Cyber Security Analyst Fresher Salary in India 2026: ₹3.5 to ₹10 LPA

Say you have just finished your degree. Two offer letters arrive for the same job title: cyber security analyst. One says ₹4 LPA. The other says ₹10 LPA. Both numbers sit inside the fresher bands in this 2026 salary breakdown. Nothing about the work looks different on paper. So why is the gap so big?

A fresher cyber security analyst in India usually earns ₹4–6 LPA at an IT services firm. Product companies and global capability centres (GCCs, the India offices of foreign companies) pay ₹8–10 LPA for the same title, according to Salaryinfo. That is a stretch for most freshers, so plan on ₹4–6 LPA at a services firm. The PayScale entry-level average of ₹4.73 LPA backs that up. The employer type appears to change your pay more than the city does, based on these sources. The typical bands differ by about 4 LPA, from ₹4–6 to ₹8–10. The ₹10 LPA figure is a typical top; some city and OSCP figures run higher, up to ₹12 and ₹20 LPA. Product firms and GCCs hire for their own security teams, while services firms bill clients for your hours. That is why one job title can carry such different offers.

Cyber security analyst fresher salary in India: the ranges

Across the four 2026 salary pages listed below, plus PayScale, fresher pay starts near ₹3.5 LPA (Scaler) and tops out around ₹10 LPA (Salaryinfo). The PayScale entry-level average sits at ₹4.73 LPA.

Here is what each source says about fresher pay:

• Futurense: ₹4–6 LPA at IT services firms.
• Scaler: ₹3.5–7 LPA.
• Cybersecurity Academy: ₹3.5–6 LPA, with ₹6 LPA and above at product firms and GCCs, as well as consulting firms.
• Salaryinfo: ₹4–10 LPA, depending on role and employer.

PayScale gives the most precise figure. Its entry-level average total pay is ₹473,098, based on 82 salaries. Across all experience levels, the same page puts the average at ₹581,061 a year.

Why don't the sources agree? Most of them build their numbers from pay that people report about themselves. A sample of a few dozen people can swing with one large offer. Some pages also mix job titles, so a "SOC analyst" and a "security analyst" land in the same bucket. Treat each range as a rough guide, not a promise. Most of the higher figures here come from one site, Salaryinfo, so they are not fully independent. For planning, expect ₹4–6 LPA at a services firm, and treat ₹8 LPA or more as a stretch.

Cyber security analyst monthly pay from CTC, before deductions

A ₹3.5–7 LPA fresher package works out to roughly ₹30,000–58,000 a month before tax, and the amount that reaches your bank account is lower. None of the sources here gives a standard take-home figure, so the exact drop depends on your offer.

The gap comes from how Indian offers are written. Your offer letter shows CTC, or cost to company. That is everything the employer spends on you in a year, not what you take home.

Three things usually sit between CTC and in-hand pay:

• Variable pay: a bonus paid only if you and the company hit targets, often once a year.
• Provident fund (PF): a retirement saving that both you and the employer pay into.
• Tax: income tax, plus professional tax in some states.

The table below divides the yearly package by twelve. It shows gross monthly pay only, using the fresher band from Scaler and the employer bands from Salaryinfo.

Your real in-hand figure depends on your own offer letter. Two offers with the same CTC can pay different monthly amounts. One may hold back a large variable part, while the other pays it as fixed salary. Ask HR for the salary breakup before you compare offers.

IT services vs product companies and GCCs

GCCs and product companies pay about 40–60% more than Indian services firms by Salaryinfo's count, while the fresher bands (₹8–10 against ₹4–6) suggest a gap nearer ₹4 LPA. Both come from their hiring for their own security teams and not for client billing.

A GCC is an office that a foreign company runs in India for its own work. Take a bank or a retailer headquartered abroad. It might run its security operations from Bengaluru or Hyderabad. You protect that company's systems directly. At a services firm, the client pays for your hours, and the firm keeps a share as its margin.

SOC means security operations centre. A SOC L1 analyst watches alerts and reads logs, then passes real threats to a senior analyst. Most campus hires at services firms start here.

The gap also grows over time. The Randstad India 2025-26 report, as quoted by Rungta, says a move to a GCC raises pay faster than any other switch. Developers see a similar split between services and product firms, as the full-stack fresher salary breakdown shows.

