Takes apart malicious software to learn exactly what it does, how to detect it and how to stop it, using disassemblers and sandboxes. BLS does not publish separate figures for digital forensics analysts; it counts them within digital forensics analyst (SOC 15-1299), whose median pay is $116,580 a year (BLS OEWS, May 2025). Typical entry-level education: Bachelor's degree.
- SOC 15-1299
- Computer and Mathematical
- Last updated October 9, 2026
At a glance
Malware Analyst in four numbers
- Median pay
- $116,580a year, or $56.05/hrBLS OEWS, May 2025Lowest 10% $56KTop 10% $188K
US median, all jobs: $50,980
- Projected growth
- +5.1%Faster than averageBLS EP, 2025–2035This career+5.1%All jobs+3.5%
Projected employment change, 2025–2035 Item Value This career +5.1% All jobs +3.5% - Openings a year
- 27,000471,200 jobs todayBLS EP, 2025–2035
- Jobs in 2025471.2K
- Projected 2035495.3K
Employment, 2025–2035 Item Value Jobs in 2025 471.2K Projected 2035 495.3K - Typical education
- Bachelor'sneeded to enterBLS EP, 2025–2035; mix: O*NET
Also advertised as: Malware Reverse Engineer, Reverse Engineer, Malware Researcher, Threat Researcher, Malware.
Pay
How much do Digital Forensics Analysts make?
Every malware analyst in the US, by percentile of annual wage
Median
$116,580
Middle half earn $79,370 to $157,500
- 10th
- $55,940
- 25th
- $79,370
- 75th
- $157,500
- 90th
- $188,470
All US occupations: $50,980
| Percentile | Value |
|---|---|
| 10th | $55,940 |
| 25th | $79,370 |
| Median | $116,580 |
| 75th | $157,500 |
| 90th | $188,470 |
| All US occupations | $50,980 |
Source: BLS OEWS, May 2025
- Median annual wage
- $116,580
- Median hourly wage
- $56.05/hr
- Mean annual wage
- $122,230
- People employed
- 435,370
Versus all US occupations
At $116,580, Digital Forensics Analysts earn 129% above the $50,980 median across all US occupations, a difference of $65,600 a year.
Versus computer and mathematical occupations
The median is typical for the Computer and Mathematical group, where the middle occupation pays $116,580.
Pay range
The top 10% earn $188,470 or more while the bottom 10% earn $55,940, a gap of 3.4×. That is an unusually wide spread, which usually tracks specialisation, employer type and years of experience.
Rank in the bank
This median pays more than 82% of the 1,741 occupations in the NueCareer career bank.
Highest-paying state
District of Columbia pays the most at $156,590, and still leads at $142,483 once local prices are taken into account.
Pay by state
Which states pay Digital Forensics Analysts the most?
State medians come from the same OEWS release as the national figures. The cost-of-living column divides each state median by that state's BEA Regional Price Parity, restating pay in national-average dollars so a high-cost state and a low-cost one can be compared directly.
| State | Median | COL-adjusted | Employed |
|---|---|---|---|
| 1District of Columbia | $156,590 | $142,483 | 17,200 |
| 2Maryland | $144,680 | $137,844 | 19,060 |
| 3Colorado | $139,580 | $135,446 | 11,800 |
| 4Virginia | $139,030 | $137,512 | 17,000 |
| 5Delaware | $137,470 | $137,734 | 860 |
| 6California | $134,440 | $121,423 | 80,150 |
| 7Washington | $128,940 | $120,490 | 14,360 |
| 8Connecticut | $127,720 | $123,270 | 3,100 |
| 9New Mexico | $127,090 | $137,824 | 1,650 |
| 10Hawaii | $120,100 | $109,230 | 2,080 |
Job outlook
Is Malware Analyst a growing career?
Employment change over 2025–2035, against every US occupation
Faster than average. +5.1% projected growth vs 3.5% for all occupations.
| Item | Value |
|---|---|
| Digital Forensics Analysts | +5.1% |
| All US occupations | +3.5% |
Source: BLS EP, 2025–2035
Faster than average
BLS projects employment of Digital Forensics Analysts to change 5.1% over 2025–2035, against 3.5% projected for all occupations. That is 24,200 more jobs.
