SOC Analyst Resume Examples: free ATS score and gap list
Write a SOC Analyst Resume That Proves You Can Triage
By Mustafa Tarabya, founder of CVBooster · Published · Updated
A SOC analyst resume example with SIEM keywords, alert triage bullets, tier-level tips and a full writing guide for security operations roles.
Sample resumes for a soc analyst
The same soc analyst content laid out in three CVBooster templates, so you can see what the finished document looks like before you write a word.
Example SOC Analyst summary
SOC analyst with four years on a follow-the-sun monitoring team, triaging 50 notables a shift in Splunk Enterprise Security and containing endpoints through CrowdStrike Falcon. Wrote 34 detection rules mapped to MITRE ATT&CK and led containment on a dozen business email compromise cases. GCIH certified and looking for a tier 3 detection engineering seat where I can own rule quality rather than queue depth.
Skills to list on a SOC Analyst resume
- SIEM monitoring
- Splunk Enterprise Security
- Microsoft Sentinel
- CrowdStrike Falcon
- MITRE ATT&CK mapping
- Alert triage
- Phishing analysis
- Malware analysis
- Incident response
- Log correlation
- Threat intelligence
- Network traffic analysis
- SOAR playbooks
- Python scripting
- Endpoint forensics
- Vulnerability management
What actually gets this resume read
- State your tier, the shift pattern you worked, and the alert volume you carried per shift near the top.
- Name the SIEM by product, not by category: Splunk Enterprise Security, Microsoft Sentinel, QRadar or Elastic Security.
- Map at least one bullet to MITRE ATT&CK so the hiring manager sees you speak the detection language.
- Show a full case you owned end to end: alert, investigation, containment, eradication, and what you wrote up afterward.
- Put Security+, GCIH or the CrowdStrike and Splunk product certifications in their own block above your work history.
- Include the EDR, the ticketing system and the case volume, because those three details set your resume apart from every generic security summary.
How to write a soc analyst resume
A SOC analyst resume is filtered on three things before anyone reads a sentence: the SIEM you have worked in, the tier you worked at, and whether you have carried a real queue on a real shift rotation. Security operations managers are staffing a roster, so they need to know how many alerts you can absorb in eight hours and how often you send a bad escalation upstairs.
The failure mode is a resume that lists security tools like a shopping cart and never shows a single case worked from alert to closure. Tool names get you past the keyword filter. The investigation you describe is what gets you the interview.
This guide covers the section order a SOC hiring manager expects, how to write alert triage without sounding like a job description, three example summaries from a first security job through to a detection engineering seat, and the questions analysts ask when they try to make queue work look like a career.
Format: one page, tools block high, cases underneath
Reverse chronological, one page for anything under seven years. Put a compact technical block directly under the summary listing the SIEM, the EDR, the ticketing platform and the enrichment sources you use daily. Security operations postings are written from a tool list, so the parser needs to find those product names in the top third of the page.
Do not use a two-column layout with icons for skill levels. A rating bar next to "Splunk" tells a SOC lead nothing, and column parsing frequently scrambles the dates on hospital and government applicant tracking systems.
- Header: name, city and state, phone, email, and your clearance status if you hold one.
- Order: summary, certifications, technical environment, experience, education.
- Anyone with under a year of paid security work adds a home lab or detection project section under education.
Summary: tier, shift, volume, and what you specialize in
Four lines maximum. Name the tier you worked at, the shift pattern, the alert volume per shift, the SIEM and EDR by product, and the one case type you are strongest on. A summary that begins with a passion for cybersecurity is indistinguishable from every other applicant who watched the same course.
If you are coming from help desk, systems administration or the military, say the move out loud and name the transferable half. Someone with three years of Windows administration moving into monitoring should say so, because knowing what normal looks like on an endpoint is exactly what triage rests on.
Experience: alerts triaged, cases owned, detections written
Give every job a scope line before the bullets: the environment size in endpoints or users, the industry, the coverage model, and where you sat in the escalation chain. "Tier 2 on a 24/7 rotation, nine thousand endpoints, financial services" answers half the interview before it starts.
