Cybersecurity Analyst resume example
Also indexed as: security analyst · SOC analyst · information security analyst
Security hiring is unusually credential-driven, and unusually tired of resumes that list tools and frameworks without evidence of judgement. Splunk, CrowdStrike, Nessus, NIST, MITRE are all necessary keywords, but a reviewer wants to know what you detected that would otherwise have been missed, and what you did in the first hour.
Numbers exist here even though people rarely use them: alerts triaged, false-positive rate reduced, mean time to detect and respond, phishing click-through after training, findings remediated against a total. Use them, and be careful about what you can disclose. Describe the shape of an incident, not the customer.
A complete document in the Meridian family of layouts, rendered live, not a screenshot.
The screen
What a cybersecurity analyst resume is actually judged on
Detections you authored
Rules or queries you wrote, mapped to MITRE technique, and what they caught. This is the clearest analyst-versus-alert-clicker signal.
MTTD and MTTR
Detection and response times, with the change you made to move them.
Real incident involvement
Your role in a genuine incident (containment, forensics, comms), described without breaching confidentiality.
Certifications, plainly listed
Security+, CySA+, GCIH, OSCP, CISSP. Many enterprise filters are literal about these.
Bullets
5 bullets that would survive the screen
Copy the shape, not the words. Each one leads with the result, then names the mechanism, and carries the vocabulary of the field without listing it.
Wrote 40 Sigma detections mapped to MITRE ATT&CK, including the one that caught credential dumping on a domain controller inside four minutes.
Cut mean time to detect from 26 hours to 40 minutes by rebuilding alert logic around identity signals rather than perimeter events.
Reduced false positives 72% across the top ten noisiest rules, which recovered roughly fifteen analyst hours a week.
Led containment on a business email compromise affecting 12 mailboxes: revoked tokens, forced reauthentication, and produced the timeline used in the client report.
Ran the phishing simulation programme; click-through fell from 18% to 4% over four quarters with targeted follow-up rather than blanket training.
The rewrite that matters most in this role
Monitored security alerts in the SIEM and escalated incidents according to established procedures.
Wrote 40 Sigma detections mapped to MITRE ATT&CK and cut mean time to detect from 26 hours to 40 minutes by pivoting alert logic onto identity signals.
Why it works: The weak line describes a shift, not a contribution, and it is what every SOC analyst does. The rewrite shows authorship, a framework reviewers trust, and a step change in the number the function is measured on.
Skills
Skills worth listing as a cybersecurity analyst
Only what you would be comfortable being interviewed on. A long list dilutes every real match.
Technical & role-specific
Worth proving, not claiming
These belong inside a bullet that demonstrates them, not in a list. A line that says “communication” is worth nothing; a bullet showing you ran the workshop is worth a lot.
Keywords
What the tracking system is indexing
These are the terms a requisition for this title typically matches on. Use the ones that are true of you, inside the sentences where you did the work.
Paste the actual posting into the builder and you get this list generated from that requisition instead of the general case, including which terms you are already carrying and which bullet is the right home for the rest.
How keyword targeting worksMistakes
Errors specific to cybersecurity analyst resumes
Not the generic advice. These are the ones that cost people interviews in this particular field.
Tool lists standing in for judgement
Every candidate has touched a SIEM. What they have written in it, and what it caught, is the differentiator.
Burying certifications
Enterprise and government filters are frequently literal. Put them in a clearly headed section with the exact names.
Over-disclosing an incident
Never name the affected client or specifics that identify them. Describe technique, scale and your role; a reviewer will recognise competence without the details.
Claiming red team work you have not done
This is the fastest field in which to be caught. Interview panels here test claims directly.
Questions
Cybersecurity Analyst resume questions
No certifications yet. Should I still apply?
Yes, but expect filters to bite at large enterprises. Security+ or CySA+ is the cheapest fix to the pass rate.
How do I move from IT support into security?
Reframe the security-adjacent work you already do (patching, identity, access reviews, phishing triage) as the spine of the resume, then add a detection or lab project.
Are home labs and CTFs worth listing?
As a short section, yes, especially early on. Name what you built or solved rather than the platform.