After an attack, the answers are buried in logs, memory, and malware — and you dig them out, analyzing the evidence to reconstruct how far an intrusion went. Where the breach gets explained.
The day often blends analyzing malware and mapping an attacker's path through systems. You support incident response and investigations, and a clear, defensible account is the goal. Documentation and rigor tend to matter as much as the technical findings.
The pace swings with the setting: SOC, consultancy, or government shop each frame the work differently. The hard part for many can be urgency colliding with the patience analysis demands — a live breach won't wait, but careful analysis can't be rushed. Attacker techniques evolve fast, so last year's knowledge may not hold.
Folks who do well here tend to be analytical, dogged, and calm under a live breach. Trade-offs can include on-call pressure and the stress of active incidents. For someone who likes piecing together how an attack worked and turning chaos into a clear story, the work can be genuinely gripping.
Still figuring out what you want to become
when you grow up?
Where this role sits in the broader career landscape — and where it can take you.
It's your career.
Take the wheel.
Roles like this one sit within a broader occupational category. The numbers below reflect that full landscape — helpful for context, but your specific experience will depend on level, specialty, and where you work.
No skills data available
Roles with similar work and overlapping career paths
View all Technology roles →After an attack, the answers are buried in logs, memory, and malware — and you dig them out, analyzing the evidence to reconstruct how far an intrusion went. Where the breach gets explained.
Median pay for a Cyber Forensics Analyst is about $109K nationally, with the field ranging roughly from $53K to $177K depending on experience, employer, and metro (BLS).
Employment in this field is projected to grow about 8.2% through 2034, with roughly 439,380 people working in it today (BLS).
Closely related roles include Security Management Consultant, IAM Consultant (Identity and Access Management Consultant), and Digital Forensics Analyst.
Still figuring out what you want to become
when you grow up?