Cybersecurity Analyst resume example. Plus the keywords recruiters search for.
A cybersecurity analyst resume that shows the alerts you triage, the incidents you contain and the risk you reduce — with the SIEM, EDR and framework keywords security hiring managers filter on.
Reviewed by Nazir Elmurodov · Updated
/ The example
Cybersecurity Analyst resume example.
Samuel Okoye
Cybersecurity Analyst
San Antonio, TX · samuel.okoye@email.com · (210) 555-0136
Summary
Cybersecurity analyst with 5 years in security operations, from a managed SOC to an in-house team at a financial services firm. I focus on threat detection, incident response and vulnerability management, and I tune detections until analysts trust them.
Experience
Cybersecurity Analyst, Riverwalk Financial Group · Apr 2023 – Present
- • Triage 150+ Splunk alerts a day in a 24/7 SOC and escalate confirmed incidents under the company's incident response plan
- • Tuned 40 noisy correlation searches, cutting false positives by 35% and freeing about 10 analyst hours a week
- • Led response to a phishing campaign that reached 120 inboxes: blocked the sender, purged the messages and reset 6 exposed accounts within 2 hours
- • Run monthly vulnerability scans in Tenable and track fixes with IT; critical findings open past 30 days fell from 48 to 9
SOC Analyst, Lonestar Managed Security · Jun 2021 – Mar 2023
- • Investigated endpoint alerts in CrowdStrike Falcon for 25 client environments
- • Wrote 20 runbooks for common alert types, cutting average triage time from 25 to 15 minutes
- • Mapped client detections to MITRE ATT&CK techniques and the NIST Cybersecurity Framework to show coverage gaps
- • Wrote Python scripts that added threat intelligence lookups to alerts before an analyst opened them
Education & certifications
B.S. Computer Science, The University of Texas at San Antonio, 2021 · CompTIA Security+ · CompTIA CySA+
Skills
SIEM (Splunk) · EDR (CrowdStrike Falcon) · Incident response · Threat detection · Vulnerability management · Tenable · Log analysis · Phishing analysis · MITRE ATT&CK · Python
Samuel Okoye
Cybersecurity Analyst
samuel.okoye@email.com · San Antonio, TX
(210) 555-0136
Summary
Cybersecurity analyst with 5 years in security operations, from a managed SOC to an in-house team at a financial services firm. I focus on threat detection, incident response and vulnerability management, and I tune detections until analysts trust them.
Experience
Cybersecurity Analyst — Riverwalk Financial Group
Apr 2023 – Present
• Triage 150+ Splunk alerts a day in a 24/7 SOC and escalate confirmed incidents under the company's incident response plan
• Tuned 40 noisy correlation searches, cutting false positives by 35% and freeing about 10 analyst hours a week
• Led response to a phishing campaign that reached 120 inboxes: blocked the sender, purged the messages and reset 6 exposed accounts within 2 hours
• Run monthly vulnerability scans in Tenable and track fixes with IT; critical findings open past 30 days fell from 48 to 9
SOC Analyst — Lonestar Managed Security
Jun 2021 – Mar 2023
• Investigated endpoint alerts in CrowdStrike Falcon for 25 client environments
• Wrote 20 runbooks for common alert types, cutting average triage time from 25 to 15 minutes
• Mapped client detections to MITRE ATT&CK techniques and the NIST Cybersecurity Framework to show coverage gaps
• Wrote Python scripts that added threat intelligence lookups to alerts before an analyst opened them
Education
The University of Texas at San Antonio
B.S. Computer Science · 2021
Certifications
CompTIA Security+
CompTIA CySA+
Skills
SIEM (Splunk), EDR (CrowdStrike Falcon), Incident response, Threat detection, Vulnerability management, Tenable, Log analysis, Phishing analysis, MITRE ATT&CK, Python
Why it works
It names the exact SIEM, EDR and scanner the analyst uses, gives alert volume and response times, and shows risk going down in numbers — false positives, triage time and open critical findings. The CompTIA certifications are listed by full name, and it doesn't claim credentials the analyst hasn't earned.
Use this as your starting point
Opens in the editor with every section filled in. Swap in your own details and download a PDF or Word file free.
Start from this exampleSample resume. Names, companies and figures are illustrative.
