16 Cyber Security Resume Examples, SOC Tier 1 to Security Manager
- ATS Friendly
- Security Specific
- 16 Full-Page Examples
A cyber security resume needs four things: a summary that names your track in the first line, an experience section where every alert, finding or control carries its severity and fidelity, a skills block listing only platforms you can discuss under questioning, and certifications placed where a screener sees them. Below are 16 full one-page resumes, one for each job this field actually posts.
540k+ resumes created
Security is not one job, and the resumes do not overlap
A Tier 1 queue seat, a pentest report writer, a cloud engineer and a GRC analyst share a field and almost no keywords. Pick the template built for the posting in front of you and the structure a reviewer in that track expects is already in place, including where the certifications sit.
Cybersecurity Analyst Resume Template
Why this resume example works?
- Names the environment size in the first line, so the scope of the work is settled before the reader reaches a bullet.
- Leads with a tuning result rather than an alert count, which is the difference between working a queue and improving one.
- Counts detection rules written and says each shipped with a test case, which is how a detection engineer reads competence.
- Attaches the fifteen minute severity-one target to the containment number, so the figure has a standard behind it.
- Keeps the help desk job visible, because multi-factor rollouts and imaging are relevant history, not filler.
SOC Analyst Resume Template (Tier 1)
Why this resume example works?
- States the escalation acceptance rate, which is the one number a SOC manager uses to judge a Tier 1 analyst.
- Says which severities and how many tenants, so the queue is described rather than implied.
- Shows a tuning request that came from noticing a rule generating a third of the night queue, which is Tier 2 thinking.
- Counts runbook entries written, because documentation is a real Tier 1 contribution and almost nobody claims it.
- Treats the overnight hotel audit job as evidence of shift tolerance, which is an honest argument for a 24/7 rotation.
SOC Analyst Resume Template (Tier 2)
Why this resume example works?
- Opens on what Tier 2 actually owns: escalations, detection tuning and the hunt backlog, not a bigger alert count.
- Gives a before and after on time to triage and names the playbook work that moved it.
- Turns hunting into a countable result by saying how many hunt findings became permanent detections.
- Claims the quality gate role over Tier 1 escalations, which is how a lead reads promotion readiness.
- Shows the Tier 1 history at the same employer, so the progression is visible without a line of narration.
Penetration Tester Resume Template
Why this resume example works?
- States engagement volume and the scope split across web, internal network and cloud, which is what a practice lead screens on.
- Counts critical findings and names one concretely, so severity is demonstrated instead of asserted.
- Describes reaching domain admin through misconfiguration chaining, which reads as methodology rather than tool output.
- Includes the retest rate, the part of the job that separates a report writer from someone who closes risk.
- Mentions client debriefs and fix ordering, because translating CVSS into a work queue is half the deliverable.
Security Engineer Resume Template
Why this resume example works?
- Frames the work as building, not watching: log source normalization, pipeline latency, policy as code.
- Says detections are version controlled with unit tests, which is the clearest signal of engineering discipline on the page.
- Gives a latency number for alert delivery, a metric analysts feel and almost no resume thinks to claim.
- Shows endpoint agent coverage as a percentage of a known estate, which is a deployment result rather than a task.
- Keeps the systems engineering history, because patch latency and VPN migration work explains how the engineering instinct formed.
Incident Response Analyst Resume Template
Why this resume example works?
- Counts engagements a year and names the sectors, which tells a reader what kind of incidents this person has actually seen.
- Attaches a containment time to a specific standardization, so the improvement has a named cause.
- Lists the artifacts examined by name, which is how a forensics lead checks whether the experience is real.
- Claims the evidence handling checklist and notes it survived legal proceedings, the strongest possible proof of rigor.
- Separates executive briefing from technical findings, which is a skill most responders discover the hard way.
GRC Analyst Resume Template
Why this resume example works?
- Leads with a completed SOC 2 Type II and the control count owned, which is the GRC equivalent of a shipped product.