Annual openings
About 27,000 openings are projected each year, 5.7% of the 471,200 jobs that existed in 2025. Most come from workers leaving the occupation, not from growth alone.
Getting in
How to become a Malware Analyst
A bachelor's degree in computer science, computer engineering or cybersecurity is common. The core skills are assembly language for x86 and ARM, operating system internals, C programming and comfort with reverse engineering tools, including the free Ghidra suite released by the National Security Agency.
The GIAC Reverse Engineering Malware (GREM) certification is the best-known credential. Analysts often build skills through crackme challenges, capture-the-flag events and published malware write-ups, and many start in SOC, forensics or incident response roles before specializing. Government roles may require a security clearance.
- 1
Typical entry-level education
Bachelor's degree
- 2
Work experience in a related occupation
None
- 3
Typical on-the-job training
None
- 4
Preparation needed (O*NET job zone)
Medium preparation
BLS Employment Projections, 2025–2035; job zone from O*NET 31.0 Database.
The work
What does a Malware Analyst do?
Malware analysts dissect malicious software. When a new ransomware strain or spyware sample appears, they run it safely in isolated sandboxes to watch its behavior, then reverse engineer it with disassemblers and debuggers such as Ghidra and IDA Pro to understand its code at the instruction level. They work out how it spreads, how it hides, what it steals and how it communicates with its operators.
From that analysis they write detection signatures, such as YARA rules, extract indicators for defenders to block, and sometimes find flaws that allow victims to recover encrypted files. Their reports feed threat intelligence teams, antivirus engines and incident responders. Some analysts specialize in mobile malware, firmware or specific threat groups.
Day-to-day tasks
- Run malware samples in isolated sandboxes
- Reverse engineer binaries with disassemblers and debuggers
- Decode obfuscation and encryption routines
- Write YARA rules and detection signatures
- Extract indicators of compromise for defenders
- Write technical reports on malware families
- Support incident responders with sample analysis
Typical tasks, researched by NueCareer from the sources below.
Working conditions and hours
Malware analysts work at antivirus and security vendors, threat intelligence firms, large enterprises, government agencies and defense contractors. The work is desk-based in isolated lab environments built for handling live malicious code. Some private-sector roles are remote. Hours are generally regular, with urgent analysis during major outbreaks.
Where the work happens
Indoors, climate-controlled
NeverEvery dayIndoors, in a climate-controlled space, every day.
Outdoors in all weather
NeverEvery dayAlmost never works outdoors.
Physical demands
Sitting
NeverAlmost all the timeSeated for more than half the working day.
Standing
NeverAlmost all the timeBending or twisting
NeverAlmost all the time
Working with people
Contact with other people
NoneConstantFace-to-face discussions
NeverEvery dayDealing with the public
Not importantExtremely important
Pressure and stakes
Strict deadlines
NeverEvery dayConflict situations
NeverEvery dayCost of a mistake
Not seriousExtremely serious
Autonomy
Freedom to decide
NoneA lotA lot of freedom to make decisions without checking first.
Conditions: O*NET Work Context survey. Each item has its own scale, so each dot is read against the two answers that end its own line.
Core skills
O*NET importance, 1 to 5
- Reading Comprehension3.8
- Active Listening3.5
- Writing3.5
- Speaking3.5
- Active Learning3.4
- Critical Thinking3.3
- Monitoring3.3
- Learning Strategies2.9
| Item | Value |
|---|---|
| Reading Comprehension | 3.8 |
| Active Listening | 3.5 |
| Writing | 3.5 |
| Speaking | 3.5 |
| Active Learning | 3.4 |
| Critical Thinking | 3.3 |
| Monitoring | 3.3 |
| Learning Strategies | 2.9 |
Source: O*NET 31.0 Database
Transferable skills
O*NET importance, 1 to 5
- Judgment and Decision Making3.5
- Complex Problem Solving3.4
- Systems Analysis3.1
- Social Perceptiveness3.0
- Systems Evaluation3.0
- Time Management3.0
- Coordination2.9
- Persuasion2.9
| Item | Value |
|---|---|
| Judgment and Decision Making | 3.5 |
| Complex Problem Solving | 3.4 |
| Systems Analysis | 3.1 |
| Social Perceptiveness | 3.0 |
| Systems Evaluation | 3.0 |
| Time Management | 3.0 |
| Coordination | 2.9 |
| Persuasion | 2.9 |
Source: O*NET 31.0 Database
Tools and software
- Application server software · in demand
- Cloud-based data access and sharing software · in demand
- Configuration management software · in demand
- Data base user interface and query software · in demand
- Development environment software · in demand
- Enterprise application integration software · in demand
- Enterprise system management software · in demand
- Expert system software · in demand
- Internet directory services software · in demand
- Object or component oriented development software · in demand
- Office suite software · in demand
- Operating system software · in demand
“In demand” marks an O*NET Employer-Based Hot Technology, software named in real job postings for this occupation.
