Cybersecurity Resume: Examples, Skills, and Writing Guide

Security work is mostly invisible when it goes well. The breach that didn't happen, the phishing email that got blocked, the vulnerability patched before anyone exploited it. That makes writing a cybersecurity resume hard, and it's why so many end up as lists of tools and certifications with no evidence of what the person actually protected.

This guide shows you how to write a cybersecurity resume that proves you reduced risk. You'll get a full sample resume, a bullet formula built for security work, a table of incident and security metrics to quantify, bullets from SOC analyst to security lead, and practical advice on Security+, CISSP, and security clearances.

You'll also see current pay and outlook data from the Bureau of Labor Statistics, guidance on describing incidents without exposing sensitive details, and a path for career changers coming from IT.

What hiring managers look for in a cybersecurity resume#

Security hiring managers read resumes with the same mindset they bring to their jobs: they look for evidence and distrust claims. Your resume needs to give them proof, fast.

Three questions every cybersecurity resume must answer#

1. What did you protect, and how big was it? Endpoints, users, cloud accounts, applications, networks, or regulated data. Scope tells the reader if your experience fits their environment.
2. How did you protect it? Tools, controls, frameworks, and processes, such as SIEM detections, EDR rollouts, vulnerability programs, or access reviews.
3. What risk went down? Faster detection and response, fewer exposed vulnerabilities, higher control coverage, cleaner audits, fewer successful phishing attempts.

Most security resumes answer the second question with a long tool list. The first and third are where you stand out.

What the job actually involves#

O*NET's profile of information security analysts lists tasks such as developing plans to protect files from unauthorized access, performing risk assessments and testing security measures, encrypting data transmissions and configuring firewalls, monitoring access, documenting security policies and tests, and training users. Each of those tasks can become a bullet with a measurable result.

How expectations shift by specialty#

Cybersecurity covers many different jobs. A SOC analyst and a GRC analyst share a field but need very different resumes. Use this table to decide what to lead with.

If you apply across specialties, keep a master resume and swap your headline and top bullets for each. Our guide on how to tailor your resume explains the process.

Cybersecurity salary and job outlook#

Cybersecurity is one of the fastest-growing fields in the BLS projections. That growth affects how you should position yourself, especially if you're moving in from IT.

According to the BLS Occupational Outlook Handbook for information security analysts, analysts earned a median annual wage of $129,180 in May 2025. The lowest 10 percent earned less than $75,090, and the highest 10 percent earned more than $199,850. There were about 192,900 jobs in 2025, and employment is projected to grow 21 percent from 2025 to 2035, much faster than the 3 percent average for all occupations, with about 14,100 openings a year.

Pay by industry#

These are the BLS May 2025 medians for information security analysts in the industries that employ the most of them.

How security compares with other tech paths#

Many security professionals arrive from systems administration or software development. The BLS projections show why security is an attractive move.

The figures for software developers and network and computer systems administrators come from their own BLS pages.

What the data means for your resume#

The BLS lists a bachelor's degree as the typical entry requirement and less than five years of related work experience, which usually means IT, networking, or development work first. It also notes that many employers prefer certified candidates. So for most people, a winning security resume combines three things: relevant IT experience, at least one recognized certification, and clear proof of hands-on security work.

A full cybersecurity resume example#

Here's a complete one-page sample for a security engineer with about five years of experience, including two years in a SOC. Company and school names are generic. Use it as a structure, then write your own.

Why this sample works#

• The headline names the specialty and stack. Detection engineering, cloud security, and named tools tell a recruiter exactly where you fit.
• Scale appears in the summary. Endpoints, identities, and cloud accounts set the level at once.
• Bullets show risk reduction. Coverage gained, false positives cut, containment time reduced, and misconfigurations closed are all measurable.
• Nothing sensitive appears. There are no incident specifics, attacker details, or client names.
• Progression is clear. SOC analyst to security engineer is a well-known path, and the resume makes it visible.

How to format a cybersecurity resume#

Security readers value precision, and your resume's structure should reflect that. Here's how format, length, and order change by situation.

Header and headline#

Include your name, city and state, phone, email, and LinkedIn. Add a top certification such as CISSP after your name if you hold it. If the role involves government work and you hold a clearance, consider adding it to the headline, such as "Incident Responder | Active TS/SCI | GCIH."

Summary#

Two to four sentences: years of experience, specialty, scope, and one result with a number. Our resume summary examples have more patterns, and we cover security summaries below.

Experience#

Give recent roles four to six bullets and older roles one or two. Lead with the bullet that shows the biggest risk reduction or widest scope.

Certifications, clearance, and education#

Certifications deserve their own section near the top for entry-level candidates and near the bottom for experienced ones. If you hold a clearance, give it a short section of its own for government and defense roles.

How to write cybersecurity resume bullets#

Security bullets fail in two ways. Some list tools: "Used Splunk, CrowdStrike, and Nessus." Others list duties: "Monitored alerts and responded to incidents." Neither tells the reader whether the organization became safer.

