Six sources will tell you what a cyber security analyst earns in Toronto. They will give you six different answers, and the gap between the lowest and the highest is more than sixty thousand dollars.
That is the real problem with researching a cyber security salary in Canada. The numbers are easy to find and hard to trust. This guide gives you the ranges, then explains why they disagree, so you can work out which one applies to your situation.
What a cyber security salary in Canada actually looks like
The most defensible national figure comes from the Government of Canada’s Job Bank, which publishes wage data drawn from administrative sources rather than from people volunteering what they earn.
Job Bank groups security roles under NOC 21220, covering information security analyst, IT security analyst and systems security analyst titles. Its wage report, updated November 2025, puts the national range at $30.00 to $72.12 an hour, with a median close to $49.52. At full-time hours that works out to roughly $62,400 to $150,000 a year, with a median near $103,000.
Whether you write it as cyber security salary or cybersecurity salary, that is the band the official data supports. And the width is the point. Cyber security is not one job. A SOC analyst watching alerts on a rotating shift and a cloud security architect designing controls for a regulated environment sit at opposite ends of the same occupational code.
Why every cyber security salary source gives a different number
Here is what the major sources report for a cyber security analyst salary in Toronto, all current as of mid-2026:
- SalaryExpert: $142,673, plus an average bonus around $6,000. Built from employer compensation surveys and modelled against cost-of-living data.
- levels.fyi: $113,564 total compensation nationally. Self-reported, skews toward large technology employers, and includes stock.
- ZipRecruiter: $94,862. Derived from scraped job postings, so it reflects what roles are advertised at.
- Indeed: $92,686 nationally, from 135 reported salaries.
- Glassdoor: $81,428, from 224 salaries submitted anonymously by people in the role.
- PayScale: $79,075 base salary, self-reported, excluding bonus.
Same role. Same city. A spread of more than sixty thousand dollars.
The differences are not errors. They are three different questions being answered:
- What employers say they pay. Employer surveys like SalaryExpert capture full compensation including bonus, and the companies that respond to compensation surveys tend to be larger and better paying than the ones that do not.
- What roles are advertised at. Posting-derived figures like ZipRecruiter’s reflect the number in the job ad. Advertised ranges are aspirational at the top end and frequently negotiated at the bottom.
- What people say they earn. Self-reported data from Glassdoor, PayScale and levels.fyi depends entirely on who chooses to submit. Base-only figures exclude bonus. Total-compensation figures include stock that may never vest.
None of these is the number a candidate actually accepts, which is a fourth figure again, and the one neither party can look up.
Cyber security analyst salary by experience
Seniority moves the number further than any other factor. Drawing on the same sources:
- Entry level, zero to two years. PayScale puts entry-level cyber security analysts in Toronto around $56,000. Job Bank’s low end of $30.00 an hour lands close to $62,000 at full-time hours. Expect a real range of roughly $55,000 to $75,000.
- Intermediate, three to six years. This is where the Glassdoor and Indeed medians cluster, around $80,000 to $95,000. Analysts with incident response experience move through this band faster than those doing monitoring alone. It is also the band where most of the security analyst searches we run actually land.
- Senior, seven years and up. SalaryExpert puts senior analysts near $161,000, and Job Bank’s ceiling of $72.12 an hour is about $150,000. Realistically $115,000 to $150,000, with the top of that reserved for cloud security and architecture.
The jump from monitoring to engineering is usually worth more than another two years in the same seat. A cyber security engineer salary tends to sit above an analyst salary at equivalent experience, because the work moves from detecting problems to designing the systems that prevent them.
Cyber security salary in Toronto and across Ontario
Toronto pays a premium, though a smaller one than most people expect. SalaryExpert puts Toronto around 18% above the national average. The self-reported sources show a narrower gap, and Glassdoor’s Toronto figure actually sits close to its national number.
The premium is real but it is concentrated. Financial services and the federal ecosystem pay the most, because both operate under regulatory obligations that make security a compliance requirement rather than a discretionary spend. A bank in downtown Toronto and a mid-size manufacturer in Mississauga will not pay the same for the same title.
There is also a factor that never appears in aggregate data: security clearance. Roles requiring enhanced reliability or secret clearance carry a premium in Ottawa and across the federal supply chain, partly for the skills and partly because the pool of cleared candidates is small and slow to expand. Clearance is not a line item in any salary survey, and it moves offers materially.
Do certifications raise a cyber security salary?
Yes, but less predictably than training providers suggest.
CISSP is the certification most consistently associated with higher pay in Canadian security hiring, largely because it is a common filter in job descriptions rather than because the content itself commands a premium. It gets candidates through screening. Cloud security certifications track closely with the roles that pay best, though the causation runs both ways: people who work on cloud security get cloud certifications.
What we see in practice is that certifications matter most at the two ends. Early on they substitute for experience a candidate does not yet have. At senior level they are close to irrelevant, because hiring managers are assessing what someone has actually built and defended. In the middle they help less than the marketing implies.
What a cyber security hire costs an employer
Every source above answers the candidate’s question. If you are hiring, the salary is not the number you need.
Budget for salary plus employer costs: CPP and EI contributions, employer health tax where it applies, benefits, and equipment. For a security role that often means additional licensing and training budget. A $100,000 analyst is realistically a $120,000 to $130,000 line item before anyone counts the cost of the search itself.
There is now a compliance dimension too. Since Ontario’s job posting requirements took effect on 1 January 2026, employers with 25 or more staff must publish expected compensation or a range on publicly advertised postings, and a range cannot span more than $50,000. That obligation falls away above $200,000, which covers most security leadership roles but very few analyst positions.
If you are building bands rather than pricing a single offer, the difference between a salary range and a hiring range matters more here than it used to. In practice the range you post is now public and comparable. Posting low to preserve negotiating room is a more expensive strategy than it used to be, because candidates can see exactly where you sit against everyone else advertising the same role.
The part the salary data does not tell you
Job Bank rates the 2025 to 2027 employment outlook for this occupation in Ontario as limited. That sits oddly beside the constant messaging that cyber security is a booming field, and it is worth taking seriously.
Demand for security work is genuinely growing. Hiring for security headcount is growing more slowly, because a lot of organisations are meeting the need with managed services, tooling, or by adding security responsibilities to existing infrastructure roles. Nova Scotia and several smaller provinces currently show stronger relative outlooks than Ontario does.
For a candidate, that means the market rewards depth over breadth right now. Generalist security profiles are competing against a lot of career changers. Incident response, cloud security and anything touching regulated environments are still short of people.
For an employer, it means the shortage is narrower than the headlines suggest. You will find monitoring analysts. You will struggle to find someone who has genuinely run an incident. That gap is most of what our cyber security recruitment work consists of.
Using these numbers
If you are benchmarking an offer, take Job Bank as your floor and treat the self-reported sources as a sanity check rather than a target. If a number looks high, check whether it includes bonus and stock before you anchor on it.
If you are setting a range to post, work from what you can actually pay rather than from an aggregate. It will be read alongside every other posting for that role, and candidates now compare them directly.
And if you are trying to work out whether a number is competitive across other technology roles rather than just this one, our 2026 Canadian salary guide covers current ranges by role and city.