/ Summary examples
Three summary examples. Pick the one closest to you.
Two or three lines: your level, your field and one result.
- Entry level
CompTIA Security+ certified IT support specialist moving into security, with 2 years handling account, endpoint and phishing tickets and a home lab running Splunk and Sysmon.
- Mid level
Cybersecurity analyst with 5 years in security operations. I triage 150+ alerts a day, cut false positives by 35% and led a phishing response that was contained within 2 hours.
- Senior
Senior security analyst who leads incident response for a 3,000-person company, owns detection engineering in the SIEM and reports risk to the CISO each quarter.
More for other jobs and situations (no experience, career change, senior): resume summary examples.
/ Bullet points
Bullet point examples. From duty to result.
Turn duties into results: what you did, how, and what changed.
Detection tuning
Instead of: Worked on SIEM rules
Write: Tuned 40 Splunk correlation searches, cutting false positives by 35% and freeing about 10 analyst hours a week
Incident response
Instead of: Responded to incidents
Write: Contained a phishing campaign that reached 120 inboxes within 2 hours, including resets for 6 exposed accounts
Vulnerability management
Instead of: Ran vulnerability scans
Write: Cut critical findings open past 30 days from 48 to 9 with monthly Tenable scans and tracked fixes
Process
Instead of: Wrote procedures
Write: Wrote 20 runbooks that cut average triage time from 25 to 15 minutes
Endpoint
Instead of: Used CrowdStrike
Write: Investigated CrowdStrike Falcon endpoint alerts across 25 client environments
Frameworks
Instead of: Knowledge of MITRE ATT&CK
Write: Mapped client detections to MITRE ATT&CK and the NIST Cybersecurity Framework to show coverage gaps
/ Keywords
Keywords and skills for cybersecurity analysts.
These come up often in cybersecurity analyst job posts. Include only the ones you can back up in an interview, and use the exact wording from the post you're applying to.
- Security operations
- SOC
- SIEM
- Splunk
- Incident response
- Threat detection
- Vulnerability management
- Tenable
- EDR
- CrowdStrike Falcon
- MITRE ATT&CK
- NIST Cybersecurity Framework
- Phishing analysis
- Log analysis
- Threat intelligence
- Runbooks
- Python
- CompTIA Security+
- CompTIA CySA+
/ ATS tips
ATS tips for cybersecurity analysts.
Name your tool stack
Splunk, Microsoft Sentinel, CrowdStrike, Tenable and similar tools are searched by name. List the ones you've worked in, not the whole market.
Show volume and speed
Alerts triaged a day, time to contain and triage time give a hiring manager a sense of the pace you're used to.
Prove risk went down
Fewer false positives, fewer open critical findings or faster response are stronger than a list of duties.
Be careful with incident details
Describe what you did and the result, but leave out anything confidential — client names, specific vulnerabilities or details an attacker could use.
Only list certifications you hold
Certifying bodies restrict use of their marks. If you've passed an exam but don't hold the full certification yet, describe it exactly as the certifying body allows.
How does your cybersecurity analyst resume compare?
Free ATS score, missing keywords and fixes in about 10 seconds.
/ Questions
Cybersecurity Analyst resume FAQ.
Writing the cover letter too? See Samuel's cover letter, annotated
Which certifications matter for a cybersecurity analyst?
CompTIA Security+ is a common baseline, and CompTIA CySA+ is built for analyst work in detection and response. Vendor certifications for the SIEM or EDR you use can also help.
Should I list CISSP if I'm studying for it?
No. ISC2 requires five years of cumulative paid work in at least two of the eight CISSP domains before you can hold the certification. People who pass the exam without the experience can become an Associate of ISC2 and should describe it that way.
How do I move from IT support into cybersecurity?
Lead with the security parts of your current job — account lockouts, phishing reports, patching, endpoint alerts — and add a home lab or Security+ to show you're building the skills on purpose.
How much technical detail should my bullets have?
Enough to name the tool and the technique, plus the result. "Tuned 40 Splunk searches, cutting false positives by 35%" is specific without exposing anything sensitive.
Should I include CTF competitions or a home lab?
Yes, especially early in your career. Give it a short section with what you built or solved and the tools you used.