Then split the bullets three ways. One or two on queue work with real volumes and a quality measure such as false escalation rate or dwell time. One or two on cases you owned end to end, naming the technique, the containment action and what you shut down. One on detection or automation work, because analysts who only close tickets are hired at the bottom of the band.
Cut every bullet that describes the job rather than your work. Monitoring alerts, following procedures and escalating as needed describe the entire profession and consume the space a real investigation needs.
- Name the technique or case type: credential stuffing, business email compromise, lateral movement, ransomware precursor.
- Say what you actually did to contain: host isolation, session revocation, blocking a sender, killing a token.
- Attach a measure to the queue: alerts per shift, escalation accuracy, or time from alert to first action.
Detections and MITRE ATT&CK: the section that separates the band
If you have written or tuned any detection logic, give it its own visible line. Say the language, the platform and the technique it maps to: a Sigma rule for suspicious parent process chains, a Sentinel analytics rule for impossible travel, a Splunk correlation search for service creation on domain controllers. Mapping to a specific ATT&CK technique identifier is stronger than the phrase "aligned to MITRE".
Tuning counts as detection work when you describe the outcome. Reducing a noisy rule from hundreds of daily notables to a handful, without losing the true positives, is one of the most valuable things a tier 2 analyst does and almost nobody writes it down.
Certifications and keywords the filter is scanning for
Put certifications in their own block near the top with the issuing body, since recruiters filter on the acronym. Security+ opens entry roles, GCIH and GCFA read as real incident response, and the vendor credentials from Splunk, Microsoft or CrowdStrike prove you have used the exact console the team runs.
Security operations postings recycle a narrow vocabulary: triage, containment, escalation, enrichment, indicators of compromise, threat intelligence, playbook, correlation search, endpoint detection and response. Mirror the exact product names from the posting once in the technical block and once inside a bullet where you did the work. A person reads this file right after the software does, so a keyword wall at the bottom hurts you.
SOC Analyst resume summary examples
First security job
Security+ certified analyst moving from three years of Windows endpoint support into monitoring. Built a home lab running Elastic Security with Sysmon telemetry and wrote 15 detection rules mapped to MITRE ATT&CK. Comfortable reading process trees, authentication logs and email headers. Seeking a tier 1 SOC seat on a rotating shift.
Three years on the queue
Tier 2 SOC analyst working a 24/7 rotation across 9,000 endpoints in financial services. Triages 50 Splunk notables a shift at a 4% false escalation rate, owns phishing and credential abuse cases through containment in CrowdStrike Falcon, and tuned three noisy rules down by two thirds without losing true positives.
Detection engineering lead
Senior SOC analyst and detection lead with eight years in security operations, currently owning rule quality for a Microsoft Sentinel deployment covering twenty two thousand identities. Wrote 60 analytics rules mapped to ATT&CK, cut alert volume by 40% while raising true positive rate, and runs the escalation review that coaches six tier 1 analysts.
Work experience bullets: before and after
Before: Monitored security alerts and escalated as needed.
After: Triaged 50 to 60 Splunk Enterprise Security notables per shift across nine thousand endpoints, escalating tier 2 cases with a documented timeline and a false escalation rate under 5%.
The volume, the platform and the escalation quality measure turn a duty statement into evidence you can carry a queue.
Before: Investigated phishing emails reported by users.
After: Worked reported phishing end to end: header and attachment analysis in a sandbox, indicator sweep across the mail gateway, sender block, and forced password reset for the four users who submitted credentials.
Naming each step shows a repeatable investigation method rather than a vague claim of having looked at email.
Before: Used EDR tools for incident response.
After: Contained twelve business email compromise cases by isolating hosts in CrowdStrike Falcon, revoking active sessions in Entra ID, and pulling the sign-in log timeline to confirm no mailbox rules survived cleanup.