- Shows control mapping reuse across two frameworks, the work that separates a GRC analyst from an evidence collector.
- Gives the audit preparation time before and after, so continuous compliance is a result rather than a tool name.
- Counts vendor assessments and says how many were blocked, which proves third-party risk review had teeth.
- Keeps the internal audit history visible, because control testing experience is why the evidence work holds up.
Cloud Security Engineer Resume Template
Why this resume example works?
- Pairs every remediation number with the guardrail that stopped the pattern recurring, which is the whole job in one shape.
- Quantifies permission removal rather than claiming least privilege, a phrase every cloud resume uses and none evidences.
- Says policy fails at deploy instead of in an audit report, which tells a reader where the control actually sits.
- Names the cloud attack techniques detected, so runtime work is specific rather than a product name.
- Shows the DevOps and sysadmin history, because credibility with platform teams is what makes guardrails land.
Application Security Engineer Resume Template
Why this resume example works?
- Measures time to fix rather than findings raised, which is the only application security number that means anything.
- Says the fix ships in the pull request, the practice that actually moves that number.
- Names a false positive threshold for static analysis and ties it to developer trust, which is honest and rare.
- Counts threat modeling sessions by team, so the coverage of the program is visible.
- Keeps the software engineering history, because the reason developers accept the review is on that part of the page.
Entry-Level Cyber Security Resume Template
Why this resume example works?
- Puts skills above experience, which is correct here and only here: there is no paid technical job title to lead with.
- Counts the lab honestly: hosts, log sources, detection rules, ATT&CK mappings, tests replayed. No invented business outcome.
- Says the target role outright, so a screener does not have to guess which queue this application belongs in.
- Keeps the retail job and counts what it measured, because a clean attendance record is a real argument for shift work.
- Lists one competition placement instead of a page of course names, which carries more weight and less noise.
Cyber Security Resume Template for a Career Change
Why this resume example works?
- Leads with experience, not skills, because six years of support work is the argument and burying it would weaken it.
- Picks out the security-adjacent parts of the support job: phishing triage, lockouts, the multi-factor rollout.
- Counts confirmed malicious messages escalated, which is Tier 1 work already being done under a different job title.
- Names the target seat in the summary, so nobody has to work out why a support resume is in the security pile.
- Treats the home lab as supporting evidence at the bottom, not as the headline it cannot carry.
Cyber Security Resume Template for a Certification Track
Why this resume example works?
- Writes the certification in progress with a booked exam month, which is precise rather than aspirational.
- Puts the study behind four years of real analyst work, so the acronym reads as a next step and not a substitute.
- Shows ownership of a recurring report, which is the kind of accountability a senior analyst posting looks for.
- Counts cases closed with written findings, because documentation quality is what gets an analyst promoted.
- Says what the next role should include, which keeps the application focused instead of open to anything.
Senior Cyber Security Analyst Resume Template
Why this resume example works?
- Opens with scope and sector, because at eight years the environment matters more than the task list.
- Credits a containment improvement to a policy change, which is how senior work differs from faster clicking.
- Names the medical device problem, a specific constraint that proves the experience is in this environment and not generic.
- Shows retiring 40 detections that never produced a true positive, which takes more judgment than adding rules.
- Counts analysts mentored to certification, the clearest available evidence of readiness for a lead role.
Security Operations Manager Resume Template
Why this resume example works?
- States team size and shift structure first, which is the scope question every hiring panel asks within two minutes.
- Solves the alert problem by retiring rules rather than requesting headcount, and says so plainly.
- Reports retention on the analysts hired, the number that separates a manager from a recruiter.
- Shows executive reporting in four actionable measures, not a dashboard screenshot described in words.
- Keeps the Tier 2 and lead history, because a SOC manager who never worked the queue is not credible to the team.
Threat Intelligence Analyst Resume Template
Why this resume example works?