City matters less than employer, but Bengaluru still leads

Bengaluru pays the most, while Hyderabad and Mumbai follow close behind (Salaryinfo), and tier-2 cities pay 20–30% less for the same role.

Look at the top of each range. The three metros end within ₹1 LPA of each other, at ₹11–12 LPA. These ceilings are outliers, and the ₹10 LPA headline is a typical top. The city spread and the employer gap are not measured the same way, so read the comparison as a rough guide. Hyderabad reaches the same ceiling as Bengaluru. That may fit the employer story. This is my reading, not something the sources state: Hyderabad has grown into a GCC hub, and GCCs may pay the top bands. Note that Hyderabad's range also starts lower, at ₹6 LPA, than Bengaluru's ₹7 LPA. The same pattern shows up for data roles in the Hyderabad data engineer salary post.

Be careful with city tables you find online. Many mix fresher and mid-level pay without saying so. Scaler's Bengaluru row, for example, shows ₹12–22 LPA for mid-level roles, which no fresher should expect. Delhi-NCR and Chennai also hire security analysts. None of these sources gave a separate fresher figure for them, so this post doesn't give one.

OSCP and other proof of skill raise the starting offer

An OSCP (a hands-on penetration testing exam) is the one credential the sources link to fresher offers of ₹10–20 LPA.

OSCP stands for Offensive Security Certified Professional. You break into practice machines during a long, timed exam, then write a report on how you did it. OffSec's PEN-200 course is the official training for the exam, and its course page describes the course and exam in detail.

Why does it move pay? A multiple-choice certificate shows that you read about attacks. OSCP shows that you can carry one out, step by step, under pressure. A hiring manager trusts that more than a list of course names on a resume.

Cheaper steps sit below it. An internship or a junior pentester role already starts you at a higher salary than the basic SOC L1 band, as the employer table above shows. Many freshers take that step first and attempt OSCP later.

Read that top band with care. It describes top firms hiring a small group of strong candidates. Most OSCP holders will land lower, and most freshers do not hold one at all.

The DPDP Act is creating security and compliance jobs

India's data-protection law (the DPDP Act) is now in enforcement, so companies need people who protect personal data and prove they do.

DPDP stands for Digital Personal Data Protection. The law sets rules for how companies collect and store data about people in India, and how they share it. A company that holds customer names, phone numbers or payment details now has to show it guards them.

That pressure feeds a hiring gap. Salaryinfo estimates about 1.5 million cyber security vacancies in India by 2026. Treat that as one site's estimate, not an official count.

These are the entry roles that grow with it:

SOC analyst

Watches for breaches, which the company must now detect and report.

GRC or compliance analyst

GRC means governance, risk and compliance. You check that teams follow the data rules and keep records that prove it.

Data protection analyst

Tracks where personal data lives and who can access it.

This ties back to the pay gap. Firms with large amounts of customer data face the biggest risk under the law. Many of them are the GCCs and product companies already paying the top bands. This section is a career view, not legal advice.

How to aim for the higher band as a fresher

Pick the employer type before you pick the city, and build proof of skill that a hiring manager can check.

1. Learn SOC basics

   Understand how alerts work and practise reading Windows and Linux logs until a strange login stands out to you.

2. Get real practice

   Do an internship, or build a home lab on your laptop with a few virtual machines you attack and defend. Free practice platforms such as TryHackMe and Blue Team Labs give guided exercises, and entry-level certificates such as Security+ or CEH cost less than OSCP.

3. Earn a hands-on certificate

   Aim for one with a practical exam, such as OSCP, once your lab work feels routine.

4. Apply wide

   Sit for campus drives at TCS and Infosys, and also apply directly to GCCs and product firms on their careers pages.

5. Plan the L1 to L2 jump

   Moving from SOC L1 to L2 raises pay by 40–80%, according to the Randstad report quoted by Rungta.

Common mistakes

Judging an offer only by CTC. A large CTC with a heavy variable part can pay less each month than a smaller, mostly fixed offer. Read the breakup line by line.

Ignoring services firms as a first step. A services SOC job gives you real alerts and real tickets in your first year. That experience is what GCCs ask for when you switch. If you want to see how security pay compares with other tech roles over a career, read the highest-paying tech jobs guide.

Your next step: open three current cyber security analyst job posts. Pick one at an IT services firm and two at a GCC or product company. Write the stated skills and pay band for each in a small table. Then find the one skill that appears in all three, and start a free lab for it this week.