Cybersecurity Analyst Resume Example (2026 Guide)
Cybersecurity Analyst resume example
A complete sample in the Modern template FitMyRole exports. The person and employers are fictional; the structure, skills and bullet style are what to copy.
Lorena Salgado
[email protected] • (555) 012-7741 • Arlington, VA • linkedin.com/in/lorenasalgado
Professional Summary
Cybersecurity Analyst with 3 years of experience in security operations, threat detection and incident response, first in a 24/7 SOC at a managed security provider and now on the in-house security team of a credit union. Monitors 6,500 endpoints and 400 servers through Splunk Enterprise Security and CrowdStrike Falcon, triaging about 120 alerts a day. Cut false positives on the noisiest detection rules by 38% and contained a business email compromise within 40 minutes of the first alert. Writes detections mapped to MITRE ATT&CK, keeps playbooks current and explains findings plainly to IT and business owners.
Technical Skills
- Security Operations: SOC monitoring, alert triage, threat detection, incident response, threat hunting, phishing analysis, escalation and case management
- SIEM & EDR: Splunk Enterprise Security, SPL, Microsoft Sentinel, KQL, CrowdStrike Falcon, Microsoft Defender for Endpoint
- Frameworks: MITRE ATT&CK, NIST Cybersecurity Framework, NIST SP 800-61 incident handling, Cyber Kill Chain, FFIEC guidance
- Network & Cloud Security: Palo Alto Networks firewalls, Zscaler, Wireshark, Zeek, Microsoft Entra ID, Microsoft 365 Defender, AWS CloudTrail
- Vulnerability Management: Tenable Nessus, CVSS scoring, CISA KEV prioritization, patch tracking, remediation reporting
- Automation & Scripting: Python, PowerShell, Splunk SOAR playbooks, regular expressions, REST APIs
Education & Certification
- Coursework focus: Network Security, Digital Forensics, Incident Response and Secure Systems Administration; member of the collegiate cyber defense team.
Work Experience
Cybersecurity AnalystMarch 2025 – PresentLiberty Crest Credit Union, Arlington, VA
- Monitor Splunk Enterprise Security and CrowdStrike Falcon for 6,500 endpoints and 400 servers, triaging about 120 alerts a day and escalating confirmed incidents within a 15-minute SLA.
- Cut false positives on the 20 noisiest correlation searches by 38% by tuning thresholds, adding asset and identity context, and retiring rules that duplicated CrowdStrike detections.
- Contained a business email compromise within 40 minutes by revoking sessions in Microsoft Entra ID, purging 260 phishing emails with Microsoft 365 Defender and blocking the sender domain.
- Wrote 14 new detections mapped to MITRE ATT&CK for credential dumping, impossible travel and encoded PowerShell, closing gaps found in a purple team exercise.
- Built a Splunk SOAR playbook that enriches reported phishing with URL and attachment verdicts, cutting average phishing triage time from 18 minutes to 6.
- Raised on-time patching of CISA KEV vulnerabilities from 71% to 94% in two quarters by tracking critical Tenable findings with IT owners in a weekly review.
SOC Analyst IJune 2023 – February 2025Bluefort Managed Security, Reston, VA
- Monitored SIEM and EDR alerts around the clock for 11 managed security clients in healthcare, legal and retail, handling 150+ alerts per 12-hour shift.
- Escalated 37 confirmed incidents, including two ransomware precursors stopped at initial access, with timelines and evidence Tier 2 could act on without rework.
- Rewrote 9 triage playbooks for phishing, malware and brute-force alerts, shortening new analyst onboarding from six weeks to four.
- Traced suspicious outbound traffic with Wireshark and Zeek logs to a misconfigured client VPN that was exposing RDP to the internet, which the client closed the same day.
- Earned a 98% quality score on peer-reviewed tickets across 2024, the highest on the Tier 1 team.
IT Security InternMay 2022 – August 2022Shenandoah Valley Health System, Winchester, VA
- Ran weekly Nessus scans across 1,800 hospital workstations and tracked 600+ findings to closure with the desktop support team.
- Reviewed firewall and Active Directory logs for failed logins and flagged three service accounts with passwords set never to expire.
- Created phishing awareness materials and a short quiz for 2,400 staff, part of a campaign that lowered the simulated phishing click rate from 14% to 8%.
- Documented the incident response contact list and evidence-handling steps used in the health system’s annual tabletop exercise.
Want yours to read like this? Upload your resume and a job posting, and FitMyRole rewrites it for that job in this template.
Tailor my resumeWhy This Resume Works
- The summary gives SOC scale in one line: 6,500 endpoints, 400 servers and about 120 alerts a day, which answers the volume question every security hiring manager asks.
- SIEM and EDR tools are named inside the bullets, not only in the skills list (Splunk Enterprise Security, CrowdStrike Falcon, Microsoft Sentinel), so ATS keyword matches are backed by real use.
- Incident response is shown with a time to containment: a business email compromise contained within 40 minutes, with each step listed.
- Detection engineering is visible even at three years of experience: 14 detections mapped to MITRE ATT&CK and false positives cut by 38% on the 20 noisiest searches.
- The internship and SOC Analyst I roles show a clear path into the job, and CySA+ and Security+ are dated so a recruiter can see they are current.
Common Resume Mistakes
- No alert or endpoint metrics.
- Missing SIEM or EDR keywords.
- Vague "monitored security" without scope.
Keywords Recruiters Look For
- Cybersecurity
- SOC
- SIEM
- EDR
- Threat detection
- Incident response
- Monitoring
- Splunk
Get more interviews. Tailor your resume automatically
Want to tailor your resume to the job you want? Use FitMyRole to analyze your resume and rewrite it for the role. Before sending your next application, run your resume through FitMyRole to tailor it to the job description.
Try FitMyRole free