Resume template · Updated October 2026
Cybersecurity analyst resume template
Short answer
Henrietta suits a cybersecurity analyst five years into security operations: a plain business layout that puts the security degree right after the jobs and fits short skills into a three-column grid. The fictional sample is a Tier 2 analyst at a regional bank in Charlotte after two years at a managed security provider, with detections mapped to MITRE ATT&CK, an email compromise response, and Security+ and CySA+ in the headline.
Download the cybersecurity analyst sample
Keisha is a fictional cybersecurity analyst (SOC tier 2). Replace every detail with your own before you send it.
The files are made in your browser by Resumity's own exporters, from this sample. The builder opens it as your own resume: click any line to replace it. Free plan, no watermark.
Why Henrietta suits a cybersecurity analyst resume
Henrietta is a conventional single-column layout that prints education straight after experience, so a cybersecurity degree is not buried under a long tool list, and its plain business look suits an analyst applying to a bank, insurer or hospital security team. The three-column skills grid fits short items such as alert triage, KQL and phishing analysis.
Second choice: Meridian. Meridian prints skills above experience as labelled rows; choose it if the posting names SIEM and EDR products you want matched before your job history.
What goes in each section, in Henrietta's order
Henrietta prints its sections in a fixed order, the same in the PDF and the Word file. Here is that order for this sample, and what to put in each section.
- Professional Summary. Name your tier, the kind of SOC (managed provider, in-house, government) and your certifications. Henrietta prints certifications at the very end, so Security+ and CySA+ also appear in the headline and the last sentence of the summary.
- Work Experience. Describe cases, not the console. Alert volume and environment size set the scale; detections written or tuned, investigations led and containment times show the level. Naming the ATT&CK techniques your detections cover gives a hiring manager a shared vocabulary for your coverage.
- Education. Henrietta places the degree right after your jobs. A cybersecurity, IT or computer science degree goes here with the year, as do associate degrees and bootcamps. Add capture-the-flag or lab work only within a couple of years of graduating.
- Skills. The grid prints three columns without the Technical, Tools and Soft Skills labels. Keep analysis skills in the first group, the named SIEM, EDR and scripting tools in the second, and reporting and handover skills in the third.
- Certifications. Full CompTIA names with the year. CompTIA lists security analyst among the roles Security+ prepares you for, and describes CySA+ as validating the ability to detect, analyse and respond to threats. List an exam in progress only once it is booked, marked "expected" with the month.
The sample resume as text
The same content as the files above, so you can copy a line or compare it with your own.
Keisha Morgan
Cybersecurity Analyst (SOC Tier 2), Security+ and CySA+
Charlotte, NC | keisha.morgan@example.com | (704) 555-0158 | linkedin.com/in/sample-keisha-morgan
Cybersecurity analyst with five years in security operations, two at a managed security provider and three in a regional bank's SOC. Triages SIEM and EDR alerts, leads Tier 2 investigations and writes detections mapped to MITRE ATT&CK. CompTIA Security+ and CySA+ certified.
Experience
Cybersecurity Analyst, SOC Tier 2, Piedmont Harbor Bank, Charlotte, NC (03/2023 to Present)
- Investigate escalated alerts in Microsoft Sentinel and Defender for Endpoint across 4,000 endpoints, closing or handing off each case with a written timeline.
- Wrote 25 KQL detection rules mapped to ATT&CK credential access and lateral movement techniques and retired 12 noisy ones; false positives in the Tier 1 queue fell by about a third.
- Led the response to a business email compromise: contained the mailbox within an hour, found the forwarding rule and wrote the report for the fraud team.
- Run a monthly phishing review with the awareness team, turning real lures from the queue into training examples.
- Track remediation of critical vulnerabilities on internet-facing servers with the infrastructure team and report overdue items weekly.
SOC Analyst, Tier 1, Uptown Shield Managed Security, Charlotte, NC (06/2021 to 02/2023)
- Triaged about 60 alerts a shift across 30 client environments, escalating with the evidence attached.
- Wrote the playbook for suspicious OAuth app consents, adopted by all three shifts.
- Automated threat intelligence lookups for alert enrichment with a short Python script.
