry links. Opinion |
| Swinburne University of Technology Hawthorn | VIC | Bachelor of Cyber Security | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | No mandatory placement recorded inside the degree. | A Hawthorn program. Opinion |
| Victoria University Footscray | VIC | Bachelor of Cyber Security | Not verified for this edition — confirm with your state admissions centre Estimate | 3 years | full-time | No mandatory placement recorded inside the degree. | Block-model teaching, one subject at a time. Opinion |
| Edith Cowan University Joondalup | WA | Bachelor of Science (Cyber Security) | 70.00, TISC 2026 Main Round minimum rank for consideration Verified fact | 3 years | full-time | No mandatory placement recorded inside the degree. | Perth's best-known cyber security program; a cybercrime and intelligence degree is also listed. Opinion |
Postgraduate study
Usually a mid-career decision, not a next step. The honest question is whether it adds anything your first three jobs would not.
Master of Cyber Security
Useful for IT graduates moving into security; experience and certifications often matter more. Opinion
17 public universities and TAFEs on the register
The table below is built from the CRICOS register, not from memory. Verified fact
How to read this table
Institution names, course names, campuses, durations and work hours are copied from the CRICOS register. Verified fact
CRICOS lists courses open to international students, so a domestic-only course will not appear here even if it is well established. Opinion
Eleven private colleges also register cyber security degrees and are not shown here; check accreditation and graduate outcomes carefully if you consider one. Opinion
6 of 17 institutions carry a real, dated selection rank from UAC or TISC. Ranks published for a different course or an unidentifiable campus were not reused; the rest read not verified. Opinion
Admissions centres also list these courses that are not in this field of the register: Curtin University, Bachelor of Computing (Cyber Security), TISC minimum 80.00 and lowest offered 83.20. Verified fact
The gates
What actually stands between you and a place. Where a gate does not apply, that is stated rather than omitted — an absent requirement is decision-relevant information.
Adjustment and access schemes
Points added to a raw rank. These are systematically under-claimed relative to eligibility — check every one.
Educational access schemes
Adjustments for students affected by financial hardship, illness, caring duties or disrupted schooling, applied for through your state admissions centre. Many eligible students never apply. Estimate
Rural and regional adjustments
Points added for applicants from regional areas, especially at regional universities. Estimate
Early entry
Offers made before results are released. Applications usually open around August and cost nothing.
Schools recommendation and early offer schemes
Offers based on Year 11 results and school recommendations, made before ATARs are released. Applications usually open around August of Year 12. Estimate
Alternative and back-door entries
No rank closes most careers. It only changes the first two years.
TAFE cyber security courses
Practical certificates and diplomas. Estimate
IT degree with a security major
A broader degree that still leads to security roles. Estimate
Industry certifications
Entry-level certifications show practical skills. Estimate
Defence traineeships
Paid training with defence and government. Estimate
Which route is realistic depends on your selection rank, your citizenship and clearance eligibility, your state and your budget; a personalised plan can work through that with you. Opinion
Subject selection — General advice for all states; check your state's subject names
Take these
- Maths. Opinion
- Digital technologies or software engineering. Opinion
- English, for report writing. Opinion
Think twice about
- Ignoring writing; security reports matter as much as technical skills. Opinion
Money to help you get there
Far more scholarship money is offered than is claimed. Rounds close early, often in September.
Cyber security scholarships
Government and industry scholarships for cyber security students. Estimate
Women in cyber scholarships
Scholarships encouraging women into cyber security. Estimate
Defence sponsorship
Defence sponsors some ICT and cyber students. Estimate
University equity scholarships
Means-tested scholarships offered by every university to students from low-income, regional or disadvantaged backgrounds. Estimate
Entry is moderate; skills decide jobs
Published ranks run from the 60s to the 80s. Opinion
Before you apply
Start learning networking and Linux basics. Opinion
Try a beginner capture the flag challenge. Opinion
General information only — not financial advice
The figures in this section are indicative estimates only and are general in nature. They are modelled from published rates and typical costs, and they take no account of your personal objectives, financial situation or needs.
They are not quotes, and they are not a projection of what you personally will pay or earn. Course fees, indexation rates, salaries and repayment thresholds all change.
Before you act on any of it, speak to a qualified financial adviser about your own circumstances, and confirm course costs and fees directly with the institution and your state admissions centre.
What it actually costs
Set your own situation. Everything updates live, and every figure is calculated in your browser from the assumptions listed below — none of it is a number quoted at you.
