Information security analysts own policy, risk assessment, audit evidence and compliance rather than hands-on defence. Demand in India is tied directly to the regulatory environment — the data protection regime, sector regulators and customer security questionnaires all create continuous work. It suits people who combine reasonable technical literacy with strong written communication, and it is one of the few security paths where a non-engineering background is not a serious handicap.