This page is for security analysts, engineers, and SOC professionals. Security resumes are screened for scope (what you protected), detection and response evidence (what you caught, how fast), and risk reduction you can quantify. Certifications matter in this field, but demonstrated incidents handled matter more.
ALEX MORGAN Email: alex.morgan@example.com | Phone: +1 555 010 0091 | Washington, DC | linkedin.com/in/alexmorgan PROFESSIONAL SUMMARY Cybersecurity analyst with 5 years in SOC and incident response. Cut mean time to detect from 9 hours to 40 minutes by rebuilding SIEM rules, and led response for 30+ confirmed incidents with zero data loss. PROFESSIONAL EXPERIENCE Senior Security Analyst | Bastion Health | 2022 - Present - Rebuilt SIEM correlation rules, cutting mean time to detect from 9 hours to 40 minutes across 5,000 endpoints. - Led containment of a ransomware attempt in under 90 minutes, resulting in zero data loss and 4 hours of downtime. - Owned SOC 2 Type II evidence for 11 controls, achieving zero exceptions across two annual audits. Security Analyst | Clearwatch SOC | 2019 - 2022 - Triaged 200+ daily alerts, escalating 3% with a documented 98% true-positive rate. - Reduced critical vulnerabilities open beyond SLA from 40 to 3 through automated patch tracking. - Ran quarterly phishing simulations, raising employee report rates from 31% to 76%. SKILLS Splunk, Microsoft Sentinel, CrowdStrike EDR, Burp Suite, Python, AWS IAM, NIST CSF, ISO 27001 CERTIFICATIONS GIAC GCIH, CompTIA Security+, AWS Security Specialty
"Cybersecurity analyst with 5 years in SOC and incident response roles. Cut mean time to detect from 9 hours to 40 minutes by rebuilding SIEM correlation rules, and led response for 30+ confirmed incidents including a ransomware containment with zero data loss. GIAC certified."
Why it works: Detection speed, incident volume with a high-stakes example, and certification in one breath. Security hiring managers scan for exactly these three signals.
SIEM (Splunk, Sentinel), EDR, Threat hunting, Incident response
Penetration testing, Burp Suite, Metasploit, Vulnerability management
ISO 27001, SOC 2, NIST CSF, Risk assessments
Python, SQL, Cloud security (AWS/IAM), Automation
The pattern to copy: strong verb, specific action, measurable result. Compare each weak version with its rebuild:
Example 1
Bad: Monitored security alerts and responded to threats.
Good: Triage 200+ daily alerts across 5,000 endpoints, escalating 3% for investigation with a documented 98% true-positive rate.
Why: Volume, scope, and precision. It shows judgment under load, which is the core SOC skill, instead of a generic monitoring claim.
Example 2
Bad: Performed vulnerability scans and reports.
Good: Reduced critical vulnerabilities open beyond SLA from 40 to 3 by automating patch tracking and negotiating remediation windows with 6 product teams.
Why: The before/after plus the cross-team method shows both technical and influence skills, which senior security roles require.
Example 3
Bad: Knowledge of compliance frameworks.
Good: Owned evidence collection for SOC 2 Type II across 11 controls, achieving zero exceptions across two annual audits.
Why: Framework knowledge becomes real when tied to specific controls and audit outcomes. Zero exceptions is a verifiable claim.
Include the terms the job posting uses, and make sure each one is backed by evidence in a bullet. Common keywords for this role:
cybersecurity analystincident responseSIEMthreat detectionvulnerability managementSOCpenetration testingrisk assessmentISO 27001SOC 2cloud securityIAM
Upload your cybersecurity analyst resume and get it roasted by VibeJudge: score, problems, quick wins, and rewrites. Free, no signup.
Check my resume freeSecurity+ for entry level, GIAC (GCIH, GCIA) for incident response and SOC roles, OSCP for offensive work, and CISSP once you meet the experience requirement. Match the certification to the job family, not the trend.
Describe scope and outcomes: endpoint counts, incident categories, detection times, audit results. Avoid client names, exploit details, and internal tooling specifics.
Yes, and your resume should bridge deliberately: automation you wrote, incidents you supported, secure coding or hardening you did. Security teams value builders who understand systems.
VibeJudge handles resume preparation. When the resume is sharp, Rehearse helps you answer the questions a recruiter will ask about it.
Practice with Rehearse →
