Cybersecurity Analyst CV example

What recruiters expect

Before writing anything, it helps to know what the person reading is checking for. In this field that is usually a short, specific list:

• Alert volumes and triage throughput, with the proportion that turned out to be genuine.
• Named tooling: the SIEM, the EDR, the ticketing system. Security teams buy specific products and hire for them.
• Framework fluency - MITRE ATT&CK, NIST CSF, ISO 27001 - used in context rather than listed.
• Detection content you wrote yourself, and how you tested it.
• Certifications stated exactly, with dates, and never implied when they are in progress.

Recommended CV structure

This is the running order the example uses. It is a starting point rather than a rule, but the order reflects what tends to be read first in this profession.

1. Profile — Three or four lines positioning you for the role.
2. Technical Skills — Grouped skills, for example "Languages" and "Tooling".
3. Professional Experience — Paid roles, in reverse chronological order.
4. Certifications — Completed certifications with the issuing body.
5. Education — Degrees, diplomas and school-leaving qualifications.
6. Professional Memberships — Bodies you belong to, with membership numbers where relevant.
7. Languages — Spoken languages with CEFR levels.

Sections worth adding

• Training — Vendor and hands-on lab training is respected while certifications are pending.
• Home Lab & Research — Valuable for early-career analysts; describe methodology, not exploits.

Skills worth including

Grouped rather than listed in one block. Grouping makes a long list readable and shows that you can tell the difference between the things you use daily and the things you have touched.

Beyond the technical list: Incident communication, Writing for non-technical stakeholders, Handover discipline, Working to defined escalation paths. These belong inside your experience bullets, demonstrated, rather than in a list of adjectives.

Example professional summary

Three or four lines, positioned for the role rather than describing your personality. Two versions you can adapt:

Security analyst with four years in a 24/5 SOC covering financial services clients. Triage around 120 alerts a day, author Sigma detections mapped to MITRE ATT&CK, and have led containment on business email compromise and credential-stuffing incidents. CompTIA Security+ and Microsoft SC-200 certified.

SOC analyst moving into detection engineering. Comfortable in Splunk and Sentinel, with a focus on reducing alert fatigue - most recently by rewriting the three rules responsible for roughly half of the team’s false positives.

Writing your experience

The difference between a CV that gets a call and one that does not is almost always in the bullet points. Each pair below shows a real rewrite of the kind of line that appears on most CVs in this field.

Taken from the example

The sample CV for this profession is fully written. A few sections from it, so you can see the level of specificity that works:

Experience

Security Analyst (Tier 2), Halberd Managed Security

• Triage around 120 alerts a day as second-line analyst across eight financial services clients, escalating a monthly average of nine confirmed incidents with full timeline documentation.
• Authored 30 Sigma detections mapped to MITRE ATT&CK techniques including T1078 and T1110, validated against replayed historical logs before release.
• Rewrote the credential-stuffing rule that generated roughly half the team’s false positives, bringing it from about 40 a week to 3 without missing a subsequent true positive.
• Acted as scribe and then lead analyst on a business email compromise incident: isolated three mailboxes, revoked sessions and produced the timeline used in the client notification.

Education

• BSc (Hons) Cyber Security, University of Westminster — First Class Honours

Certifications and registration

• CompTIA Security+ (SY0-701) — CompTIA
• Microsoft Certified: Security Operations Analyst Associate (SC-200) — Microsoft
• BTL1 – Blue Team Level 1 — Security Blue Team

Common mistakes

ATS considerations

Applicant tracking systems behave differently by sector, and generic advice is often wrong for a given field. These points are specific to cybersecurity analyst applications:

• Spell out abbreviations once: "security information and event management (SIEM)", "endpoint detection and response (EDR)".
• Use the exact certification titles including the awarding body, because screening is often done against a list.
• Name the SIEM product. "SIEM experience" alone will not match an advert asking for Sentinel.
• If you hold or are eligible for a security clearance, state it precisely and never imply a level you do not hold.

The Minimal ATS layout is built for this, and the ATS guide covers what parsers do to a file in more detail.

Guides that go deeper

This page applies general CV advice to one field. The full treatment of each part is here:

• How to Write a Professional Summary — Four lines at the top of the page that decide whether the rest gets read. A method, and the three ways they usually go wrong.
• How to Describe Work Experience — The difference between listing duties and demonstrating impact, and a repeatable way to rewrite any weak bullet point.
• How to List Skills on a CV — Group them, be specific, and cut anything you would not want to be interviewed on for ten minutes.

Questions about cybersecurity analyst CVs