This is a 2026 step-by-step pathway guide for a Cyber Security Analyst migrating to Australia under ANZSCO 262116. 262116 is on MLTSSL and CSOL — the full skilled visa stack: Subclass 189 Independent, Subclass 190 State-Nominated, Subclass 491 Regional Provisional → 191 PR, Subclass 186 Direct Entry, Subclass 494 Regional Employer → 191, and Subclass 482 Core Skills → 186 TRT.
For the cost / timeline view see the 262116 cost & timeline case study. For ACS document details see the skills assessment guide.
Step 1 — Confirm 262116 is the right code
ANZSCO 262116 covers SOC analysis — alert triage, SIEM (Splunk, Microsoft Sentinel, Elastic, QRadar, Devo), threat hunting, EDR (CrowdStrike, SentinelOne, Defender for Endpoint), incident response, malware analysis, log review, and security monitoring. Use ANZSCO search to verify against 261315 Cyber Security Engineer (build / harden), 262112 ICT Security Specialist (broader advisory), 261317 Penetration Tester (offensive), and 262118 Cyber Security Operations Coordinator (SOC management).
The cleanest 262116 fit is SOC analyst (L1/L2/L3) or threat hunter — defensive analyst work. If you spend most of your time engineering detection rules (sigma / KQL / Splunk SPL detections-as-code), 261315 may fit better. If you manage SOC operations and people, 262118.
Step 2 — ACS skills assessment
ACS (acs.org.au) assesses ICT qualifications. Pathways:
- Skills Assessment — Major in ICT — ICT or cybersecurity-aligned bachelor / master + ANZSCO match: 2 years deducted.
- Skills Assessment — Minor in ICT — partial ICT subjects: 4-5 years.
- RPL — non-ICT-aligned candidates with 6+ years experience.
- RPL — Vendor Cert — no degree but cyber certs (CISSP, OSCP, GIAC) + 8+ years.
Reference letters must show detection / monitoring / response work — generic IT support won't pass.
Step 3 — English
EOI lodgement requires Competent English. For points-tested visas, target Proficient (10 pts) or Superior (20 pts).
Step 4 — Choose a visa pathway
Subclass 189 Independent
Best for senior SOC analysts / threat hunters with 8+ years experience. See Subclass 189.
Subclass 190 State-Nominated
+5 points. NSW (Sydney financial / corporate SOCs), VIC (Melbourne corporates), ACT (federal SOCs), and WA (resources sector SOCs) all nominate. See Subclass 190.
Subclass 491 → 191 (regional)
+15 points. Newcastle, Wollongong, Geelong, Adelaide, Hobart, Canberra, Perth — substantial regional SOC demand from MSSPs and state government. See Subclass 491.
Subclass 186 Direct Entry
Major MSSP / SOC operators — CyberCX, Tesserent, Trustwave, Mandiant, NTT, Verizon, Macquarie Telecom, Telstra Purple, Optus Cyber — sponsor experienced analysts. Banks (CBA, Westpac, ANZ, NAB) and major corporates run substantial in-house SOCs. See Subclass 186.
Subclass 482 → 186 TRT / Subclass 494
482 Core Skills for 4 years employer-tied work. 494 for 5-year regional sponsorship → 191. See Subclass 482 and Subclass 494.
Step 5 — Score your points
Use the points calculator. Senior analysts with 5+ years skilled employment, Superior English, and partner skills points routinely reach 90+ points.
Step 6 — Submit EOI / lodge
Lodge an EOI through SkillSelect for 189/190/491. For 186/494/482, the employer's sponsorship + nomination is lodged first.
Useful tools
- Visa fee calculator
- Document checklist — ACS evidence pack
- Eligibility wizard
- Invitation rounds tracker
- State nomination tracker
Authoritative sources
- Home Affairs — visa pricing
- ACS — Australian Computer Society
- ACSC — Australian Cyber Security Centre
- Office of MARA
Next step
Want to map your SOC analyst profile against 189 vs 190 vs 491 vs 186 vs 494 vs 482? Book a 30-minute free strategy call.