Cyber Security Analyst CV Examples & Writing Guide

This sample is for an analyst who came up through the IT service desk, spent two years in a managed security provider's SOC and now works in-house at an NHS trust. The name, employers and university are made up. Entry-level and career-change versions are further down; the layout stays the same, the scale changes.

Security analyst adverts get hundreds of applicants, many of them career changers with a certificate and no hands-on time. SOC managers look for four things to separate people who have done the job from people who have read about it.

• Named tools with evidence of use. Not "SIEM" but "Splunk Enterprise Security" or "Microsoft Sentinel (KQL)"; not "EDR" but "CrowdStrike Falcon". Then a bullet that shows you used it: alerts triaged, searches written, hosts isolated.
• Incident handling you can tell as a story. One or two real incidents (phishing that led to a mailbox rule, malware on a workstation, a compromised service account) with what you found, what you did and how long it took. Interviewers will ask; the CV should promise the story.
• Certifications and clearance that match the level. Security+ is the floor for most analyst roles. CySA+, GCIH, GCIA, SC-200, Cisco CyberOps Associate or a CREST intrusion analyst exam show SOC depth. For government, defence and many MSSP roles, active SC clearance (or eligibility for it) matters too. CISSP on an entry-level CV raises eyebrows unless you have the 5 years it requires.
• Fundamentals. Networking (TCP/IP, DNS, how a packet moves), Windows and Linux logs, Active Directory basics and some scripting. Managers test these in the interview, so a CV that shows them (service desk, systems administration, home lab, a networking cert) gets the call.

“Show me the SIEM you used, how many alerts you cleared on a bad day, and one incident you owned end to end. Candidates who list twelve frameworks and no incidents have usually never sat a shift.”

Three to four lines under the header. Level and years first, then environment (SOC, in-house, MSSP), then tools, then one result and your certifications.

Career objective or personal statement? Use a personal statement in every case. Even with no paid experience, the graduate example above says what you have done (placement, labs, detections written) rather than what you hope for.

Each bullet needs the tool, the volume and the outcome. Six lines that appear on hundreds of analyst CVs, rewritten with the detail a SOC manager wants. Change the figures to yours.

Group the skills section by category and keep it to 12 to 16 entries. Recruiters search applicant tracking systems for tool names, so spell them the vendor's way. List only what you have touched.

• SIEM and log platforms: Splunk Enterprise Security, Microsoft Sentinel, IBM QRadar, Elastic Security, Google SecOps (Chronicle), Sumo Logic, Wazuh (open source)
• Endpoint detection and response: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black, Palo Alto Cortex XDR
• Vulnerability management: Tenable Nessus and Tenable.io, Qualys, Rapid7 InsightVM, CISA KEV prioritisation
• Network and perimeter: Palo Alto, Fortinet, Cisco ASA, Zscaler, Wireshark, Zeek, Suricata, Snort
• Email and identity security: Proofpoint, Mimecast, Microsoft Defender for Office 365, Okta, Entra ID (formerly Azure AD), MFA and conditional access
• Automation and scripting: Python, PowerShell, Bash, KQL, SPL, regular expressions, Splunk SOAR, Palo Alto Cortex XSOAR, Tines
• Threat intelligence and analysis: MITRE ATT&CK, VirusTotal, AbuseIPDB, MISP, Shodan, basic malware triage in a sandbox (Any.Run, Joe Sandbox)
• Frameworks and regulations: NIST CSF 2.0, NIST SP 800-61, CIS Controls, ISO/IEC 27001, NCSC Cyber Assessment Framework, Cyber Essentials and Cyber Essentials Plus, PCI DSS, UK GDPR breach handling (72-hour reporting to the ICO), NIS Regulations and NHS DSPT if you have worked under them
• Fundamentals: TCP/IP and DNS, Windows Event Logs and Sysmon, Linux auth and syslog, Active Directory, cloud logging (AWS CloudTrail, Azure Activity Log, GCP audit logs)

Soft skills matter in a SOC but do not list them as words. Show them: "wrote incident reports read by the CISO", "trained 4 new tier 1 analysts". Clear writing under time pressure is the skill managers complain about most.

