Cybersecurity Analyst resume example
By Bhagirath Sheela, founder of JobCatch ·
Security analysts are hired to detect and respond to threats, and the resume has to show it with specifics: the tools you monitor with, the incidents you handled, the vulnerabilities you found and fixed, and the frameworks your organisation follows.
What recruiters look for
- SOC work: SIEM monitoring, alert triage, incident response
- Vulnerability assessment and the fixes that followed
- Frameworks and compliance: ISO 27001, NIST, PCI DSS, CERT-In rules
- Certifications such as Security+, CEH, CySA+ or OSCP
Section order
With experience
- Summary
- Skills
- Certifications
- Experience
- Education
As a fresher
- Summary
- Certifications
- Skills
- Education
- Projects or lab work
- Internships
Summary examples
Fresher
Cybersecurity analyst with a B.Tech, CompTIA Security+, and a home lab running a SIEM with simulated attacks. Ranked in the top 5% on a public capture-the-flag platform.
Experienced
Cybersecurity analyst with four years in a 24x7 SOC for banking clients. Triages 400 alerts a day in Splunk and led the response to a phishing campaign targeting 2,000 staff.
Skills, spelled the way postings spell them
An applicant tracking system matches the words in the job posting, and it does not reliably treat two spellings as one skill. The left column is the form most postings use; the right, other spellings people type. Use the posting's own spelling for each application, and list only what you can discuss in an interview.
| Skill | Also written as |
|---|---|
| Linux | Unix, Ubuntu, RHEL |
| Python | Python 3 |
| Shell scripting | Bash, Shell, Bash scripting |
| AWS | Amazon Web Services |
| Microsoft Azure | Azure |
| Documentation | Technical writing, Record keeping |
| Process improvement | Process optimisation, Process optimization |
Also worth listing if you have them: SIEM (Splunk, Microsoft Sentinel), Incident response, Vulnerability assessment, Network security, ISO 27001.
Bullet examples
Each bullet says what you did and what changed because of it. Change the numbers to your own; a recruiter will ask about every one.
- Triage around 400 SIEM alerts a day in Splunk for three banking clients in a 24x7 SOC.
- Led the response to a phishing campaign against 2,000 staff: contained in 3 hours, no data lost.
- Wrote 35 detection rules that cut false positives by 40% while catching two real intrusions.
- Ran quarterly vulnerability scans and tracked 600 findings to closure with system owners.
- Prepared evidence for ISO 27001 surveillance audits with no major non-conformity.
For freshers: projects and internships
- Built a home lab with a SIEM, a Windows domain and simulated attacks, and wrote up each detection.
- Ranked in the top 5% on a public capture-the-flag platform.
- Internship: reviewed firewall rules for a mid-size company and removed 120 unused rules.
Mistakes to avoid
- Listing hacking tools without context. Employers want to know you can defend, detect and report.
- No incidents or numbers. Alerts handled, response times and findings closed are your results.
- Leaving out compliance. Indian banks and fintechs work under RBI and CERT-In rules; that experience is valued.
What an ATS reads from this sample
An applicant tracking system turns the PDF into plain text before anyone reads it. This is that text for the sample above, extracted by the same code as "What the ATS reads" in the app. Everything is in reading order, under the right heading, with the name and email intact — which is what a single-column template is for.
Mohit Arora Cybersecurity Analyst [email protected] | +91 98765 43210 | Noida, Uttar Pradesh | linkedin.com/in/mohitarora Summary Cybersecurity analyst with four years in a 24x7 SOC for banking clients. Triages 400 alerts a day in Splunk and led the response to a phishing campaign targeting 2,000 staff. Technical skills Linux · Python · Shell scripting · AWS · Microsoft Azure · Documentation · Process improvement · SIEM (Splunk, Microsoft Sentinel) · Incident response · Vulnerability assessment · Network security · ISO 27001 Projects Detection rules 35 SIEM detections with write-ups; false positives down 40%. Experience Security Analyst (SOC L2), Shieldline Cyber Services Jan 2022 – Present Noida Triage around 400 SIEM alerts a day in Splunk for three banking clients in a 24x7 SOC. Led the response to a phishing campaign against 2,000 staff: contained in 3 hours, no data lost. Wrote 35 detection rules that cut false positives by 40% while catching two real intrusions. SOC Analyst (L1), Coreline IT Services Jul 2020 – Dec 2021 Noida Ran quarterly vulnerability scans and tracked 600 findings to closure with system owners. Prepared evidence for ISO 27001 surveillance audits with no major non-conformity. Education B.Tech, Computer Science 2016 – 2020 Amity University · 8.0 CGPA Certifications CompTIA Security+, 2020 Languages English, Hindi
Interview questions to prepare
The app's interview prep for this sample and a plain Cybersecurity Analyst posting. It works from the resume and the posting only, and tells you how to prepare, never what to say.
Questions every interview has
- Tell me about yourself. Two minutes: what you do now (Security Analyst (SOC L2) at Shieldline Cyber Services), one result you are proud of, and why this role is next.
- Why do you want this job? Read their website and one recent piece of news before the call. Name something specific.
- Why are you leaving your current job? Say what you are moving towards. Do not criticise your employer.
- What is your notice period, and what salary are you expecting? Decide your number before the interview, so you are not deciding it on the call.
About the skills the job asks for
- Tell me about a time you used Python. Pick one real example: what the problem was, what you did, and what changed.
- Tell me about a time you used Shell scripting. Pick one real example: what the problem was, what you did, and what changed.
- Tell me about a time you used AWS. Pick one real example: what the problem was, what you did, and what changed.
- Tell me about a time you used Microsoft Azure. Pick one real example: what the problem was, what you did, and what changed.
- Tell me about a time you used Linux. Pick one real example: what the problem was, what you did, and what changed.
- Tell me about a time you used Documentation. Pick one real example: what the problem was, what you did, and what changed.
About what the resume claims
- You wrote: "Triage around 400 SIEM alerts a day in Splunk for three banking clients in a 24x7 SOC." Expect three follow-ups: how exactly, what was your own part, and how you know it worked.
- You wrote: "Led the response to a phishing campaign against 2,000 staff: contained in 3 hours, no data lost." Expect three follow-ups: how exactly, what was your own part, and how you know it worked.
- You wrote: "Wrote 35 detection rules that cut false positives by 40% while catching two real intrusions." Expect three follow-ups: how exactly, what was your own part, and how you know it worked.
Questions to ask them
- What would a good first three months in this role look like?
- Who would I work with most closely?
- What are the next steps, and when should I expect to hear back?
Templates that suit this role
All of these are single-column and read cleanly by an applicant tracking system. Classic is free, with no watermark.
Questions
Which certification should a fresher in cybersecurity get?
CompTIA Security+ is the common starting point, followed by CySA+ or CEH for analyst roles. Hands-on proof — a home lab, capture-the-flag results — counts as much.
Do I need to know programming for a security analyst role?
Basic Python and shell scripting help a lot for automating triage and reading logs. Deep programming matters more for application security and penetration testing.
Next: the Cybersecurity Analyst cover letter the app drafts from this resume, and how to show Linux, Python, AWS on a resume.
More cloud & security resume examples: DevOps Engineer · Cloud Engineer · Network Engineer · System Administrator