Jordan Abernathy-Cruz: SOC Analyst I
Jordan's SOC bullets show volume, judgment and initiative: alerts handled, a real campaign stopped, a time-saving script and tuning suggestions adopted. His IT support role stays because help desk work is a common and respected path into security. Security+ and CySA+ are listed prominently because many entry-level and government postings filter on them.
Read this resume as text
Jordan Abernathy-Cruz · Austin, TX · jordan.abernathycruz@email.example · (512) 555-0117
Summary
Tier 1 SOC analyst with one year of alert triage after two years in IT support. Investigates phishing, endpoint and identity alerts in Splunk and CrowdStrike, writes clear tickets for escalation and automates small tasks with Python. Security+ and CySA+ certified, and builds detection skills in a home lab.
Experience
SOC Analyst I, Lonestar Managed Security · Austin, TX · Sep 2025 — Present
- Triage 40 to 70 SIEM and EDR alerts per shift for 15 client environments, closing false positives with documented evidence and escalating real threats to tier 2.
- Investigated a credential phishing campaign hitting three clients, pulling indicators from headers and URLs and blocking them before any account was used.
- Wrote a Python script that enriches alert tickets with IP and domain reputation, saving several minutes per investigation for the whole shift.
- Mapped recurring alert types to MITRE ATT&CK techniques and suggested two Splunk rule tunings that the detection team adopted.
IT Support Technician, Colorado River Medical Group · Round Rock, TX · Jun 2023 — Aug 2025
- Resolved desktop, account and network tickets for 300 clinic staff, including password resets and multifactor enrollment under HIPAA access rules.
- Reported suspicious emails and unusual logins to the security team, and helped run phishing awareness sessions for front-desk staff.
Projects
Detection home lab
- Built a lab with a Windows domain, Sysmon and an open-source SIEM to simulate attacks with Atomic Red Team and write detections for them.
Education
BS, Cybersecurity, Central Texas State University (2023)
Certifications
CompTIA Security+ · CompTIA CySA+
Skills
Splunk, CrowdStrike Falcon, Microsoft Defender, Phishing analysis, Alert triage, MITRE ATT&CK, Wireshark, Active Directory, Python, PowerShell, Linux, Ticketing (ServiceNow)
Fatima Al-Rashid: Senior Security Analyst, Incident Response
Fatima's resume shows end-to-end incident ownership, detection engineering and hunting, the signals that separate a mid-level analyst from a tier 1 triager. Her Canadian clearance and bilingual skill are in the summary because federal and financial employers screen for them. Bullets name the cross-team coordination incidents require, not just technical steps.
Read this resume as text
Fatima Al-Rashid · Toronto, ON · fatima.alrashid@email.example · (416) 555-0151
Summary
Cybersecurity analyst with six years in incident response and threat detection for financial services. Leads investigations from first alert to containment and lessons learned, tunes detections in Microsoft Sentinel and Defender, and works with infrastructure teams on fixes that stick. GIAC GCIH certified and holds Government of Canada Secret clearance.
Experience
Senior Security Analyst, Incident Response, Bayfront Trust Financial · Toronto, ON · Apr 2023 — Present
- Led 30 security investigations including a business email compromise, coordinating containment with IT, legal and privacy teams and writing executive summaries.
- Built 25 KQL detections in Sentinel for identity and cloud attacks, tuning each with test data to keep false positives manageable for the SOC.
- Ran quarterly threat hunts based on current threat intelligence, finding an unmanaged server with exposed remote access that infrastructure then retired.
- Wrote and tested the ransomware response playbook with tabletop exercises for IT, communications and executives.
Security Analyst, Lakeshore Insurance Group · Mississauga, ON · Jun 2020 — Mar 2023
- Monitored SIEM alerts and EDR telemetry for 2,500 endpoints, handling escalations and producing weekly incident reports for the security manager.
- Managed monthly vulnerability scans in Tenable and tracked critical fixes with system owners, shortening the time critical findings stayed open.
- Delivered phishing simulation campaigns and short training for staff, in English and French for the Quebec office.
Education
Bachelor of Technology, Information Security, Lakeshore Polytechnic University (2020)
Certifications
GIAC Certified Incident Handler (GCIH) · Microsoft Certified: Security Operations Analyst Associate · CompTIA Security+
Skills
Incident response, Microsoft Sentinel, Microsoft Defender XDR, KQL, Threat hunting, Digital forensics, Malware triage, Azure and Entra ID, MITRE ATT&CK, Vulnerability management, Python, French and English
Marcus Whitfield-Osei: Lead Cybersecurity Analyst
Marcus leads with clearance and CISSP because federal employers check both before anything else. His bullets show leadership of a 24/7 team, a detection engineering process and an incident handled under agency reporting rules. His first technician role shows where the monitoring foundation came from, and the degree he finished while working sits under education.