- Measures intelligence by detections deployed, which answers the question every intelligence team gets asked about value.
- Tracks clusters relevant to the sector rather than counting feeds, so relevance is the stated unit of work.
- Mentions finding existing telemetry for most techniques in a campaign, an honest result that beats a scary advisory.
- Includes the intelligence requirements exercise, the thing that stops a team producing reporting nobody reads.
- Shows SOC analyst origins, because intelligence written by someone who never worked a queue tends not to be usable.
Vulnerability Management Analyst Resume Template
Why this resume example works?
- Measures the program on remediation inside the policy window, not on scans run or findings discovered.
- Credits the improvement to routing findings to the owning team, which is the actual mechanism behind every closure rate.
- Says authenticated scanning revealed findings credential-free scans missed, which shows the coverage problem is understood.
- Replaces raw severity ranking with exploit availability and exposure, a defensible prioritization most resumes never mention.
- Keeps the desktop support history short, because the current work carries the application on its own.
Build your cyber security resume
Open the example closest to the posting you are answering, swap its severity bands, findings and platform names for your own, and the editor keeps the one-page layout an applicant tracking system can parse.
Build my resumeHow to write a cyber security resume
The hard part is not formatting. It is deciding which numbers you can defend in a technical screen, and then writing the resume so a reviewer in your track recognizes them.
Pick a track before you write a word
A SOC seat, a pentest role, a cloud engineering job and a GRC opening screen on different evidence and share almost no keywords. One resume aimed at all four reads as none of them.
What the track decides:
- The headline: a reviewer should place you in five words as defensive, offensive, engineering or compliance.
- The numbers you lead with: escalation accuracy for SOC, critical findings and retest rate for pentest, closure rate inside the window for vulnerability management, controls and audit outcome for GRC.
- The tools worth naming: Splunk and CrowdStrike for a SOC posting, Burp Suite and Metasploit for an offensive one, Terraform and Wiz for cloud.
- Which experience leads and which gets one line. A cloud engineer's sysadmin years are context. A GRC analyst's audit years are the foundation.
- If you genuinely target two tracks, keep two resumes. It is faster than writing one that convinces nobody.
Give every number its severity, fidelity or target
Alerts triaged monthly is the most common bullet in this field and it settles nothing. Two hundred hits on one noisy rule is a tuning backlog; two hundred investigations across four severities is a workload.
What turns a volume into evidence:
- The severity band you worked, and across how many tenants or business units.
- Your escalation acceptance rate, which is the number a SOC lead already has for every analyst.
- False positive rate before and after a tuning pass, with the rule set you touched.
- Time to triage or time to contain against the queue's own target, not against an industry average.
- For findings work, remediation inside the policy window, and whether the scan was authenticated.
A home lab is evidence. It has no business metrics
Published advice tells candidates with no security job title to quantify their lab, and the samples that follow claim detection times cut by a percentage. Nothing was detected and nobody was protected, so a screener reads an invented number and stops reading.
What a lab can honestly claim:
- The stack and the log sources: Wazuh, Security Onion or a free SIEM tier, with Sysmon, DNS and firewall telemetry from a named number of hosts.
- Detection rules written, and which MITRE ATT&CK techniques they cover.
- Attacks replayed against those rules, using something like Atomic Red Team, and what came back.
- What you tuned after a rule fired on normal activity, which is the most convincing sentence an entry-level resume can carry.
- Practice platforms and CTF placements, counted plainly. Write up two investigations properly rather than listing fifty rooms.
Put experience first, unless you have no paid technical job at all
Skills-first ordering is standard advice for career starters and wrong for most people who use it. If you have worked a help desk, a NOC or any technical seat, that record is the argument and it belongs at the top.
Use skills-first order only when all of these are true:
- No paid job has given you technical responsibility, not even first-line support.
- Your strongest evidence is a lab, coursework or a certification rather than a workplace.
- Your work history is unrelated enough that a reviewer would stop at the first job title.
