Cybersecurity Resume Guide: Examples, Skills, and Certifications by Role

"Cybersecurity" covers very different jobs. A SOC analyst triages alerts all day. A GRC analyst maps controls to frameworks and talks to auditors. A pen tester tries to break in. One resume that tries to cover all of them usually reads as unfocused.

Choose the one or two roles you are applying for, then build your summary, skills, and bullets around them. Keep a master version with everything, and trim it for each posting.

Read each job posting carefully. Titles vary a lot between employers, and a "security analyst" at one company might do SOC work while at another it means GRC. Paste the posting into the job description analyzer to see which skills and tools it really stresses.

Use a clean, single-column layout with standard headings. Security hiring often goes through an applicant tracking system first, and simple layouts are easier for that software to read.

1. Header: name, city and state or region, email, phone, LinkedIn, and a GitHub or blog link if it shows security work.
2. Summary: two to three lines with your target role, years of experience (or training), and key tools.
3. Skills: grouped by type (see below).
4. Certifications: near the top if they are a main selling point, especially for entry-level roles.
5. Experience: reverse order, with three to six bullets for recent jobs.
6. Projects, labs, and CTFs: essential if you are entry level or changing careers.
7. Education.

Most early-career security resumes fit on one page; experienced engineers and managers often need two. For general layout rules, see how to format a resume.

Group your skills so a reader can scan them in seconds. List only what you can discuss and demonstrate. Security interviews often include technical questions on anything you list.

Write tool and framework names exactly as the posting does. If it says "MITRE ATT&CK", do not shorten it to "ATT&CK" only. For more on matching posting language, see resume keywords.

Soft skills that matter in security

Clear writing, calm escalation, and explaining risk to non-technical people are real security skills. Show them in bullets ("Wrote incident summaries for leadership") rather than listing "communication" on its own.

Certifications are common screening filters in security, especially for entry-level and government-related roles. List each one with the full name, the issuing body, and the year earned. Add "in progress" with an expected date only if you are actively studying and booked for the exam. See how to list certifications on a resume for formatting details.

Requirements, names, and exam codes change over time. Check the issuer's website for current rules before you list a certification or plan your next one. Never list a certification you have not earned, and do not write "CISSP" if you are an Associate of ISC2; use the correct designation.

If you have no security job yet, projects are your experience section. Treat them like jobs: give each a name, the tools used, and two or three bullets with what you did and what you learned or found.

Strong project ideas

• Homelab: a small network with a firewall, a few virtual machines, and a SIEM collecting logs. Write detection rules and test them against simulated attacks.
• CTF competitions: list the event, your team or solo placement if it is notable, and the categories you solved (web, forensics, crypto).
• Training platforms: rooms or labs completed on platforms such as TryHackMe or Hack The Box, ideally with a write-up linked from your GitHub or blog.
• Detection or automation scripts: a Python script that parses logs, enriches IP addresses, or automates a triage step.
• Policy or risk project (for GRC): a sample risk assessment or a control mapping to NIST CSF for a fictional small business.
• Volunteering: helping a nonprofit or school set up MFA, backups, or basic security awareness training.

Only test systems you own or have written permission to test. If you are a student, our computer science resume guide shows how to present coursework and projects together.

Show your transferable experience

Help desk, system administration, networking, and development jobs all build security skills. Highlight the security parts: password resets and account lockouts (identity), patching (vulnerability management), phishing reports (incident triage), and firewall changes (network security).

The numbers below are examples to show the shape of a strong bullet. Use your own real figures, or replace a number with a clear fact if you do not have one.