Read this resume as text
Marcus Whitfield-Osei · Arlington, VA · marcus.whitfieldosei@email.example · (703) 555-0136
Summary
Senior cybersecurity analyst and detection engineering lead with 12 years protecting federal and defense networks. Leads analysts through threat hunting, incident response and detection development, and builds programs aligned with NIST and agency requirements. CISSP certified with an active TS/SCI clearance.
Experience
Lead Cybersecurity Analyst, Potomac Mission Systems · Arlington, VA · Mar 2020 — Present
- Lead a team of eight analysts in a 24/7 security operations center supporting a federal agency, setting triage standards, escalation paths and training plans.
- Built a detection engineering process with version-controlled Splunk rules, peer review and test cases, raising true positive rates across major alert types.
- Led response to a targeted intrusion attempt on a public-facing application, containing access within hours and supporting the agency's required reporting.
- Automated common enrichment and containment steps in SOAR, letting tier 1 analysts close routine alerts faster and focus on investigations.
Cybersecurity Analyst, Chesapeake Defense Solutions · Columbia, MD · Jul 2016 — Feb 2020
- Hunted for threats in network and endpoint data using Zeek and Elastic, documenting findings mapped to MITRE ATT&CK for defense customers.
- Supported assessments against NIST 800-53 and 800-171 controls, writing evidence and remediation plans for contract requirements.
- Mentored four junior analysts through their first incident investigations and certification exams.
Network Security Technician, Shenandoah Federal IT Services · Herndon, VA · Jun 2012 — Jun 2016
- Monitored intrusion detection systems and firewall logs for a government customer network, escalating events according to defined procedures.
- Maintained network security documentation and supported annual security inspections and audits for the customer agency.
Education
BS, Cybersecurity and Information Assurance, Commonwealth Online University (2016)
Certifications
CISSP · GIAC Certified Intrusion Analyst (GCIA) · CompTIA Security+
Skills
Detection engineering, Threat hunting, Incident response leadership, Splunk Enterprise Security, Elastic, Network forensics, Zeek, MITRE ATT&CK, NIST 800-53, SOAR, Python, Analyst mentoring
Tailor this resume to a job in 30 seconds
Paste a real cybersecurity analyst posting and AutoApplyMax rewrites your own resume for it: same facts, reordered and rephrased around what that employer asks for. The free plan includes 1 tailored resume a month.
How to write each section of a cybersecurity analyst resume
Header, clearance and certifications
List name, city, email, phone and LinkedIn. If you hold a security clearance, state the level and status, such as Active TS/SCI or Government of Canada Secret, near the top or in the summary, because many postings require it before review. Never include clearance investigation details or classified program names.
Put key certifications after your name or in a line under the header if they are required in your target postings, such as Security+ for many US Department of Defense roles.
Summary
State your years of experience, your focus area (SOC monitoring, incident response, vulnerability management, governance and risk, cloud security) and the industries you know. Security analyst titles cover very different jobs, so be explicit.
Mention shift availability if you are applying to SOC roles, and the main tools you use daily. Add a clearance or key certification here if it is a hard requirement in the posting.
Experience
Write bullets about investigations, detections, hunts, remediation and improvements, with volume and outcomes. Good measures include alerts handled, mean time to respond, detections written, vulnerabilities remediated and incidents contained.
Keep sensitive details general. Do not name breached clients, internal hostnames or specific weaknesses that are still open. Describe the attack type and your response instead; careful wording shows the discretion employers need.
Skills
Group skills into SIEM and analytics, endpoint and network tools, cloud and identity, frameworks, and scripting. Name query languages such as SPL or KQL, since they show hands-on use of a platform rather than passing familiarity.
Include frameworks you have applied, such as MITRE ATT&CK, NIST CSF, NIST 800-53 or ISO 27001, and explain one of them in a bullet.
Education, training and labs
List degrees in cybersecurity, IT or computer science, plus military training if relevant. Career changers and new graduates should add a home lab or capture-the-flag section with specific skills learned, such as building detections or analyzing packet captures.
Certifications deserve their own section with issuer and status. Keep expired certifications off unless you are renewing them, and show planned exams as in progress with a target month.