The asset, action, risk reduced formula#

Build each bullet from three parts:

• Asset: what you protected and how big it was (6,000 endpoints, 40 cloud accounts, a payments application, 9,000 user identities).
• Action: the control, detection, process, or fix you put in place, with the key tool named.
• Risk reduced: what improved, ideally with a before and after (time to contain, coverage, findings closed, false positives, click rates).

For big wins, lead with the outcome: "Cut critical vulnerability exposure from 45 days to 9 by building a risk-based patching program with IT across 3,000 servers."

Before and after rewrites#

These are illustrations. Replace every number with your own.

For verbs that fit security work, such as "detected," "contained," "hardened," "remediated," and "audited," see our list of resume action verbs. The resume bullet point generator can also turn a plain duty into structured drafts you then edit with your real numbers.

Describe incidents without exposing them#

Security work involves sensitive information, and hiring managers judge your discretion by how you handle it on your resume. Follow these rules:

• Describe type, volume, and outcome: "Led response on 12 business email compromise cases, all contained within 4 hours."
• Use generic descriptions of systems: "a customer-facing payments application," not the product name or architecture.
• Leave out attacker details, indicators, and unpatched weaknesses, even old ones.
• Never mention client names from consulting or MSSP work without permission.

What to quantify on a cybersecurity resume#

Security teams track plenty of metrics, but many practitioners never put them on paper. The table below lists the measures hiring managers recognize most.

A worked example: response time#

Response time is one of the clearest security metrics. Here's how to calculate it and turn it into a bullet, using illustrative numbers.

1. Define the clock. Pick when timing starts (first alert) and when it ends (host or account contained). Use the same definitions before and after.
2. Pull the baseline. From your ticketing or case system, take confirmed incidents for the six months before your change. Say the median time to contain was 9 hours.
3. Describe the change. You built automated playbooks that isolate hosts and disable accounts after analyst approval.
4. Pull the after. For the following six months, the median was 50 minutes.
5. Write the bullet. "Built automated containment playbooks for compromised hosts and accounts, cutting median time to contain from 9 hours to 50 minutes."

The chart below shows what a change like that can look like month by month. It's a model, not real data.

Where to find your numbers#

Look in SIEM and SOAR dashboards, case management or ticket history, vulnerability scanner reports, EDR consoles, identity provider reports, phishing simulation results, audit reports, and quarterly security reviews. Even rough numbers, labeled honestly with "about" or "more than," are better than none. Our guide to quantifying achievements on a resume covers estimation methods.

Cybersecurity resume bullets by level#

Expectations rise quickly with seniority. A tier 1 analyst who triages accurately is doing well. A security lead is expected to set strategy and improve the whole program. Use these as models, not copy.

Entry level or tier 1 SOC analyst#

At this level, show accurate triage, volume, and early improvements.

Security analyst#

At this level, show ownership of investigations or programs and measurable improvements.

Security engineer#

At this level, show controls you designed and built, and their effect on risk and workload.

Senior engineer, security lead, or manager#

At this level, show program ownership, team leadership, and organization-wide risk reduction.

Skills for a cybersecurity resume#

A security skills section often turns into a long list of tools. Group skills so readers can confirm your fit quickly, and only include tools you could use confidently next week.

Tools that show up in the data#

O*NET's technology list for information security analysts flags Splunk Enterprise, MITRE ATT&CK, eMASS, Amazon Web Services, Microsoft PowerShell, and Microsoft Excel among its in-demand technologies. The full list also includes tools such as Wireshark, Burp Suite, Qualys, Palo Alto Networks, and intrusion detection and prevention systems.

eMASS appears because it's used in U.S. defense work. If you're targeting government roles, include it if you've used it. For commercial roles, focus on the tools in the posting.

Use the NICE Framework for federal and defense roles#

The NICE Framework from NIST provides a common language for describing cybersecurity work and the knowledge and skills it requires. Many government and defense postings use its work role names. If a posting references a NICE work role, use the same role title and skill wording in your summary and bullets where it accurately describes your work. Our guide to the federal resume covers other government formatting rules.

Match keywords to the posting#

Run each posting through the job description keyword finder, then compare your draft with the resume keyword scanner. The technical skills generator can help you organize a grouped list. Our guide to technical skills for a resume covers how to show proficiency levels honestly.

Soft skills that matter in security#

The BLS lists analytical, communication, creative, detail, and problem-solving skills as important qualities for information security analysts. Prove them with results:

• Communication: "Briefed executives during 3 major incidents, with plain-language updates every 2 hours."
• Teaching: "Ran security training for 40 developers, cutting high-severity code findings 35% the next quarter."
• Collaboration: "Worked with IT to cut patch cycles from 30 days to 10 without increasing outages."
• Writing: "Wrote 12 security policies adopted by the company in one review cycle."

Certifications on a cybersecurity resume#

Certifications carry more weight in security than in most tech fields. The BLS notes that many employers prefer certified candidates, and many postings filter by certification name.

