How To Become a Cryptanalyst

Cryptology is the study and art of writing and solving codes. In today's digital world, cryptology is an essential component of cyber security—encrypting sensitive information can help protect it against various cyber attacks. However, those same methods can be used by cyber criminals to commit cyber crime, which is where cryptanalysts come in.

Cryptanalysts decipher or "break" codes to unearth the information they are meant to obscure. Because of this, cryptanalysts are often employed by law enforcement, the military and other government entities to break codes that were made by cyber criminals, meaning their role in the cyber security ecosystem is essential for keeping precious data safe.

What is a cryptanalyst?

Cryptology is the study of codes, while cryptography is the art of writing and solving them. This means these two terms are nearly identical and may be used interchangeably in some contexts.

The people who encode information through encryption, ciphers algorithms and more are called cryptographers. In other words, they create the codes. Those that decipher or break the codes are called cryptanalysts. Many cyber security professionals that are well versed in cryptology do both, while others may choose to specialize in one or the other.

"Cryptanalysis is the discipline more commonly known as codebreaking. Foreign countries and terrorists use cryptography to encrypt their communications and to control access to their computer networks," said a spokesperson for the National Security Agency (NSA). "Cryptanalysts at NSA find ways to get around those protections so that the United States has the information it needs for national security."

What does a cryptanalyst do?

A cryptanalyst's job may vary a bit depending on who they work for and the cryptologic goals of their employer. It's quite common for cryptanalyst positions to include cryptography as part of their job duties (making codes) instead of just working on cryptanalysis (breaking codes) since they are in many ways two sides of the same coin.

With that in mind, a cryptanalyst's job duties typically include the following:

Many other high-level IT and/or cyber security positions may also include cryptanalysis or cryptography as a component of that job, such as security managers or security architects.

 "Codebreaking is almost never straightforward, and cryptanalysts have to think creatively and consider a wide range of approaches," the NSA spokesperson said. Those approaches include:

• "Finding mathematical weaknesses in an encryption algorithm." 
• "Discovering that a programmer who wrote encryption-code made a mistake." 
• "Collaborating with partners throughout the United States Government, and more."

"This work generally appeals to people who love to solve puzzles; in this case, the answers to the puzzles are vital to national security," the spokesperson said.

Ethical considerations in cryptanalysis and cryptography

Breaking a code meant to protect certain information, just as one might pick a lock on a safe, raises certain ethical questions about the balance between privacy and protection. Encryption can be used for good to protect personal information, but the inverse is also true: it can be used by criminals and perhaps hinder law enforcement efforts. Some people, therefore, see this sacrifice of overall security to be too great, while others may argue that it's worth it to uphold our individual right to privacy. 

Encryption can be used for good to protect personal information, but the inverse is also true: it can be used by criminals and perhaps hinder law enforcement efforts.

The moral and ethical implications in the field of cryptography don't end there, however. Phil Rogaway, an esteemed cryptographer and professor at the University of California, Davis, discussed this topic in great detail as the 2015 International Association for Cryptologic Research (IACR) Distinguished Lecturer.

In the abstract of his paper which the lecture was based on, he wrote, "Cryptography rearranges power: it configures who can do what, from what. This makes cryptography an inherently political tool, and it confers on the field an intrinsically moral dimension… I call for a community-wide effort to develop more effective means to resist mass surveillance. I plead for a reinvention of our disciplinary culture to attend not only to puzzles and math, but, also, to the societal implications of our work."

How to become a cryptanalyst

There's no singular path that leads to a career as a cryptanalyst. To become a cryptanalyst, you'll need a combination of relevant cyber security education and training which can be supplemented with various credentials and certifications.

Educational requirements

You'd be hard-pressed to find someone who learned cryptanalysis on their own, which is why education is so vital to building a foundation for a cryptanalysis career. Most cryptanalysts need at least a bachelor's degree in mathematics, computer science, or a closely related field such as cyber security, information technology or computer engineering. Some schools offer cryptography as a specialization or concentration within another major, such as a mathematics degree with a cryptography focus, but it is not an undergraduate major on its own.

"A degree in mathematics, engineering, computer science, data science, statistics or a related field is required for most cryptanalysis positions. Related fields may be considered relevant if the programs contain specific coursework," the NSA spokesperson said.

A job in cryptanalysis isn't usually an entry-level position, so you may need an advanced degree to land a cryptanalyst job or progress in the field. A cyber security related graduate degree has the added bonus of allowing students to specialize more, and it's at this level that you can find graduate cryptography programs such as a master's degree in cryptography. A master's degree in computer science or any of the subjects mentioned above can also benefit cryptanalysts.

If you wish to take your education to the very top—and if you want to truly be a master in your field—a doctoral degree in cryptography or computer science may be a good choice. This education level may even be necessary to access some of the most advanced positions, especially within government entities such as the NSA. 

Bootcamps for aspiring cryptanalysts

Cyber security bootcamps are becoming an increasingly popular way for people to learn the knowledge and skills necessary to gain entry-level access to the field of cyber security. Most bootcamps are offered by academic providers (colleges and universities) or independent providers (skills academies and training companies). They typically take anywhere from three to nine months to complete, though some are shorter or longer. 