Cybersecurity Analyst resume summary examples
Entry-level objective: IT support technician seeking a tier 1 SOC analyst role in a team that values documentation and learning. Brings two years of account and endpoint support, Security+ certification and a home lab with simulated attacks and custom detections.
It connects support work to security and offers proof of hands-on interest beyond a certificate.
New-grad summary: Cybersecurity graduate with a SOC internship triaging phishing and endpoint alerts in Splunk and CrowdStrike. Comfortable reading logs, mapping activity to MITRE ATT&CK and writing clear escalation notes. Security+ certified and available for shift work.
It lists tools, frameworks and availability, which are practical concerns for SOC hiring managers.
Mid-level summary: Cybersecurity analyst with six years in financial services incident response. Leads investigations from alert to lessons learned, writes KQL detections for identity and cloud attacks and runs threat hunts. GIAC GCIH certified, bilingual English and French, with Government of Canada Secret clearance.
Specialty, industry, technical depth and screening credentials appear together, matching what mid-level postings filter for.
Senior summary: Detection engineering lead with 12 years defending federal and defense networks. Leads 24/7 analyst teams, builds tested detection pipelines and SOAR automation, and aligns operations to NIST requirements. CISSP certified with an active TS/SCI clearance.
Leadership, program building and the clearance appear immediately, which saves a federal recruiter from searching the page.
Cybersecurity Analyst resume bullet examples: weak vs strong
The strong versions use made-up figures for a fictional candidate. Replace them with your own real numbers, or describe the scope (team size, volume, frequency) if you have none.
Volume, scope and documentation habits show a reliable analyst, not just someone watching a screen.
Shows the incident type, speed and the cross-team coordination real response requires.
Specific platform, language, count and quality control prove depth in detection work.
A hunt matters when it finds something and leads to a fix, and this bullet shows both.
Scanning is easy; the strong version shows follow-through to remediation, which is the real job.
Shows coding ability applied to a team-wide problem, a strong sign for growth into engineering.
Names the frameworks and your exact contribution instead of vague involvement in compliance.
Leadership in a SOC is about consistency across shifts, and this bullet shows the mechanisms used.
Keywords from live cybersecurity analyst job postings
We read 55 live cybersecurity analyst postings (18 US and 37 Canadian) from our job feed on October 14, 2026 and counted how many mention each skill, tool or credential. A posting counts once per term, wherever it appears in the title or description. Use the list to check your resume for gaps that are real for you, not as a checklist.
| Keyword | Postings | |
|---|---|---|
| Vulnerability management | 39 of 55 (71%) | |
| Incident response | 38 of 55 (69%) | |
| Compliance (HIPAA, PCI, other) | 37 of 55 (67%) | |
| SIEM | 29 of 55 (53%) | |
| Cloud security | 26 of 55 (47%) | |
| CISSP | 25 of 55 (45%) | |
| GIAC certification | 22 of 55 (40%) | |
| NIST frameworks | 21 of 55 (38%) | |
| Threat intelligence | 20 of 55 (36%) | |
| Firewalls | 20 of 55 (36%) | |
| EDR | 18 of 55 (33%) | |
| Security awareness | 18 of 55 (33%) | |
| Security+ | 18 of 55 (33%) | |
| Risk assessment | 17 of 55 (31%) | |
| IDS / IPS | 16 of 55 (29%) | |
| Identity and access management | 16 of 55 (29%) | |
| Digital forensics | 15 of 55 (27%) | |
| Python / scripting | 15 of 55 (27%) | |
| 24/7 / shift work | 13 of 55 (24%) | |
| Security clearance | 12 of 55 (22%) | |
| ISO 27001 | 10 of 55 (18%) | |
| Network security | 10 of 55 (18%) |
Source: 55 unique postings whose title matches the role, from the WhatJobs publisher feed (US and Canada), collected October 14, 2026. Duplicate reposts were counted once. Counts change daily; a term not listed may still matter for a specific employer.
Skills for a cybersecurity analyst resume
Detection and monitoring
- Splunk (SPL)
- Microsoft Sentinel (KQL)
- QRadar
- Elastic
- CrowdStrike Falcon
- Microsoft Defender
Name the SIEM and EDR you used, with the query language, to prove real depth.
Response and analysis
- Incident response
- Threat hunting
- Digital forensics
- Malware triage
- Phishing analysis
- Packet analysis
Pair each with an investigation outcome in your experience bullets.
Risk and frameworks
- MITRE ATT&CK
- NIST CSF
- NIST 800-53
- ISO 27001
- Vulnerability management
- Risk assessment
Governance roles weigh frameworks heavily; operations roles weigh ATT&CK and tools.