The specific containment actions prove console-level ability, which a tool name on its own never does.
Before: Helped reduce false positives.
After: Rewrote a service creation detection to exclude three signed deployment agents, dropping the rule from 180 daily notables to 11 while keeping every previously confirmed true positive in a replay test.
The before and after counts plus the replay validation show tuning judgment instead of just muting noise.
Before: Created reports for management.
After: Produced the weekly operations summary covering case counts by ATT&CK tactic, median time to containment, and the two detection gaps that drove the next quarter of rule work.
Saying what the report contained and what it changed makes the reporting work look like influence, not admin.
Hard skills
- SIEM triage in Splunk Enterprise Security
- Microsoft Sentinel analytics rules
- IBM QRadar offense handling
- CrowdStrike Falcon endpoint containment
- MITRE ATT&CK technique mapping
- Phishing and email header analysis
- Malware sandbox analysis
- Network traffic analysis with Wireshark and Zeek
- Windows event log and Sysmon telemetry
- SOAR playbook building
- Threat intelligence enrichment
- Python and regular expressions for log parsing
- Identity and authentication log review
Soft skills
- Escalation judgment under time pressure
- Clear written case notes
- Handover discipline across shifts
- Curiosity that survives a quiet queue
- Coaching tier 1 analysts
- Calm communication during an active incident
Certifications worth listing
- CompTIA Security+ (CompTIA)
- CompTIA CySA+ (CompTIA)
- GIAC Certified Incident Handler (GCIH) (GIAC)
- GIAC Security Essentials (GSEC) (GIAC)
- Microsoft Certified: Security Operations Analyst Associate (SC-200) (Microsoft)
- Splunk Core Certified Power User (Splunk)
- Certified Information Systems Security Professional (CISSP) (ISC2)
Mistakes that cost soc analyst candidates the interview
- Listing every security tool ever opened without saying which console you sat in every day and at what tier.
- Writing the alert queue as a duty rather than a number, so the reader cannot tell a quiet queue from a busy one.
- Skipping containment actions, which leaves the reader guessing whether you had permission to act or only to watch.
- Claiming threat hunting when the work was closing assigned alerts. Hunting means a hypothesis, a data set and a result.
- Naming MITRE ATT&CK once as a buzzword instead of mapping a single case or detection to a specific technique.
- Burying a real incident response certification under a wall of course completion badges from video platforms.
- Sending the same file to a tier 1 monitoring posting and a detection engineering posting when the two want different first bullets.
SOC Analyst resume questions
How do I get a SOC analyst job with no security work history?
Build something reviewable and describe it like work. A home lab with Sysmon telemetry feeding a free SIEM, ten detection rules you wrote yourself, and short case write-ups give a hiring manager something concrete to ask about instead of a course list.
Should I put my home lab on a SOC analyst resume?
Yes while you have under two years of paid security experience. Give it a section with the stack, the telemetry sources, what you detected and what you learned. Remove it once real case work fills the page, because production volume outweighs a lab every time.
Which certification matters most for security operations?
Security+ clears the automated filter for entry roles and CySA+ or GCIH reads as genuine investigation ability at tier 2. Vendor credentials matter when the posting names that exact platform, because they prove console familiarity the team will not have to teach.
How do I show incident response experience without breaking confidentiality?
Describe the technique, your actions and the outcome, never the client name, the affected system name or the indicators themselves. Saying you contained a credential abuse case across a retail environment of eight thousand identities is specific and discloses nothing.
Is shift work worth mentioning on the resume?
Yes, because staffing a rotation is the hiring problem. Say whether you worked nights, weekends or a follow-the-sun handover model, and how many analysts covered each shift. Managers filter hard on candidates who have already proven they can hold a night rotation.
Related resume examples
- Cybersecurity Analyst Resume example
- Security Engineer Resume example
- Security Analyst Resume example
- IT Auditor Resume example
- Penetration Tester Resume example
- Cloud Security Engineer Resume example