TechnologyMid level

Cybersecurity Analyst CV Example

Detection tuned, response times cut and audits passed — security work stated without theatrics.

Security CVs face a special credibility problem: everything sounds either classified or exaggerated. The fix is operational numbers — alerts triaged, response times, audit outcomes — plus one well-anonymised incident handled end to end. This example shows the pattern.

Why this CV works

Alert volumes and response times turn invisible vigilance into measurable operations.
One anonymised incident, told with containment time and outcome, proves capability without breaching confidence.
Detection tuning framed both ways (fewer false positives *and* better catches) pre-empts the obvious objection.
Audit results and patch SLAs show the governance half of security, which most analyst CVs skip.

The professional summary

Cybersecurity Analyst with 5 years in SOC and security operations for banking and retail. Tuned SIEM detection to cut false positives 63% while raising true-positive catch rate, brought mean time-to-respond from 4.2 hours to 55 minutes, and ran point on a business-email-compromise case contained with zero financial loss. ISO 27001 audit passed with no majors, two cycles running.

Lead with your environment's scale, your response-time story and one contained incident. Restraint reads senior in security — no "cyber warrior" language.

Writing the work experience

Balance the four quadrants: detection (tuning), response (times, playbooks), prevention (vulns, training) and governance (audits). One quantified bullet each covers the whole role.

Turning duties into achievements

Instead ofMonitored security alerts

WriteRetuned SIEM correlation rules, cutting false positives 63% while raising true-positive catches

Instead ofResponded to security incidents

WriteContained a business-email-compromise in 40 minutes with a blocked fraudulent transfer and zero loss

Skills on this CV

SIEM (Splunk, Sentinel)Incident responseThreat huntingVulnerability management (Qualys)Phishing analysisEDR (CrowdStrike)ISO 27001NIST frameworkSecurity awareness trainingLog analysisPython scriptingMITRE ATT&CK

ATS tips for Cybersecurity Analysts

Name your SIEM and EDR products exactly (Splunk, Sentinel, CrowdStrike) — security ads are tool-filtered.
Include "incident response" and "SOC" verbatim; both are near-universal filters.
Write "ISO 27001" and "NIST" as standalone entries — compliance keywords are hard filters in regulated sectors.

ATS checks help identify potential compatibility issues, but employers and ATS platforms use different criteria — no template or score can guarantee an outcome.

Writing tips

Anonymise incidents by type and outcome, never by victim — "a BEC case, contained in 40 minutes" is safe and strong.
Time is your best metric: detection to containment, alert to response.
Show the boring half (patching, audits) — it is what regulated employers actually run on.