Entry-level and career changer bullets

• Built a homelab with pfSense, Windows Server, and two Linux VMs, forwarding logs to Splunk and writing 10 detection searches for brute-force and suspicious PowerShell activity.
• Completed 60+ hands-on labs on blue-team topics, including log analysis, phishing investigation, and memory forensics, with public write-ups on GitHub.
• Placed in the top 15% of teams in a university CTF, solving web and forensics challenges.
• Resolved about 35 help desk tickets a day, including account lockouts and MFA issues, and escalated suspicious login reports to the security team.
• Wrote a Python script that checked IP addresses from firewall logs against a threat intel feed, saving manual lookup time during triage practice.

Security analyst resume and SOC bullets

• Triaged an average of 80 SIEM alerts per shift in Microsoft Sentinel, escalating confirmed incidents using the team's playbooks.
• Tuned noisy detection rules with the engineering team, cutting false positives on the top five alert types.
• Investigated phishing reports from staff, extracted indicators, and blocked malicious domains at the email gateway.
• Mapped recurring alert types to MITRE ATT&CK techniques to show coverage gaps in a quarterly report.

Experienced engineer, pen test, GRC, and cloud bullets

• Rolled out EDR to about 2,000 endpoints in phases, writing exclusion rules with IT to avoid disrupting core apps.
• Led scoped web application tests for internal apps, reporting findings with severity ratings and fixes, and retesting after remediation.
• Managed evidence collection for a SOC 2 Type II audit across 40 controls, finishing with no major findings (example outcome).
• Wrote Terraform guardrails that blocked public storage buckets in AWS accounts, and set up alerts for IAM policy changes.
• Built a SOAR playbook that enriched and auto-closed known-benign alerts, freeing analyst time for real investigations.

For more on turning tasks into results, see our guide to resume bullet points.

Keep the summary short and specific. Name the role, your level, your tools, and one proof point.

Entry level

Entry-level SOC analyst with CompTIA Security+ and two years of IT help desk experience. Built a home SIEM lab in Splunk and practice log analysis and phishing triage weekly. Looking to bring calm, documented incident handling to a Tier 1 SOC team.

Experienced

Security engineer with six years in detection and response for mid-size cloud environments. Deploys and tunes SIEM and EDR tools, writes detections mapped to MITRE ATT&CK, and automates triage with Python and SOAR. CISSP and AWS security certified.

See more patterns in our resume summary examples.

Some US government and defense contractor roles require a security clearance. If you hold one and the role calls for it, it is common to list the clearance level and status near the top of your resume, such as in the header or summary.

• State the level and whether it is active, for example "Active Secret clearance". If it has lapsed, you might write "Previously held" with the level.
• Do not include investigation details, case numbers, or classified information.
• Never claim a clearance you do not hold. Clearance status can be verified by employers.
• In general, individuals cannot apply for a clearance on their own; it is sponsored by an employer or agency for a specific role.

Rules and best practices vary, so follow guidance from the employer or your facility security officer if you have one.

Security work often involves confidential systems, clients, and incidents. You can show your impact without breaking an NDA or creating risk for a past employer.

• Describe clients by industry and size, not by name, unless you have permission.
• Leave out IP addresses, hostnames, internal tool names, and specific unfixed weaknesses.
• Use percentages or ranges instead of exact internal counts if those are sensitive.
• Do not link to write-ups of real client engagements.
• When in doubt, check your employment agreement or ask your former employer.

• Listing every tool you have heard of. A long, unproven list invites tough interview questions. Keep what you have used.
• Buzzwords without proof. "Zero trust", "threat intelligence", and "defense in depth" need a bullet that shows what you did.
• One resume for every security role. SOC, GRC, and pen test resumes should look different.
• Hiding certifications at the bottom. If they are a key requirement, put them near the top.
• Oversharing confidential details. This can make a security hiring manager worry about your judgment.
• Using a heavy, graphic layout. Skill bars and icons do not help and may confuse resume software.

Test before you apply

Run your draft through the ATS checker with the job posting to see keyword gaps and formatting issues, then add missing terms only where they truly describe your experience. When you are ready to put it together, the resume builder gives you an ATS-friendly layout and exports a clean PDF.