Cybersecurity is one of the most certification-filtered disciplines in technology hiring. CompTIA Security+, CEH, CISSP, and OSCP function as pre-screening filters before a recruiter reads a single bullet — and a cybersecurity analyst CV that doesn't surface the right certification in the first five seconds of scanning often doesn't advance regardless of the experience underneath. The second structural problem is domain ambiguity: cybersecurity analyst covers four genuinely different roles — SOC/threat detection, vulnerability management, GRC and compliance, and penetration testing — and a CV that doesn't signal which domain the candidate operates in will confuse the hiring manager, who is almost always hiring for one specific type. The third failure is reactive-only evidence: a SOC analyst CV that shows only alert triage, with no evidence of detection rule creation, SIEM tuning, or threat hunting, positions the candidate as a consumer of security tooling rather than a contributor to it. This guide covers how to position a cybersecurity analyst CV correctly, which ATS keywords matter by domain, and how to write bullets that signal security depth.

What Cybersecurity Analyst Job Descriptions Require in 2026

Cybersecurity analyst JDs divide sharply by domain. Each domain uses different tooling, different certifications, and attracts different candidates. Identify your primary domain and structure your CV around it.

SOC Analyst / Threat Detection (most common analyst title): Alert triage, incident investigation, threat detection, and escalation. Primary tools: SIEM (Splunk, Microsoft Sentinel, IBM QRadar), EDR (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne), and threat intelligence platforms. MITRE ATT&CK framework knowledge is increasingly listed as required. CompTIA Security+ is the floor credential; CySA+, CEH, or GIAC certifications differentiate.

Vulnerability Management Analyst: Scanning, prioritisation, and remediation tracking. Primary tools: Tenable Nessus, Qualys, or Rapid7 InsightVM. Requires understanding of CVE/CVSS scoring and the ability to engage with system owners to drive remediation. Often closer to a project coordination role than a pure technical one.

GRC Analyst (Governance, Risk, Compliance): Risk assessments, policy development, audit support, and compliance framework management (ISO 27001, SOC 2, NIST CSF, Cyber Essentials). Less hands-on technical, more process and documentation. CISSP, CISM, or ISO 27001 Lead Implementer are the relevant credentials.

Penetration Tester / Ethical Hacker: Offensive security testing, vulnerability exploitation, and reporting. OSCP (Offensive Security Certified Professional) is the primary filter credential. Entirely separate hiring market with different CV conventions — see the dedicated Penetration Tester article.

Requirements common across all cybersecurity analyst domains:

  • A relevant certification at the right level for the role seniority
  • Domain-specific tooling experience named explicitly
  • Evidence of handling real security events or findings, not just theoretical knowledge
  • Communication skills for report writing and stakeholder briefing — security findings must be communicated to non-technical audiences

Cybersecurity analyst salaries in 2026: £35K–£65K UK (SOC/VA/GRC); £60K–£90K for senior analyst and lead roles. OSCP-certified penetration testers: £50K–£85K. US: $65K–$110K analyst; $95K–$150K senior/lead.

ATS Keywords for a Cybersecurity Analyst Resume

Cybersecurity ATS filtering is domain-specific. SIEM tool names, certification names, and framework terms are the primary keyword matches — generic phrases like "security experience" return nothing.

Essential ATS terms for a cybersecurity analyst resume:

  • Title variants: Cybersecurity Analyst, Security Analyst, SOC Analyst, Information Security Analyst, Tier 1 SOC, Tier 2 SOC, Security Operations Analyst, Vulnerability Analyst, GRC Analyst
  • SIEM: Splunk, Microsoft Sentinel, IBM QRadar, LogRhythm, Elastic SIEM, SIEM, log analysis, event correlation
  • EDR and endpoint: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Carbon Black, EDR, endpoint detection and response
  • Threat and detection: threat detection, threat hunting, incident response, IR, malware analysis, digital forensics, DFIR, IOC, IOA, kill chain, MITRE ATT&CK
  • Vulnerability management: Tenable Nessus, Qualys, Rapid7, InsightVM, CVE, CVSS, vulnerability assessment, patch management, remediation tracking
  • Network security: firewalls, IDS, IPS, Palo Alto, network traffic analysis, Wireshark, packet capture, DLP
  • Frameworks: MITRE ATT&CK, NIST CSF, ISO 27001, SOC 2, CIS Controls, Cyber Essentials, risk assessment
  • Certifications: CompTIA Security+, CEH, CISSP, CISM, OSCP, GIAC, CySA+, Azure Security Engineer Associate, AWS Security Specialty
  • Long-tail phrases: cybersecurity analyst resume examples, how to write a cybersecurity analyst resume, SOC analyst cv, information security analyst resume, security+ resume

Placement: Certification name in full in your headline or directly beneath it — "CompTIA Security+" or "CISSP" as exact strings, not just "CompTIA certified." Your SIEM tool (Splunk, Sentinel) belongs in the headline alongside the certification. MITRE ATT&CK in your Skills section signals framework literacy that is increasingly screened for.