Infrastructure and scripting
- Windows and Active Directory
- Linux
- TCP/IP and firewalls
- Azure and AWS security
- Python
- PowerShell
Understanding the systems you defend is what lets analysts separate real threats from noise.
Soft skills, and how to prove them
- Clear writing: Mention incident reports, executive summaries or escalation notes you wrote and who relied on them.
- Judgment under pressure: Describe an incident where you decided what to contain first and how that choice limited damage.
- Curiosity: Show a hunt, lab project or investigation where you followed an unusual signal and found something others missed.
- Collaboration: Give an example of working with IT, legal or developers to fix a root cause rather than closing a ticket.
- Discretion: Describe sensitive investigations in general terms on the resume itself, showing you protect confidential information.
Certifications and licenses
- CompTIA Security+ (CompTIA): A common entry-level requirement and an approved baseline certification for many US Department of Defense cybersecurity positions.
- CompTIA Cybersecurity Analyst (CySA+) (CompTIA): Focuses on detection, analysis and response, which fits SOC and analyst roles well.
- GIAC Certified Incident Handler (GCIH) (GIAC): Well respected for incident response; GIAC also offers GCIA for intrusion analysis.
- Certified Information Systems Security Professional (CISSP) (ISC2): Aimed at experienced professionals and requires several years of paid security work; valued for senior and leadership roles.
- Certified in Cybersecurity (CC) (ISC2): An entry-level credential for people starting out, useful alongside a home lab and IT experience.
Looking for low-cost options? See our list of free certifications in this field.
US vs Canada: cybersecurity analyst resumes and pay
United States
In the US, many cybersecurity analyst jobs with federal agencies and defense contractors require US citizenship and a clearance, such as Secret or TS/SCI, and some require a polygraph. The Department of Defense ties many security roles to approved baseline certifications under its workforce framework, which is why Security+ appears in so many postings. Private sector roles often mention HIPAA, PCI DSS or SOC 2. State an active clearance clearly, and leave out photo, age and marital status.
| BLS occupation | 10th pct. | Median | 90th pct. |
|---|---|---|---|
| Information Security Analysts (SOC 15-1212) | $75,090 | $129,180 | $199,850 |
Annual wages, US national, BLS Occupational Employment and Wage Statistics, May 2025.
Canada
In Canada, federal government and defense work requires security screening through the Government of Canada, at levels such as Reliability, Secret or Top Secret, and some roles require citizenship. Government guidance from the Canadian Centre for Cyber Security is a common reference alongside NIST. Banks and insurers are major employers in Toronto and often ask for incident response and cloud experience. Federal positions in the National Capital Region may require bilingual English and French. Privacy law varies, with PIPEDA federally and stricter rules in Quebec.
| Job Bank occupation | Low | Median | High |
|---|---|---|---|
| Cybersecurity Analyst (NOC 21220) | $30.00/h | $49.52/h | $72.12/h |
Canada-wide wages in CAD, Job Bank (Government of Canada), reference period 2023-2024. Provincial figures differ; follow the link for your province.
Check your cybersecurity analyst resume before you apply
The free ATS checker compares your resume with a real job description and lists the keywords you are missing. No signup needed for the scan.
FAQ
Which certification is best for an entry-level cybersecurity analyst?
CompTIA Security+ is the most common starting point, especially for US government and defense work. CySA+ adds analyst-specific skills, and ISC2 Certified in Cybersecurity is another entry option. Pair any certification with hands-on proof, such as a home lab, capture-the-flag results or IT support experience.
Should I list my security clearance on my resume?
Yes. State the level and whether it is active, current or inactive, for example Active TS/SCI. Put it near the top for government and contractor roles. Never list classified program names, investigation details or anything about the systems you accessed. If you have no clearance, simply leave it out.
How do I get into cybersecurity from IT support?
Show security-related tasks from your support role, such as account security, phishing reports and patching. Earn Security+ and build a lab where you write detections. Apply to tier 1 SOC roles, which often value support experience because analysts must understand how users and systems behave.
Can I mention specific incidents on my resume?
Describe them in general terms: attack type, your role, actions taken and outcome. Do not name affected clients, attackers' targets or weaknesses that may still exist. Interviewers will ask for detail, and you can share appropriate context there without breaking confidentiality agreements.
Does a cybersecurity analyst need to know coding?
Not always, but scripting helps a lot. Python and PowerShell let you automate enrichment, parse logs and build simple tools. Query languages like SPL and KQL are essential in most SOC roles. Show coding through a bullet about a script or detection that saved the team time.