keenresume
  1. Home
  2. Resume examples
  3. Software & IT
  4. Cybersecurity analyst

Cybersecurity analyst resume example

A mid-level security analyst’s resume, built on military cyber experience and a move into a regulated industry. Security managers look for incidents handled, detections improved and certifications, so each of those is easy to find.

Cybersecurity analyst resume example, page 1 of 1JAMAL WASHINGTONCybersecurity Analystjamal.washington@example.com | (703) 555-0109 | Arlington, VA | linkedin.com/in/jamalwashington-secSUMMARYCybersecurity analyst with five years in security operations, including four years of active-duty Army cyberwork. I detect and contain threats quickly, tune noisy alerts into useful ones, and explain risk to people whodo not work in security. Holds an active Secret clearance.EXPERIENCECybersecurity Analyst IIJan 2023 – PresentPotomac Federal Credit UnionArlington, VA•Monitor and triage alerts in Splunk and CrowdStrike for 2,200 endpoints; investigated 1,400 alerts in 2025with a median response time of 11 minutes.•Led containment of a business email compromise in under 2 hours, stopping a $180,000 fraudulent wiretransfer.•Tuned 85 detection rules, cutting false positives by 60% and freeing about 15 analyst hours a week.•Run monthly phishing simulations; the click rate fell from 14% to 3% in a year with targeted training.Cyber Operations Specialist (17C)Jun 2018 – Dec 2022U.S. ArmyFort Meade, MD•Performed network defense and threat hunting on classified networks for a unit of 600 personnel.•Built Python scripts to correlate firewall and endpoint logs, cutting hunt preparation time from 3 days to 4hours.•Trained 12 soldiers on incident handling procedures; earned the Army Commendation Medal.EDUCATIONB.S. in Cybersecurity2019 – 2022University of Maryland Global CampusAdelphi, MDCERTIFICATIONSGIAC Certified Incident Handler (GCIH)2024GIACCompTIA CySA+2023CompTIACompTIA Security+2019CompTIASKILLSSIEM (Splunk) · EDR (CrowdStrike) · Incident response · Threat hunting ·Vulnerability management (Tenable) · Phishing analysis · Python · Wireshark · MITRE ATT&CK · NIST 800-53 · Secret clearance
Cybersecurity analystUse this example

What recruiters look for

  • Incidents you handled: type, speed and outcome. Containment times and losses avoided are the strongest proof.
  • Tools in daily use: SIEM, EDR, vulnerability scanners and ticketing. Name the products.
  • Detection engineering: rules written or tuned, false positives reduced.
  • Frameworks: MITRE ATT&CK, NIST, ISO 27001 or CIS. They show you think in systems, not alerts.
  • Certifications and clearance: often hard requirements in job ads; make them easy to find.

Writing the summary

Years in security, your specialty (SOC, incident response, vulnerability management, cloud security), and any clearance. Add one line on how you work with the rest of the business.

The summary in this example

Cybersecurity analyst with five years in security operations, including four years of active-duty Army cyber work. I detect and contain threats quickly, tune noisy alerts into useful ones, and explain risk to people who do not work in security. Holds an active Secret clearance.

Entry-level SOC analyst

Security-focused IT technician with CompTIA Security+ and two years on a service desk, where I handled phishing reports and account lockouts. Built a home lab with Splunk and Security Onion to practice detection, and looking for a tier 1 SOC role.

Security engineer, cloud

Security engineer with six years securing AWS and Azure environments for a 1,500-person company. I build guardrails into pipelines and infrastructure code so teams ship securely without waiting for a review.

Bullet points that work

Strong lines for this role, beyond the ones in the example. Borrow the shape and put in your own numbers.

  • Reduced critical vulnerabilities older than 30 days from 340 to 12 by setting up risk-based patching with IT.
  • Wrote 40 detection rules mapped to MITRE ATT&CK, closing coverage gaps found in a red team exercise.
  • Investigated a ransomware precursor on a file server and isolated it within 20 minutes, preventing encryption.
  • Built an automated phishing triage playbook in a SOAR platform, cutting manual analysis per report from 12 minutes to 2.
  • Led the incident response tabletop exercise for 25 executives and wrote the improvement plan they approved.
  • Rolled out phishing-resistant MFA to 3,000 users with the identity team in 8 weeks.
  • Prepared evidence for a PCI DSS audit with no security findings.
  • Hunted for indicators from a vendor breach across 18 months of logs and confirmed no compromise in a day.

Skills to list

Hard skills

  • SIEM (Splunk, Microsoft Sentinel, QRadar)
  • EDR (CrowdStrike, Defender, SentinelOne)
  • Incident response and forensics basics
  • Vulnerability management
  • Network analysis (Wireshark, Zeek)
  • Scripting (Python, PowerShell)
  • Cloud security basics (AWS, Azure)
  • Frameworks (MITRE ATT&CK, NIST CSF, ISO 27001)
  • Identity and access management

Soft skills

  • Calm under pressure
  • Clear incident write-ups
  • Explaining risk to non-specialists
  • Attention to detail
  • Discretion

Certifications and licenses worth listing

  • CompTIA Security+: the baseline; required for many US government roles under DoD 8140.
  • CompTIA CySA+ or GIAC GCIH: for SOC and incident response roles.
  • CISSP: for senior roles; needs five years of experience.
  • Cloud security certificates (AWS Security Specialty, Microsoft SC-200) for cloud-focused roles.
  • Security clearance: list the level and that it is active, never the details of your investigation.

Length and format

One page for up to about five years in security, two pages for senior analysts and engineers. Put certifications high up; many security job ads screen on them first.

Common mistakes

  • Listing every tool you have ever logged into. Choose the ones you could use on day one.
  • Describing incidents without outcomes: what was the impact, and how fast did you stop it?
  • Sharing sensitive details: never name a compromised client or describe internal weaknesses that are still open.
  • Hiding a clearance at the bottom. For government and contractor roles it is a screening requirement.

Questions and answers

How do I get a cybersecurity job without experience?

Start in IT support or networking, earn Security+, and build a home lab you can describe. Write about what you detected and investigated there, and apply for tier 1 SOC roles.

Should I list my security clearance?

Yes, with the level and status (“active Secret clearance”). Do not include investigation dates or other personal details.

How do I translate military cyber experience?

Use the civilian equivalent of your duties (network defense, incident response, threat hunting), keep your military occupational code in brackets, and add numbers on the size of the network and the team.

Related examples

All Software & IT examples

All resume examples