What should I put on an entry-level cyber security resume?

Certifications (Security+ is the common first one), a home lab or two described as projects, CTF results, relevant coursework, and any IT or help-desk experience, with bullets about the security parts of that work.

What skills are good for a cyber security resume?

SIEM and EDR tools, incident response, vulnerability management, network fundamentals, cloud security, scripting in Python or PowerShell, and frameworks like NIST or MITRE ATT&CK. List only what you've used.

Where do certifications go on a security resume?

In their own section near the top, with the issuing body and year. Security hiring filters on certifications more than most tech fields.

What are the best keywords for a cyber security resume?

Use the job post's terms: commonly SIEM, incident response, threat detection, vulnerability assessment, SOC, IAM, cloud security, and the specific tools named.

How to write a cyber security resume

By Mubeen Jawed, founder of ResumeForDev · Updated November 7, 2026

Short answer

A cyber security resume should show the threats you detected, the risks you reduced and the systems you protected, with numbers where you have them: alerts triaged, mean time to respond, vulnerabilities remediated, audit findings closed. Name your tools (Splunk, CrowdStrike, Burp Suite, AWS Security Hub), list certifications like Security+ or OSCP with the year, and for entry-level roles lead with labs, CTFs and home-lab projects.

Key points

Quantify detection and response: alerts, MTTR, incidents handled.
Certifications matter more in security than most tech fields. List them clearly.
Entry level: home labs, CTF rankings and write-ups count as experience.
Don't disclose confidential incident details. Describe the type and scale instead.

Analyst, engineer or entry level

A SOC or cyber security analyst resume centres on detection and response: monitoring, triage, investigation and escalation. A security engineer resume centres on building controls: hardening, cloud security, IAM, automation. Application security roles need code and secure-SDLC work. Match the first two bullets of each job to the side the posting emphasises.

Before and after

Before:Monitored security alerts and responded to incidents.

After:Triaged ~150 SIEM alerts a day in Splunk for a 4,000-employee company, cut false positives 40% by tuning 25 detection rules, and led response on 12 confirmed phishing incidents.

Security metrics for a resume

Numbers that work on a cyber security resume
Area	Example phrasing
Detection	tuned 25 detection rules, cutting false positives 40%
Response	reduced mean time to respond from 6 hours to 90 minutes
Vulnerabilities	remediated 300+ critical and high CVEs across 900 hosts
Compliance	closed all 14 findings for the SOC 2 Type II audit
Identity	rolled out MFA to 2,500 users with under 1% help-desk escalations
Training	ran phishing simulations that cut click rate from 18% to 5%

Example cyber security bullets

Built automated enrichment for phishing reports in Python and the SOAR platform, saving analysts about 10 minutes per ticket.
Ran authenticated vulnerability scans with Nessus across 900 servers and drove patching with owners, clearing the critical backlog in 6 weeks.
Hardened AWS accounts with SCPs, GuardDuty and Security Hub, bringing CIS benchmark compliance from 61% to 94%.
Performed web application penetration tests with Burp Suite on 8 internal apps, finding 2 critical auth bypasses fixed before launch.
Wrote incident response playbooks for ransomware and account takeover, used in 2 tabletop exercises with IT and legal.

Cyber security skills and certifications

Detection and response: SIEM (Splunk, Microsoft Sentinel), EDR (CrowdStrike, Defender), SOAR, incident response
Offensive and AppSec: Burp Suite, Nmap, Metasploit, OWASP Top 10, threat modeling
Cloud and identity: AWS or Azure security, IAM, Okta, zero trust
Frameworks: NIST CSF, MITRE ATT&CK, ISO 27001, SOC 2
Scripting: Python, PowerShell, Bash

Give certifications their own section near the top for security roles, with the issuer and year: CompTIA Security+, CySA+, CISSP, OSCP, AWS Security Specialty. See how to list certifications on a resume.

Entry-level cyber security resume

Hiring managers know entry-level candidates don't have incident history. They look for evidence you practise: a home lab (a SIEM ingesting your own logs, an Active Directory lab you attacked and defended), CTF placements, TryHackMe or Hack The Box progress, and short write-ups on a blog or GitHub. Put these in a Projects section with the same bullet format as a job.

On ResumeForDev, set your target role to “Security Engineer”. Without a job post, the keyword check falls back to a general software vocabulary, so for this role it's worth pasting the job description. Paste a job description and the keyword check uses that post's terms instead; on Pro, the writer also tailors the bullets to it. Before writing, it asks follow-up questions about the numbers above, and it removes any number or skill you never gave it. Your first resume is free.

Frequently asked questions

What should I put on an entry-level cyber security resume?: Certifications (Security+ is the common first one), a home lab or two described as projects, CTF results, relevant coursework, and any IT or help-desk experience, with bullets about the security parts of that work.
What skills are good for a cyber security resume?: SIEM and EDR tools, incident response, vulnerability management, network fundamentals, cloud security, scripting in Python or PowerShell, and frameworks like NIST or MITRE ATT&CK. List only what you've used.
Where do certifications go on a security resume?: In their own section near the top, with the issuing body and year. Security hiring filters on certifications more than most tech fields.
What are the best keywords for a cyber security resume?: Use the job post's terms: commonly SIEM, incident response, threat detection, vulnerability assessment, SOC, IAM, cloud security, and the specific tools named.