Security Analyst Resume Examples: the lines they read
Write a Security Analyst Resume Built on Alerts and Outcomes
By Mustafa Tarabya, founder of CVBooster · Published · Updated
A security analyst resume that shows alert volume, SIEM tooling, detection work and incident handling, with a sample resume and a writing guide.
Sample resumes for a security analyst
The same security analyst content laid out in three CVBooster templates, so you can see what the finished document looks like before you write a word.
Example Security Analyst summary
Security analyst with five years in bank and managed service security operations centers. Triages roughly two hundred fifty alerts a week across Splunk, Microsoft Sentinel and CrowdStrike, and writes detection logic in both query languages instead of waiting on vendor rules. Cut false positives by 46% through rule tuning while extending ATT&CK coverage, and led containment on a business email compromise within twenty-five minutes of the first alert.
Skills to list on a Security Analyst resume
- Splunk
- Microsoft Sentinel
- SIEM tuning
- Endpoint detection and response
- MITRE ATT&CK
- Incident response
- Phishing and email analysis
- Malware triage
- Threat intelligence
- Vulnerability management
- KQL and SPL query writing
- Log source onboarding
- Network traffic analysis
- Playbook automation
- Security awareness reporting
What actually gets this resume read
- State your alert volume and tier, because a triage analyst and a detection engineer are read against different bars.
- Name the SIEM and endpoint tools you have used daily, and mention the query language you write in for each.
- Show detection work with counts: rules written, rules tuned, techniques covered or false positives removed.
- Describe one incident from alert to containment, with the clock times that show how fast you moved.
- Map your experience to a public framework such as MITRE ATT&CK or the NIST incident handling stages so scope is legible.
- Include automation you built in the platform, since analysts who reduce manual triage time are the ones who get promoted.
How to write a security analyst resume
A security analyst resume is read by a security operations manager who has a queue problem. They need someone who can work a shift, judge an alert quickly, escalate the right ones, and eventually make the queue smaller. So the two things they look for are volume you have handled and evidence that you improved the signal rather than only absorbing it.
Tooling matters, but not as a list. Naming a platform means little; naming the query language you write in it means a lot, because that is the difference between clicking through a console and building detection. The same applies to frameworks: mapping your work to recognized technique coverage shows you think in adversary behavior rather than in individual alerts.
What follows is the structure that fits this role, three summaries across career stages, before and after bullets drawn from the phrasing analysts use by default, and answers to the questions people ask when they move into security operations from help desk, network or systems work.
Format: one page for the first few years, tools block high
Reverse-chronological and plain. Put a short tools block under the summary covering the platform, the endpoint tooling, the query languages and the frameworks you work against. Recruiters filter on platform names, and technical interviewers read the query languages.
Do not scatter tool names through paragraphs. A grouped block is quicker to scan and leaves your bullets free to carry outcomes instead of product names.
- Header: name, title, location, email, and current credentials on a single line.
- Order: summary, tools and frameworks, experience, certifications, education.
- Say your tier and shift pattern, because that sets the expectation for the rest of the page.
Summary: volume, tier, and what you tune
State the environment, the alert volume you handle and the level you work at, then add the improvement work you do beyond triage. An analyst who triages a few hundred alerts a week and writes their own detection logic is a different hire from one who only closes tickets, and one sentence can make that clear.
If you have led an incident rather than only supporting one, say so here. Containment ownership is the strongest single line an analyst can put on a resume.
Experience: triage, detection, incidents, automation
Open each role with the environment: number of client or business environments, log sources, endpoints, and the shift model. Then cover four areas. Alert volume and how you triage. Detection work you authored or tuned. An incident you helped contain, with times. Automation that reduced manual handling.
Detection engineering is where analysts differentiate themselves. Give counts: rules written, rules tuned, rules retired, techniques newly covered, false positives removed. Those numbers are unglamorous and extremely persuasive because most candidates cannot produce them.
For the incident bullet, use the clock. Time from first alert to containment, the accounts or hosts isolated, and the artifact you produced afterward. Managers read timing as competence under pressure.
- Environment: log sources, endpoints, monitored environments, shift pattern.
- Detection: rules authored and tuned, and the change in false positive load.
- Incidents: type handled, containment actions, and time to containment.
Frameworks: give the reader a map
Anchor your experience to something public. MITRE ATT&CK for technique coverage and threat hunting, and the NIST incident handling stages for response process, are the two most commonly referenced. Mapping detection work to techniques shows you can talk about coverage gaps rather than alert counts alone.
If you have worked under a compliance regime, name the control area you supported: log retention, access review evidence, vulnerability remediation deadlines. Regulated employers hire heavily for analysts who already understand those obligations.
Keywords that recur in security operations postings
The vocabulary is stable across postings: triage, escalation, endpoint detection and response, threat hunting, phishing analysis, malware triage, indicators of compromise, threat intelligence, vulnerability management, log source onboarding, playbook automation and incident response. Mirror the posting wording once in the tools block and once inside a bullet backed by a number.