Cybersecurity Analyst CV Structure and Bullets That Show Security Depth

Section order:

  1. Headline — "SOC Analyst | CompTIA Security+ · Splunk · CrowdStrike · MITRE ATT&CK · Incident Response"
  2. Certifications — primary cert first; include in-progress certs (e.g. "OSCP — in progress, expected Q4 2026")
  3. Skills — by domain: SIEM & Detection / EDR & Endpoint / Threat Intelligence / Vulnerability Management / Frameworks & Compliance
  4. Experience — 4–6 bullets per role; alert volume, MTTD, incidents handled, vulnerabilities remediated
  5. Education — CS, cybersecurity, or information systems degree; also list TryHackMe/HackTheBox profiles and home lab if relevant for entry-level

One to two pages. Home lab work, CTF competition placements, and TryHackMe/HackTheBox completion percentages are legitimate CV entries for entry-level and career-change candidates — they demonstrate practical learning that classroom-only training does not.

Three elements make a cybersecurity bullet convincing: the tool and scale, the security action or metric, and the outcome (threat contained, vulnerability remediated, risk reduced). Three examples:

  • Monitored and triaged 200+ daily security alerts via Splunk SIEM — investigated and escalated 14 confirmed incidents over 6 months with average MTTD of 22 minutes on priority-1 events; reduced false positive rate from 34% to 11% by tuning 8 detection rules mapped to MITRE ATT&CK techniques T1566 and T1078
  • Led incident response for a ransomware event affecting 3 endpoints — contained the threat within 40 minutes via CrowdStrike network containment, forensically imaged affected systems, identified the initial access vector as a phishing macro, and delivered a post-incident report with 12 remediation recommendations implemented within 30 days
  • Managed a vulnerability management programme across 1,200 assets using Tenable Nessus — prioritised remediation by CVSS score and asset criticality; reduced critical open vulnerability count from 340 to 18 over 8 months through fortnightly patching cycles and direct engagement with 12 system owners

Cybersecurity interviews test both technical knowledge ("walk me through how you'd investigate a potential phishing alert in Splunk") and judgement ("we have 200 critical CVEs and 2 weeks — how do you prioritise?"). Your CV's metrics establish which scale of environment the interviewer assumes you've worked in, which sets the complexity of the scenario.

Three Cybersecurity Analyst CV Mistakes That Signal the Wrong Level

Certification absent from the headline. CompTIA Security+ is the industry's baseline validation for cybersecurity analyst roles — it tells the recruiter you have been tested on the core concepts that the job requires. CISSP and OSCP signal senior or specialised capability. None of these certifications are worth what you paid for them if they are buried in a skills list at the bottom of the page. A recruiter screening 80 cybersecurity analyst applications is looking for the certification in the first scan. Put it in the headline: "SOC Analyst | CompTIA Security+ · Splunk · CrowdStrike." If you don't yet hold a certification, list TryHackMe or HackTheBox progress, home lab experience, or the certification you are currently studying for — anything that signals active learning.

SOC work described without metrics. "Monitored security alerts and escalated incidents" is the task description for every Tier 1 SOC analyst. It communicates nothing about performance. The metrics that differentiate SOC analysts are: alert volume handled daily, mean time to detect (MTTD) and respond (MTTR) on priority events, escalation rate (what percentage required escalation vs. were resolved at your tier), and false positive rate if you have influenced it through rule tuning. These metrics are available in your SIEM and ticketing system. One analyst who writes "triaged 180 alerts daily, escalated 6% to Tier 2, MTTD 18 minutes" is immediately distinguishable from every candidate who wrote the same generic description.

No domain signal — reads as a generic "security" CV. A CV that mixes SOC alert triage bullets with GRC risk assessment bullets with vulnerability scanning bullets with penetration testing references positions the candidate as someone without a clear specialisation. Hiring managers for SOC roles want a SOC analyst. GRC teams want someone who understands compliance frameworks. These are different people. Lead with your primary domain, put supporting domain experience in context, and write your headline to match the specific role type you are applying for. If you are genuinely transitioning between domains, note it explicitly — "transitioning from GRC to SOC operations" tells a coherent story; a mixed CV with no narrative tells none.

If you are applying to cybersecurity analyst or SOC analyst roles and want your CV rebuilt around the specific SIEM, certification, and threat detection requirements in a target job description, Resumegpt generates your cybersecurity analyst CV from your work history in under 60 seconds — certifications surfaced, domain signalled, ATS-optimised, and exported as a PDF ready to submit.