Personality fit
What personality type suits a Malware Analyst?
NueCareer estimate (Holland code IRC) built on O*NET's Digital Forensics Analyst profile, scored 1 to 7
| Axis | Malware Analyst |
|---|---|
| Realistic | 4 |
| Investigative | 6 |
| Artistic | 2 |
| Social | 2 |
| Enterprising | 3 |
| Conventional | 6 |
Source: O*NET 31.0 Database
What the work is built around
Day to day this is work built around investigating, analysing and solving problems with ideas and data, combined with organising, following procedures and working precisely with data.
- Investigative6.1
- Conventional6.0
- Realistic3.9
- Enterprising2.7
- Artistic1.7
- Social1.6
Closest MBTI types
NueCareer fit scores: cosine similarity between each MBTI type's interest vector and this occupation's O*NET interest profile. Not a BLS or O*NET figure; the method is documented on our methodology page.
Explore further
Careers related to Malware Analyst
O*NET related occupations
- Computer and Mathematical
- Computer and Mathematical
- Computer and Mathematical
- Protective Service
- Computer and Mathematical
- Business and Financial Operations
More computer and mathematical careers
Median annual pay, with digital forensics analysts highlighted
- Software Developer$135,980
- Actuary$130,000
- Data Scientist$120,230
- Business Intelligence Analyst$120,230
- Malware Analyst$116,580
- Database Administrator$104,620
- Web Designer$104,000
- Computer Programmer$100,390
- Web Developer$92,650
| Item | Value |
|---|---|
| Software Developer | $135,980 |
| Actuary | $130,000 |
| Data Scientist | $120,230 |
| Business Intelligence Analyst | $120,230 |
| Malware Analyst | $116,580 |
| Database Administrator | $104,620 |
| Web Designer | $104,000 |
| Computer Programmer | $100,390 |
| Web Developer | $92,650 |
Source: BLS OEWS, May 2025
Lists Malware Analyst appears on
Questions
Malware Analyst: frequently asked questions
How much do Digital Forensics Analysts make?
BLS does not publish a separate wage for digital forensics analysts. It counts them within digital forensics analyst, whose median pay is $116,580 a year (BLS OEWS, May 2025). The middle half of that occupation earn between $79,370 and $157,500, and the top 10% earn $188,470 or more.
Do you need a degree to become a Malware Analyst?
Yes. BLS reports a bachelor's degree as the typical entry-level education for Digital Forensics Analysts, and O*NET rates the preparation needed as medium preparation.
Is Malware Analyst a growing career?
Yes. Employment is projected to grow 5.1% over 2025–2035, faster than the 3.5% average for all occupations (BLS EP, 2025–2035). BLS still projects about 27,000 openings a year, mostly from workers retiring or moving to other work.
What does a Malware Analyst do?
Malware analysts dissect malicious software. A typical task: run malware samples in isolated sandboxes. Employers most often ask for Application server software, Cloud-based data access and sharing software, Configuration management software.
Which states pay Digital Forensics Analysts the most?
The highest state medians for Digital Forensics Analysts are District of Columbia ($156,590), Maryland ($144,680), Colorado ($139,580) (BLS OEWS, May 2025).
What personality type suits a Malware Analyst?
O*NET scores Digital Forensics Analysts highest on the Investigative, Conventional and Realistic interest areas, so the work mixes investigating, analysing and solving problems with ideas and data with organising, following procedures and working precisely with data. On NueCareer's MBTI-to-interest mapping that lines up most closely with ISTJ personalities. Personality is a fit signal, not a gate. The free NueCareer quiz scores your own profile against all 1,731 careers in the bank.