- One example on this page is built that way. The career changer on it is not, on purpose: six years of support work beats any skills block.
Place certifications where they are read, and stop stacking them
Certifications matter in this field and they are not seniority. A header carrying five acronyms over no documented investigation reads as a studier, which is the one impression a technical screen will confirm.
How to handle them:
- Put them near the top when the certification is the qualifying credential for the posting, which is common for entry-level and for cleared roles.
- Name the issuer, the year, and nothing else. CompTIA, ISC2, GIAC, Offensive Security, EC-Council, ISACA and the cloud providers are all recognized without explanation.
- Write one in progress precisely: the exam month you have booked, not studying toward. ISC2's CISSP also carries a five-year experience requirement across two or more of its domains, with an associate route for people who pass the exam first, so say which one applies to you.
- List only what you can be questioned on. The fastest way to fail a screen is an acronym you cannot discuss.
- Skip expired certifications unless the posting asks for the knowledge, in which case date it honestly.
Write a summary of three to four sentences and keep it to one page
Fifty to seventy words, opening with your track and the scope you cover rather than a word like passionate. Every example here does that, and every one of them fits on a single page, including a manager running a 14-analyst SOC.
Cybersecurity analyst covering a 1,900-endpoint environment for a regional insurance carrier, working Microsoft Sentinel detections and Defender for Endpoint containment. Cut repeat false positives on the ten noisiest rules by 61 percent across two quarters of tuning. Holds Security+ and CySA+, and writes detection logic mapped to MITRE ATT&CK with a documented test for each rule.
What a security summary has to carry:
- The track and the environment size, stated as endpoints, accounts, tenants, assets or engagements.
- The one number you would most want asked about in an interview.
- The platforms a posting in your track would name, and the certification that qualifies you for it.
- What you are targeting next, in six words, if the track you want differs from the one you are in.
Name the frameworks the posting runs on
Security job descriptions are written out of control frameworks, and matching their phrasing is the whole of defensible keyword work. Copy the posting's wording where it is true of you, and leave the rest off.
Which ones belong where:
- Detection and response work: MITRE ATT&CK by technique, the NIST Cybersecurity Framework, and NIST incident handling guidance.
- Compliance and GRC: SOC 2, ISO/IEC 27001, NIST SP 800-53 and the Risk Management Framework, PCI DSS, HIPAA, FedRAMP.
- Offensive work: the OWASP Top 10, the OWASP Testing Guide, PTES, and CVSS for scoring.
- Hardening and baselines: CIS Controls and the CIS Benchmarks for the platforms you actually touched.
- Never claim a framework you have only read about. Naming ISO 27001 invites a question about Annex A.
Common cyber security resume mistakes
- An invented lab metric. Detection time reduced by a percentage, in a home environment where no real attack ever happened, is the single clearest tell that a resume is padded. Count the hosts, the log sources, the rules and the techniques covered instead. Those are true and they are more convincing.
- Alert counts with no severity or fidelity. Triaged 200 alerts a month describes a dashboard, not a person. Say which severities, across how many tenants, at what escalation acceptance rate, and against which triage target. A SOC lead has all four numbers for every analyst already.
- Tools you cannot discuss. A skills block listing fourteen platforms will produce a question about the one you touched once. Keep the list to what you can be interviewed on, and put the depth in a bullet where you say what you did with it.
- Certifications stacked where accomplishments should be. Five acronyms in the header over an experience section with no documented investigation reads as study rather than practice. One certification plus one case you can walk through beats the stack every time.
- One resume for every track. SOC, pentest, cloud and GRC postings screen on different evidence and share almost no keywords, so a single general security resume ranks last in four piles instead of first in one. Pick the track, then rewrite the summary and the skills block for it.
Frequently asked questions
What should a cyber security resume include?