Which certification fits your level#

What Security+ and CISSP involve#

CompTIA describes Security+ as a globally recognized certification that validates core security skills, aimed at security analysts, security engineers, and systems administrators. Its page notes that version 7 is current and version 8 is expected on or around November 17, 2026, so check which version your training covers.

The CISSP experience requirements call for at least five years of cumulative, full-time work in two or more of the eight CISSP domains. A relevant degree or an approved credential, including Security+, can count for up to one year. If you pass the exam without enough experience, you become an Associate of ISC2 and have six years to earn the required experience.

How to list certifications correctly#

Write the full name, issuer, and year, one per line. Put your most important certification after your name or in your headline. If you're an Associate of ISC2, say exactly that, not "CISSP." If you're studying, write "CompTIA Security+ (exam scheduled February 2027)."

The certifications section generator can format your list consistently, and our guide to certifications on a resume covers expired and in-progress credentials.

How to list a security clearance on your resume#

For government and defense contractor roles, a clearance can matter as much as any certification. Listing it correctly helps recruiters who search for cleared candidates find you.

What to include#

• Level: such as Secret, Top Secret, or TS/SCI.
• Status: active or current, or the year it became inactive.
• Polygraph: only if you have one and the posting asks, with the type.
• Placement: in your headline or summary, and in a short clearance section for government roles.

What to leave out#

Never list classified program names, locations, or mission details. Describe your work at an unclassified level, as you would in any public setting. If you're unsure whether a detail is sensitive, leave it out or check with your security officer.

How to write a cybersecurity resume summary#

Your summary should tell the reader your specialty, your scope, and your best result in a few lines.

The four-part summary#

Cover these points in two to four sentences:

• Years of experience and specialty.
• Scope: users, endpoints, cloud accounts, applications, or clients.
• Key tools, certifications, or clearance.
• One result with a number.

Summary examples by level#

The resume summary generator can draft a version from your title and experience. Edit it until every phrase is specific and true.

Breaking into cybersecurity from IT or another field#

Most security professionals start in IT: help desk, systems administration, networking, or development. That background is an asset. Your resume needs to make the security parts of it visible.

Reframe your current work#

Look for every task that touched access, patching, logging, configuration, or incidents:

• Help desk: password resets and access requests, phishing reports, endpoint issues, account lockouts.
• Systems administration: patching, hardening, backups, Active Directory, group policy.
• Networking: firewall rules, VPNs, segmentation, traffic analysis.
• Development: secure coding, dependency updates, secrets management, code review.

Keep your real job title and write security-focused bullets. A sysadmin might write: "Hardened 300 Windows servers against CIS benchmarks, reducing failed controls from 140 to 12." Our career change resume guide covers combination formats, and our list of transferable skills helps you name what carries over. If you're coming from infrastructure work, our DevOps engineer resume guide shows how to present automation that overlaps with cloud security.

Build hands-on proof#

When your job offers little security work, build it yourself:

1. Set up a home lab with a SIEM, a few Windows and Linux hosts, and log forwarding.
2. Run attack simulations and write detections that catch them.
3. Compete in capture-the-flag events and write up what you solved.
4. Publish write-ups or detection rules in a public repository.
5. Earn an entry certification to pass keyword filters.

List these in a projects or labs section with links. Our guide to projects on a resume covers how to present them.

Common cybersecurity resume mistakes#

These mistakes show up on security resumes all the time. Each has a quick fix.

Listing every tool you've touched#

A skills section with 50 tools suggests breadth without depth. Hiring managers know nobody is expert in all of them. Keep the tools you'd use confidently next week, and show your strongest ones inside bullets.

Ignoring the business#

Security leaders have to justify spending to executives. If your work enabled a sale, passed a customer audit, reduced insurance premiums, or cut tool costs, say so. Business outcomes separate senior candidates from tool operators.

Your cybersecurity resume checklist and next steps#

Before you send your resume, check each item:

• Headline names your specialty, key tools, and top certification or clearance
• Summary includes years, specialty, scope, and one quantified result
• Each recent role shows scale (users, endpoints, accounts, assets)
• Bullets show risk reduced, not just tools used
• No sensitive incident details, client names, or classified information
• Certifications list the exact name, issuer, and year
• Clearance level and status are accurate
• Skills are grouped and trimmed to tools you'd use confidently
• Single-column layout, saved as a PDF unless the posting asks otherwise

Then take three next steps. First, pull a year of SIEM, ticket, scanner, and audit data and list every before-and-after number. Second, rewrite your top six bullets with the asset, action, risk reduced formula. Third, tailor your headline and top bullets to one real posting.

For interviews, prepare two incident stories and two improvement stories with the STAR method, and review our technical interview prep guide for hands-on assessments. If you'd like a head start on layout, Resume Maker can import your existing resume from PDF, Word, or text so you can rework it in one of four ATS-friendly templates.