Skills that make the work valuable
- Security log analysis
- Alert triage
- Access review
- Incident evidence documentation
Build proof, not just a list
Analyze synthetic authentication logs to identify suspicious patterns, document competing explanations, and propose triage steps. Include a clear evidence timeline, false-positive checks, and a practical recommendation for improving access controls.
How to price this work as a freelancer
Define the systems, log sources, review period, and reporting expectations for an assessment. Separate scheduled analysis from monitoring and incident response coverage. Tool licenses, data retention, evidence handling, and urgent escalations can change costs substantially; specify how findings are handed to the person authorized to act.
Start with the income you need to replace
Required hourly rate = (target salary + benefits budget + annual business expenses) ÷ (annual billable hours × share of revenue retained after fees).
For illustration, $100/hour × 25 billable hours/week × 48 working weeks = $120,000 revenue. After $20,000 in business expenses, that leaves $100,000 profit before personal taxes. Replacing a $100,000 salary plus $15,000 in benefits under those assumptions takes $112.50/hour, with no percentage fees.
These are editable planning assumptions, not rates surveyed for cybersecurity analyst work. Your personal taxes, location, contract terms, and workload still affect the comparison.
Employee or freelancer?
Working as an employee
Employment can provide threat context, established response procedures, and peers for reviewing difficult alerts. Shift patterns and incident responsibilities vary, so understand coverage expectations and the authority attached to the role.
Running a freelance business
A security review can be packaged around clear systems and deliverables. Access to sensitive logs, reporting obligations, and escalation ownership require explicit agreements, and assessment work does not automatically include continuous monitoring.
Where this career could take you
- 01Junior Security Analyst
- 02Cybersecurity Analyst
- 03Security Operations Lead
An example path, with room for lateral moves or specialization. Progression depends on opportunities and demonstrated work; these steps do not imply a timetable or salary increase.
Try one small next step
Create synthetic login records and investigate an unusual access pattern. Write a short triage note with evidence, uncertainty, and the additional information needed before taking action.