A cyber security resume needs a three-to-four-sentence summary that names your track and the size of the environment you cover, an experience section where every alert, finding or control carries its severity and fidelity, a skills block listing only platforms you can discuss under questioning, education, and a certifications block placed where a screener will see it. The numbers most security resumes are missing are the ones a hiring manager already has on a dashboard: escalation acceptance rate, false positive rate before and after tuning, time to triage against the queue target, critical findings and retest results, remediation inside the policy window. If you have no security job title yet, a projects section covering a home lab belongs above work history. One page is enough at every level, including a manager running a 14-analyst SOC.
How do you write a cybersecurity resume with no experience?
Lead with skills and projects instead of work history, which is the one case where that order is correct, and count your lab honestly. Say how many hosts it runs, which log sources ship into it, how many detection rules you wrote, which MITRE ATT&CK techniques they cover, and what came back when you replayed tests against them. Do not claim a business outcome, because a personal environment has none and an invented percentage is the fastest way to lose a screener. Then count what your current job genuinely measures, whether that is transactions, tickets or attendance, and name the target role outright so nobody has to guess which queue your application belongs in. Two examples on this page are built exactly this way.
Where do certifications go on a cyber security resume?
Near the top when the certification is what qualifies you for the posting, which is usual for entry-level roles and for anything requiring a specific credential, and in a clearly labeled block lower down once you have several years of documented work. Name the issuer and the year and nothing else: CompTIA, ISC2, GIAC, Offensive Security, EC-Council, ISACA and the cloud providers are all recognized without explanation. Write one in progress precisely, with the exam month you have booked rather than a vague studying toward. Note that ISC2's CISSP carries a five-year paid experience requirement across two or more of its domains, with an associate route for candidates who pass the exam before meeting it, so state which applies to you. List only certifications you can be questioned on.
How do you put a home lab or CTF results on a resume?
As a dated projects entry in the experience section, written exactly like a job, with bullets that count real things. Name the stack and the telemetry, for example Wazuh and Suricata ingesting Sysmon, DNS and firewall logs from eight hosts. Say how many detection rules you wrote and which ATT&CK techniques they map to. Say what you replayed against them, such as Atomic Red Team tests, and what the rules caught or missed. The most convincing single line an entry-level resume can carry is what you tuned after a rule fired on normal activity. For CTF work, give placements and the number of machines or rooms solved, then write up two investigations properly rather than listing fifty. Never attach a business metric to any of it.
What skills and keywords belong on a cybersecurity resume?
The ones in the posting that are also true of you, grouped by what they do. For detection work that means SIEM and endpoint platforms by name, such as Splunk, Microsoft Sentinel, QRadar, Elastic, CrowdStrike Falcon, SentinelOne or Defender for Endpoint, plus the telemetry you actually query. For offensive roles it means Burp Suite, Metasploit, Nmap, Wireshark, BloodHound and the vulnerability scanners. For cloud it means AWS, Azure, Kubernetes, Terraform and a posture tool. Frameworks carry real keyword weight: MITRE ATT&CK, the NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, ISO/IEC 27001, SOC 2, PCI DSS, the OWASP Top 10 and CVSS. Keep the list to what you can be interviewed on, because a fourteen-tool skills block invites a question about the one you touched once.
How long should a cyber security resume be?
One page, at every level on this site's standard. Every example here is a single page, including a penetration tester delivering around 30 engagements a year and a security operations manager running a 14-analyst SOC across three shifts. Security applications usually pass through an applicant tracking system before a person opens them, so a clean one-page layout with standard headings parses more reliably than a two-column design built around a graphic. If you are running out of room, cut detail from your oldest roles rather than dropping the environment size and severity context from the recent ones, because that context is what makes your numbers mean anything. Federal and cleared roles are the one exception, since those applications often ask for a longer format outright.
More cyber security resume resources
Build your cyber security resume
Open the example closest to the posting you are answering, swap its severity bands, findings and platform names for your own, and the editor keeps the one-page layout an applicant tracking system can parse.