Cryptography and cryptanalysis themselves are not really offered as the sole subject of a bootcamp, but most beginner-friendly cyber security bootcamps include coursework in both. This can still be an excellent way to break into the field.

Benefits of attending a bootcamp

Bootcamps provide a different learning experience compared to traditional degree programs. These differences come with their own unique benefits worth considering for anyone interested in a cyber security career:

• Shorter times to complete means they typically cost less and can get you into the workforce sooner
• Full-time and part-time options allow the flexibility to work with your schedule
• Fully online, hybrid or in-person learning formats mean there's a program to meet any learning style
• With a curriculum concentrated solely on cyber security, you'll gain exactly the knowledge and skills you need to succeed

Popular cryptanalysis bootcamps to consider

Here is a sample of some popular bootcamps you may consider to help prepare you for a cryptanalysis career:

Skills for cryptanalysts

Cryptanalysis requires a fair amount of technical, "hard" knowledge, but as with practically any job, technical skills may only get you so far. If you want to work in cryptanalysis, consider these skills which you may need to master to be successful:

The spokesperson for the NSA also listed the following as important skills for cryptanalysts:

• "An aptitude for and an interest in solving challenging problems."
• "An interest in using programming and other computational tools to solve real-world problems – there is not a requirement for any particular programming background, but applicants need to be comfortable with the idea of learning and using computational tools."
• "A willingness to grow and apply technical communication skills, documenting and presenting progress and results."
• "The ability and willingness to work as part of a team to tackle challenging problems."

Career paths and job outlook

Cryptanalysts, like many other cyber security roles, typically have the option to work in one of two settings: in the public sector for government agencies or in the private sector for private companies and businesses.

Public sector government agencies include local law enforcement and state or federal agencies such as the NSA. In these roles, a cryptanalyst is usually focused on protecting the digital integrity of highly sensitive government information, from military intelligence to personally identifiable information (PII). Most cryptanalysis jobs are found in the public sector.

"The NSA's current cryptanalysis population works in a number of different organizations and across the extended enterprise (including Texas, Georgia, Hawaii and Colorado). The majority of the Agency's cryptanalysts are in The Cryptanalysis and Signals Analysis organization, which is responsible for delivering cryptanalytic and signals analytic results that yield the highest impact and security outcomes for NSA and the Nation," the NSA spokesperson said.

Cryptanalysts may work for private companies, however, or contract their services to a combination of the two. When working for a private company, a cryptanalyst is focused on decrypting and addressing cyber security attacks or threats to that particular company. Since their job scope is focused solely on that company, it's more likely that their job duties include cryptography and other cyber security tasks as well.

Cryptanalyst salary and job outlook

While the U.S. Bureau of Labor Statistics (BLS) does not track data for cryptanalysts specifically, it does report salary and job growth projection data for information security analysts. This position can encompass many different cyber security-related roles, including cryptographers and cryptanalysis. Read our guide to cyber security salaries to get an idea of the various industry roles and their associated wages.

According to the 2023 Occupational Employment and Wage Statistics from the BLS, the median annual salary for information security analysts is $120,360, with the top 10% earning upwards of $182,370. The bottom 10% earn $69,210, which is still higher than the annual mean wage across all occupations. The metropolitan areas of Washington D.C., San Jose, San Francisco and New York have some of the highest wages and employment numbers of this profession.

The BLS estimates that the employment of information security analysts will grow a staggering 31.5% through 2032

The BLS estimates that the employment of information security analysts will grow a staggering 31.5% through 2032, much faster than the average across all occupations. Unsurprisingly, they attribute this demand to the need for cyber security professionals to address increasing cyber security attacks and the need to secure new technologies from external threats.

Cryptanalysis techniques and tools

Cryptanalysts utilize numerous techniques to break codes and decrypt information. In other words, the goal is to unearth the plaintext that is being hidden or coded. The plaintext can be words written in English or another language or in a programming language such as Java. Here are a few examples of some of those techniques:

Cryptanalysis certifications

Certifications are an essential component of IT, cyber security and related fields. Certifications validate an individual's skills and competencies, which is why so many IT and cyber security roles prefer or require candidates to possess certain certifications. They may also lead to better jobs and higher salaries. Here are a few information security certifications that any cryptanalyst may consider pursuing:

• Certified Encryption Specialist (CES) from EC-Council
• Certified Information Systems Security Professional (CISSP) from (IC2)²
• Security+ from CompTIA
• Certified Ethical Hacker (CEH) from EC-Council

In addition to certifications themselves, there are a few organizations and associations that emerging or current cryptanalysts should be aware of. Organizations may offer relevant certifications, member benefits, continuing education programs and more. Joining a professional association­, if they offer membership, is also a great way to stay up to date on industry developments and trends. Check out the following organizations to see how they may be able to help your cryptanalyst career: 

Are you ready for a career in cryptanalysis?

Cryptanalysis and cryptography are just two branches of the ever-expanding field of cyber security. As technology itself continues to evolve, as do the ways cyber criminals can commit crime, the need for competent cyber security professionals like cryptanalysts has seldom been greater.

A bachelor's degree in cyber security or mathematics is a good place to start, and there are other training programs out there to supplement a formal education, such as bootcamps, certifications or development programs from the NSA. If you aren't sure where to start, consider using our search feature to find relevant training programs for a cyber security career to last a lifetime.

Updated: October 25, 2023