Every line, three ways
Minimum, average and premium. The deferrable column is the one most people misread — a deferred cost is repaid through the tax system, not paid up front.
| Cost | Minimum | Average | Premium | Deferrable |
|---|---|---|---|---|
| Student contribution (tuition) Computing is capped at $9,880 per full-time year in 2027. Three years in every column. Verified fact | $29,640 | $29,640 | $29,640 | Yes |
| Student services and amenities fee Capped at $386 a year for full-time students in 2027 and deferrable through SA-HELP. Verified fact | $1,158 | $1,158 | $1,158 | Yes |
| Laptop and home lab A capable laptop and a small home lab for practice. Estimate | $1,500 | $2,000 | $3,500 | No |
| Certifications Entry-level certification exams. Estimate | $300 | $1,000 | $2,500 | No |
| Textbooks and courses Many resources are free online. Estimate | $300 | $800 | $1,500 | No |
| Living costs while studying Zero if living at home for the whole degree; the average column assumes moving out for about two years, the premium column for all 3. Estimate | $0 | $30,000 | $66,000 | No |
Return and assumptions
What these numbers assume
A graduate starting salary of $80,000, typical for graduate security analysts. Estimate
Compulsory HELP repayments start at $69,528 of repayment income in 2026-27, at 15 cents per dollar above that threshold, so early repayments are a small share of salary. Verified fact
Lifetime earnings assume long-run pay growth of 3.0 per cent a year over 40 years. A projection, not a promise. Forecast
Tuition and the amenities fee can be deferred through HECS-HELP and SA-HELP and repaid through the tax system once income passes the threshold. Verified fact
Certifications are not covered by HECS-HELP; some employers pay for them. Estimate
Mid-priced to study, well paid with experience
Fees are moderate, and pay rises quickly with skills and certifications. Opinion
The verdict
Several ways of asking “which is best”, answered separately — because the best pathway depends entirely on what you are optimising for.
Best value
A public university or TAFE cyber security degree with practical labs
Practical labs and industry links matter more than reputation. Opinion
Which one is yours depends on your selection rank · where you can study
Fastest
A three-year cyber security degree with internships
Three years plus internships gets you job-ready. Opinion
Which one is yours depends on your selection rank
Most prestigious
A research-intensive university with a security research group
Helpful for research and some graduate programs. Opinion
Which one is yours depends on your selection rank
Lowest cost
TAFE plus entry-level certifications and IT work
Low fees and early income. Opinion
Which one is yours depends on whether a local TAFE offers it
Best long-term return
A degree plus certifications and a specialism such as cloud security
Specialists and managers earn the most. Opinion
Which one is yours depends on your interests · years of experience
Best for mature-age students
IT experience plus certifications, or part-time study
Career changers from IT move fastest. Opinion
Which one is yours depends on your IT background
Best for career changers
A postgraduate cyber security qualification or bootcamp plus certifications
Shorter routes work best with some IT experience. Opinion
Which one is yours depends on your current skills
Get your personalised plan
Sign in to generate one for your own circumstances — your state, your year level, your budget.
Your action plan
Concrete, dated and checkable. Tick these off as you go — your progress is saved in this browser.
This year
First three years
By five years
By ten years
Decision points and contingencies
The last column is the useful one. A plan with no fallback is a wish.
| Decision point | When | Preferred move | If that’s unavailable |
|---|---|---|---|
| University offer round | December to January of Year 12 | A cyber security degree | Take an IT degree with a security major, or TAFE. Estimate |
| First role | Final year | A graduate security role | Start in IT support or networking and move across. Estimate |
| Specialism | Three years in | Choose a specialism | General security analyst roles remain in demand. Estimate |
| Clearance | When applying to government | Apply for roles needing clearance | Private sector roles rarely need one. Estimate |
If the whole pathway closes
Security skills transfer to IT operations, networking, cloud engineering and software development. Estimate
Mistakes to avoid
The most common
- Skipping networking fundamentals. Opinion
- Graduating without practical projects. Opinion
- Expecting a senior title straight away. Opinion
And the less obvious
- Neglecting report writing. Opinion
- Ignoring how AI is changing entry-level monitoring work. Opinion
What to read, watch and do
Generic to the career, not to you — start anywhere. Most of these cost nothing.
Capture the flag competitions
The best way to build practical skills. Opinion
Local security community groups
Meetups and conferences welcome students. Opinion
UAC lowest selection ranks
Published ranks for cyber security degrees in NSW and the ACT. Verified fact
Free online cyber security courses
Introductory courses cover networking and security basics. Opinion
Entry-level security certifications
Widely used to show baseline skills. Opinion
A growing field that rewards practical skills
Cyber security suits curious, patient investigators who keep learning. Opinion
Demand is strong and pay rises quickly with experience. Build practical skills and certifications alongside the degree. Opinion