lucipath
Engineering & Data

Cybersecurity Analyst resume example & template

A mid-level SOC analyst resume for someone moving from managed security into an in-house team. Every bullet names the tool, the environment size and what the analyst actually found or fixed.

Edit this template, free Download PDF
  • Environment scale up front: 14,000 endpoints, 9 hospitals, 30 client tenants.
  • Evidence a SOC lead trusts: alert volumes, a real intrusion caught, detection rules written.
  • Security+, CySA+ and GCIH backed by work that shows each one being used.
100%
Darnell Hughes
Security Analyst II · SOC Operations & Incident Response
San Antonio, TX(210) 555-0137darnell.hughes@email.comlinkedin.com/in/darnellhughes

Summary

Security analyst with 6 years in security operations, the last 3 on a hospital system's internal SOC. Works in Splunk Enterprise Security, CrowdStrike Falcon and Microsoft Sentinel daily. Strongest in detection tuning and containing phishing and account compromise incidents.

Experience

Security Analyst II · Brazos Health SystemMar 2023 – Present
San Antonio, TX
  • Triaged about 60 escalated alerts a week from Splunk ES and CrowdStrike Falcon across 9 hospitals and 14,000 endpoints.
  • Contained a 2025 business email compromise: disabled 3 Entra ID accounts, purged 1,140 phishing messages and drafted the HIPAA incident summary.
  • Wrote 22 Splunk correlation searches mapped to MITRE ATT&CK and retired 9 noisy rules, dropping weekly false positives from about 480 to 190.
  • Ran monthly Tenable scans and chased remediation with server teams; critical findings older than 30 days fell from 87 to 12 in a year.
  • Automated phishing-report handling with a Splunk SOAR playbook, bringing median time to verdict from 40 minutes to 9.
SOC Analyst I · Pinnacle Managed SecurityJun 2020 – Feb 2023
San Antonio, TX
  • Monitored Microsoft Sentinel and QRadar queues for 30 client tenants on a rotating 12-hour shift schedule.
  • Closed an average of 35 tier 1 alerts per shift, escalating confirmed intrusions with PCAPs and timeline notes attached.
  • Caught a Cobalt Strike beacon at a manufacturing client from DNS beaconing in proxy logs; 4 hosts were isolated within 2 hours.
Help Desk Technician · Mission Creek ISDJun 2018 – May 2020
San Antonio, TX
  • Handled 25 to 30 tickets a day for 4 campuses: account lockouts, MFA enrollment, Chromebook repairs and classroom projectors.

Education

B.S. Cyber Security · The University of Texas at San AntonioMay 2018

Skills

SIEM & SOAR: Splunk Enterprise Security, Splunk SOAR, Microsoft Sentinel, IBM QRadar
Endpoint & Identity: CrowdStrike Falcon, Microsoft Defender for Endpoint, Entra ID, Proofpoint
Analysis: SPL, KQL, Wireshark, Tenable, MITRE ATT&CK, PowerShell, Python

Certifications

CompTIA Security+ · CompTIA CySA+ · GIAC Certified Incident Handler (GCIH)

How to write a cybersecurity analyst resume

What hiring teams in this field actually screen for, and the terms that get matched.

What SOC and security hiring managers screen for

A security lead reads your resume for one thing first: have you worked real alerts in a real environment? Name the SIEM and EDR you used, the size of what you protected (endpoints, users, client tenants) and your tier. Then show judgment: a true positive you caught, how fast it was contained, a noisy rule you fixed. Tier 2 postings ask for investigation, containment and detection engineering, so a bullet about writing or tuning correlation searches often matters more than one about alert counts.

Certifications, tools and terms that get matched

Postings list tools by product name, so spell them the way they do: Splunk, Microsoft Sentinel, QRadar, CrowdStrike Falcon, SentinelOne, Defender for Endpoint. Query languages (SPL, KQL) and MITRE ATT&CK are common filters. For certifications, CompTIA Security+ is the usual baseline (and required for many DoD roles), CySA+ and GIAC GCIH or GCIA signal analyst depth, and CISSP matters only once you have the five years of experience it requires. Include compliance frameworks you worked under, such as HIPAA, PCI DSS or NIST CSF.

Common mistakes on cybersecurity resumes

The most common complaint from security hiring managers is a certification list with no work behind it. A cert next to a bullet showing it in use is worth far more than four certs alone. Two more: saying you are familiar with Wireshark or Splunk instead of saying what you found with them, and listing every tool from a home lab as if you ran it in production. Keep lab work in a separate projects line and be ready to walk through any incident you mention.

Cybersecurity Analyst resume FAQ

Quick answers before you start writing.

What should a cybersecurity analyst resume include?

A strong cybersecurity analyst resume opens with a concise professional summary, then work experience written as quantified, results-first bullets, followed by education, a skills section, and any certifications. The example above shows each section in order.

What skills should a cybersecurity analyst resume highlight?

Lead with the skills the job posting asks for. For a cybersecurity analyst, recruiters and ATS filters commonly look for Splunk Enterprise Security, Splunk SOAR, Microsoft Sentinel, IBM QRadar, CrowdStrike Falcon, and Microsoft Defender for Endpoint. Group them so they are easy to scan.

Is this cybersecurity analyst resume template ATS-friendly?

Yes. It uses a single-column structure, standard section headings, real text (no text trapped in images), and no tables or graphics that confuse applicant-tracking systems, so it parses cleanly while still looking polished.

How long should a cybersecurity analyst resume be?

One page is ideal for most cybersecurity analysts. Use two pages only if you have ten or more years of directly relevant experience, then tune the text size and margins so it stays clean.

More resume templates

Different role? Start from one of these, or browse every role in the Classic style.

Writing the cover letter too? See the Cybersecurity Analyst cover letter example.

Software Engineer

ClassicEngineering & Data

Data Analyst

CompactEngineering & Data

Data Scientist

ClassicEngineering & Data

Make this resume yours

Edit the wording, switch styles and colours, and tailor it to each job. All free.

Edit this template for free

Free · your data stays yours · no credit card