Education
BS, Cybersecurity, Mecklen State University (05/2021)
Certifications
- CompTIA Security+, CompTIA (2021)
- CompTIA Cybersecurity Analyst (CySA+), CompTIA (2024)
Skills
Alert triage, Incident response, Detection engineering (KQL), Threat hunting, Phishing analysis, MITRE ATT&CK mapping, Microsoft Sentinel, Defender for Endpoint, Splunk, Wireshark, Python, Jira, Written incident reports, Shift handover, Calm escalation
How to make the sample yours
Match the SIEM and EDR names to the posting
Splunk, Microsoft Sentinel, QRadar, Elastic, CrowdStrike, Defender: if you have used the one in the posting, make sure it appears in the skills grid and in at least one bullet.
Give the size of what you watch
4,000 endpoints, 30 client environments, alerts per shift. Scale tells a reader whether your SOC resembles theirs.
Tell one investigation in four beats
Detection, containment, root cause, report. The email compromise bullet in the sample covers all four in one line; write your own the same way.
Show tuning, not only triage
Rules retired, false positives reduced, playbooks written. On paper, those are what separate a Tier 2 analyst from Tier 1.
Use the title the posting uses
Cybersecurity analyst, information security analyst and SOC analyst overlap heavily. Put the posting's wording in your headline when it matches your work; your official title stays on the job line.
Keywords to keep where they are true
Terms this kind of resume is usually searched for. Use the posting's exact wording, and only for work you have done.
- security operations center (SOC)
- SIEM
- EDR
- alert triage
- incident response
- threat hunting
- detection engineering
- KQL
- Splunk SPL
- MITRE ATT&CK
- phishing analysis
- vulnerability management
- log analysis
- CompTIA Security+
- CompTIA CySA+
Mistakes to avoid
- A tool list padded with products you only saw in a demo; interviewers ask you to talk through a query.
- Case details that identify your employer's customers, IP ranges or internal hostnames.
- "Monitored alerts" as the whole description of a job. Say what you decided and what happened next.
- A certification you have only started studying for, listed as if passed.
How the sample PDF reads in text extractors
We exported this sample with Resumity's PDF exporter in Chrome on 2026-10-29 and read the file back with three open-source text extractors. This shows whether software that turns a PDF into text can recover it; it is not a test of any commercial applicant tracking system. How we test templates.
| Extractor | Name, email, phone | Headings | Bullets intact |
|---|---|---|---|
| pdf.js 4.10.38 | All found | 5 of 5 | 8 of 8 |
| pdftotext (Xpdf) 4.00 | All found | 5 of 5 | 8 of 8 |
| pypdf 6.13.0 | All found | 5 of 5 | 8 of 8 |
Frequently asked questions
Is a cybersecurity analyst resume the same as an information security analyst resume?
Very nearly. The titles overlap and the evidence (alerts handled, investigations, detections, vulnerability follow-up) is the same. Use the exact title from the posting in your headline if it fits what you do.
How do I show the step from Tier 1 to Tier 2?
With work beyond the queue: detections you wrote, rules you tuned, playbooks others now follow, investigations you led end to end. The sample keeps the Tier 1 job below to show where that started.
What should I leave off a security resume?
Internal hostnames, IP ranges, tool configurations, customer names and details of incidents that were never made public. Describe the type of attack and your part in it instead.
Do I need Security+ to get a SOC analyst job?
Not always. CompTIA positions it for security analyst, security engineer and systems administrator roles, and when a posting names it a screener will look for it. If you have it, put it in the headline as well as the certifications list.
Should I include a home lab or capture-the-flag work?
Early in your career, yes: a home SIEM lab or CTF write-ups show initiative. Label them clearly as lab work, and drop them once two or three real investigations fill the page.
Will applicant tracking systems read this Henrietta PDF?
The sample PDF read back with its contact details, all 5 section headings and all 8 bullets intact in three open-source text extractors (pdf.js, pdftotext and pypdf). Commercial systems such as Workday, Greenhouse or Taleo were not tested, and each employer configures its own.
Guides and templates for this resume
Sources, checked 29 October 2026
We opened every page below on that date. Pay, rules and requirements change, so check the source before you rely on a detail.
- CompTIA: CompTIA Security+ (validates core security skills; CompTIA links it to security analyst, security engineer and systems administrator roles)
- CompTIA: CompTIA Cybersecurity Analyst (CySA+) (validates the ability to detect, analyze and respond to cybersecurity threats)
- The MITRE Corporation: MITRE ATT&CK (a globally accessible knowledge base of adversary tactics and techniques based on real-world observations)
More in resume templates by job title.