No licence is required to work as a cyber security analyst in the UK, so certifications are how employers check your baseline. The UK Cyber Security Council's professional titles (Associate, Principal, Chartered) are growing but not yet expected at analyst level. List certifications in a separate Certifications section with the year, most recent first, and add the ones you are studying for with the booked exam date.

• CompTIA Security+: the baseline. Most analyst adverts list it as required or preferred, including many MSSP, public sector and defence supplier roles. If you have nothing else, get this.
• CompTIA CySA+ and CREST analyst exams: CySA+ is the SOC-specific step up (log analysis, threat detection, incident response). CREST's intrusion analyst exams (Practitioner, then Registered) are well known among UK MSSPs and CREST member companies.
• GIAC GCIH (incident handling), GCIA (intrusion analysis), GSEC (fundamentals): expensive, employer-funded in most cases, and strongly respected by SOC managers.
• Microsoft SC-200 (Security Operations Analyst): valuable where the stack is Sentinel and Defender, which covers much of the UK public sector, including the NHS, and many large companies. Splunk Core Certified User or Power User does the same for Splunk shops.
• ISC2 Certified in Cybersecurity (CC): an entry-level certificate and a reasonable first line for students. ISC2 closed new sign-ups for its free exam offer in May 2026, so budget for the exam fee and the annual maintenance fee. ISC2 SSCP sits one step above.
• CISSP: requires 5 years of paid experience (4 with a relevant degree). Do not list it as "in progress" on an entry-level CV. If you passed the exam without the experience, you are an "Associate of ISC2", and that is the correct wording.
• Security clearance: if you hold active or recently lapsed UK clearance (BPSS, SC, DV), put it in the header line. You cannot apply for clearance yourself; an employer sponsors it, which is why "SC cleared" is one of the most searched terms for government and defence supplier roles.

"No experience" in security rarely means no relevant experience. Service desk, systems administration, networking and Armed Forces communications roles all contain security work if you pull it out. What you cannot skip is hands-on evidence: a SOC manager needs to see that you have looked at logs and alerts, even in a lab.

1. 1Certifications and education at the top: Security+ (or the exam date), ISC2 CC, any networking cert (CompTIA Network+, CCNA), your degree, apprenticeship or Skills Bootcamp. Add relevant modules only if you have no certifications yet.
2. 2A Projects or Home Lab section written like a job, with numbers: "Built a SOC lab on Proxmox with Wazuh SIEM, Sysmon on 3 Windows VMs and Suricata; wrote 20 detection rules mapped to MITRE ATT&CK and documented 6 simulated attacks on GitHub." Link the GitHub repository in your header.
3. 3Platforms and hours, honestly: TryHackMe SOC Level 1 path completed, LetsDefend 40 alerts investigated, Blue Team Labs Online, HackTheBox Sherlocks, CyberDefenders challenges, a university CTF placement. Managers know these names and the effort each represents.
4. 4Your current or past job, with the security parts pulled forward: phishing tickets handled, MFA or patch rollouts, AD account audits, firewall change requests, incident write-ups, anything with logs.
5. 5Placements, apprenticeships and volunteer work: a 3-month SOC placement is worth more than any certificate; put it under Experience with alert counts. Volunteer security work for a charity (MFA rollout, a phishing test, Cyber Essentials preparation) counts too.

• Length: two pages for most analysts; one page is enough at entry level. Senior analysts, incident responders and anyone with a long list of engagements or a clearance history use two full pages.
• Order for experienced analysts: header (with clearance if any), personal statement, experience, skills grouped by category, certifications, education. Entry level: header, personal statement, certifications, projects or lab, experience, education.
• Layout: single column, plain headings, standard fonts. Large companies, MSSPs and government suppliers use applicant tracking systems that read text only. A dark technical template such as cvplex cyber-security is fine as long as it stays single column and text-based. No photo and no date of birth on a UK CV; state your right to work and clearance level instead if relevant.
• Mirror the advert's exact tool and framework names when they are true for you: SIEM, EDR, incident response, threat hunting, vulnerability management, MITRE ATT&CK, NIST, ISO 27001, Cyber Essentials, NCSC CAF, UK GDPR, PCI DSS, Splunk, Sentinel, CrowdStrike, KQL, Python. The ATS matches strings, not synonyms.