Security Analyst resume summary examples
First security role
Service desk technician moving into security operations, with a year of endpoint and account investigation support alongside the security team. Comfortable reading authentication logs, writing basic queries and documenting timelines. Holds a foundational security credential and is seeking a tier one analyst position on a monitored rotation.
Three years in
Security analyst triaging around 250 alerts a week across a SIEM and endpoint detection platform for a mid-size bank. Writes and tunes detection rules in both query languages, tuned 70 noisy rules and cut false positives by 46%, and leads containment on phishing and credential abuse cases.
Senior analyst
Senior security analyst with seven years across managed service and in-house operations centers. Owns detection engineering and technique coverage, mentors tier one analysts, and led containment on a business email compromise within 25 minutes of first alert. Builds playbook automation that halves average handling time.
Work experience bullets: before and after
Before: Monitored security alerts and escalated incidents.
After: Triaged around 250 alerts a week across the SIEM, endpoint platform and mail security, escalating confirmed incidents with a written timeline and evidence set.
Volume and the escalation artifact show both throughput and the quality of what you hand over.
Before: Tuned detection rules to reduce noise.
After: Tuned 70 detection rules and retired 18 obsolete ones, cutting false positives by 46% while adding coverage for eight previously unmonitored techniques.
Counts on both sides prove you reduced noise without quietly reducing coverage.
Before: Responded to a phishing incident.
After: Led containment on a business email compromise, isolating four accounts, revoking active tokens and blocking the forwarding rule within 25 minutes of first alert.
Specific containment actions and the elapsed time demonstrate command of a live incident.
Before: Helped automate SOC processes.
After: Built a phishing triage playbook with automated enrichment and sandbox detonation, reducing average handling time per report from 22 minutes to 6.
The automation is described by what it does and by the handling time it removed from the shift.
Before: Maintained log sources for the security team.
After: Audited the asset and log source inventory, closing gaps that had left nine production servers outside the logging pipeline entirely.
A named gap and the number of blind spots closed turns housekeeping into risk reduction.
Hard skills
- SIEM administration and tuning
- Splunk and search processing language
- Microsoft Sentinel and Kusto queries
- Endpoint detection and response platforms
- MITRE ATT&CK technique mapping
- Incident response and containment
- Phishing and email header analysis
- Malware triage and sandboxing
- Threat intelligence and indicator management
- Vulnerability management
- Network traffic and flow analysis
- Log source onboarding
- Playbook and response automation
- Windows and Linux event analysis
Soft skills
- Judgment under alert pressure
- Precise incident timelines
- Handover discipline across shifts
- Briefing non-technical stakeholders
- Curiosity in threat hunting
- Discretion with sensitive findings
Certifications worth listing
- CompTIA Security+ (CompTIA)
- CompTIA CySA+ (CompTIA)
- GIAC Certified Incident Handler (GCIH) (GIAC)
- GIAC Security Essentials (GSEC) (GIAC)
- Microsoft Certified: Security Operations Analyst Associate (Microsoft)
Mistakes that cost security analyst candidates the interview
- Naming platforms without naming the query language, which leaves it unclear whether you build detection or only read dashboards.
- Omitting alert volume, so a manager cannot tell whether you worked a busy queue or a quiet one.
- Describing incidents without times, when speed to containment is the metric operations leaders care about most.
- Claiming threat hunting with no hypothesis, data source or outcome attached to the claim.
- Listing every acronym in the field instead of the handful of tools and frameworks you use every shift.
- Ignoring tuning and automation work, which is what turns a capable analyst into a promotable one.
Security Analyst resume questions
How do I move from help desk into a security analyst role?
Bridge with the work you already do. Account lockouts, malware cleanups, phishing reports and access reviews all touch security, so describe them in security language, add a foundational credential, and practice query writing in a free lab environment you can point to.
Which certification helps most for a first analyst job?
A foundational vendor-neutral credential clears the largest number of filters, and an analyst-focused one is the natural follow-up. Beyond screening, the value is the shared vocabulary, since interviews often start with terminology before moving to a scenario walkthrough.
Should I list the SIEM I used if the employer runs a different one?
Yes. Query syntax differs but the discipline transfers, and hiring managers know it. Name your platform, name the query language you write, and add one line showing you have onboarded log sources or built content rather than only consuming vendor rules.
How do I write about incidents without disclosing sensitive detail?
Describe the incident class, the containment actions and the timing, and leave out the victim, the specific indicators and any internal system names. Business email compromise contained in under half an hour is informative and discloses nothing an employer would object to.
What separates a tier one analyst resume from a tier two one?
Ownership of outcomes. Tier one resumes describe triage volume and escalation quality. Tier two resumes add detection authored, rules tuned, investigations led end to end, automation built and coverage gaps closed, which is the work that makes the queue smaller over time.
Related resume examples
- Cybersecurity Analyst Resume example
- Cloud Security Engineer Resume example
- Penetration Tester Resume example
- System Administrator Resume example
- SOC Analyst Resume example
- Cybersecurity Manager Resume example