The cybersecurity resume, rebuilt from 500 open security postings and their application forms

What screening software and security hiring managers look for on a resume, counted on 500 open job postings and the application forms attached to them, with wording you can adapt line by line.

Most advice about the cybersecurity resume is written from memory: a list of "top keywords", a template, a warning that robots reject most applicants. This guide was written the other way round. On 11 November 2026 this board drew a random sample of 500 open security postings, fifty from each of its ten specialties, posted by 191 different employers, and read each one in full together with the application form the employer attached to it. Every count below comes from that sample unless it says otherwise, and each is dated, because postings change by the hour.

Three findings shape everything that follows. First, the form screens before the resume does: 369 of the 396 application forms the board could read asked questions of their own, and the commonest, about visa sponsorship, sat on 66% of them. Second, the words that recur across the postings are not exotic. Python appeared in 47% of them, a named cloud provider (AWS, Azure or Google Cloud) in 41%, a request for clear written or spoken communication in 41%, a SIEM in 20%. Third, certifications matter less to most postings than their marketing suggests: across all 2,144 open postings the board read that day, 26.2% named any certification at all, CISSP led with 16.7% and CompTIA Security+ stood at 4.2%, as the certifications page records.

The guide moves from how a resume is screened, through what the postings ask for, to what to write in each part of the page. It then covers the SOC analyst and security analyst resume, the other specialties one by one, the resume with no security experience, federal and cleared applications, and the honesty questions that AI has made sharper. Anything this guide says about people or organizations outside the board links to the source it came from.

Contents

1. How a security resume is read in 2026
2. What 500 open security postings ask for
3. The application form screens before the resume does
4. File and layout that parsers and people read cleanly
5. What a reader sees first: title line, summary and skills
6. Experience bullets that prove security work
7. The SOC analyst and security analyst resume
8. Specialty by specialty: what to put first
9. Certifications, degrees and clearances on the page
10. A cybersecurity resume with no security experience
11. Federal resumes and cleared contractor resumes
12. AI, honesty and checks employers run
13. A last pass before you press apply
14. Questions people ask about cybersecurity resumes

1. How a security resume is read in 2026

Picture the path an application takes. You fill in a form on the employer's careers page, attach a file, and press submit. What happens next depends on the applicant tracking system behind that page, and on this board the answer is concentrated. Of the 2,151 open roles the board listed on the evening of 11 November, 1,273 (59%) came from employers whose careers pages run on Greenhouse, 437 (20%) on Ashby and 362 (17%) on Workday, with Lever and SmartRecruiters sharing the rest. So three vendors decide the mechanics for nearly every security role here, and all three publish how their screening works.

Read their documentation and a security resume turns out to face three distinct readers, each with its own logic.

The rules on the form. Greenhouse lets an employer attach rules to the questions on a job post: an auto-reject rule screens out and emails candidates whose answer fails a criterion the employer marked as essential, and when an auto-advance rule and an auto-reject rule both fire, the rejection wins - Greenhouse Support. The company's own explainer for job seekers uses a "no" to a work-authorization question as its example and stresses that these filters are set by recruiters themselves rather than by a bot - Greenhouse. Notice what the rule reads: your answer to a question, not your resume. Section 3 shows which questions security employers actually put on their forms.

The matcher. Here the vendors differ, and the differences matter. Greenhouse states plainly that its AI does not score or rank applications; it uses AI to suggest keywords that recruiters can search the applicant pool for, and it says candidates have no need to stuff their applications with them - Greenhouse. Ashby offers an opt-in feature in which a model checks each resume against criteria the recruiter writes and marks every criterion as met, not met, or undecided. Its documentation tells recruiters to write criteria that are "objectively verifiable", meaning provable by looking at a resume - Ashby documentation. Workday's HiredScore grading, as its August 2026 release notes describe it, evaluates each screenable qualification individually against the candidate's parsed resume, and the basic qualifications decide whether a candidate lands in the A/B grades or the C/D grades - Workday HiredScore release notes.

A person. Somebody still reads what survives. Greenhouse says that, by and large, applications in its system are reviewed by people one at a time, in the order they arrived, and that on popular roles recruiters filter the queue (often by referrals first) rather than reading everything - Greenhouse. In security, the person who decides what that reader looks for is usually technical. ISC2 surveyed 929 hiring managers and found that screening is shared between security or IT managers and HR in 53% of organizations and handled by the security or IT managers alone in another 35%; it also reports that those managers typically define the technical skills, certifications, clearances and applicant tracking keywords for a role - ISC2 2025 hiring trends study.

Put the three readers side by side and they converge on one demand. A rule needs a clean answer. A search needs the exact term. A model checking criteria needs each requirement visibly met in the text. A security manager skimming the shortlist needs the same thing a model does, only faster. Every one of them is asking whether each requirement in the posting can be found, in plain words, somewhere on the page. That is the principle the rest of this guide applies: name things exactly, give each claim its own line, and back it with evidence rather than adjectives. A resume written that way passes a keyword search, satisfies a criteria checker, and reads well to a tired human, without any trickery aimed at software.

It also explains why the folklore about robots silently binning resumes for a missing keyword is the wrong worry. None of the vendor documentation quoted above describes rejection by keyword count. What it does describe is rejection by form answer, and ranking or grading against requirements a person wrote. Both reward the same habit: read the posting closely and answer it directly.

2. What 500 open security postings ask for

The sample was drawn at random from the board's open roles, fifty from each of its ten specialties, so small specialties such as cloud security weigh as much in the totals as large ones such as security engineering. The board read the full text of each posting (the median one ran to 891 words) and counted a posting once for each tool, framework, language or credential it named, whether as a requirement or as a preference, since postings rarely separate the two cleanly. Generic words that appear in company descriptions more than in requirements, such as "cloud" on its own, were not counted as skills.

One limit is worth stating before the numbers. Because the board can only read employers whose openings sit on public careers systems, its mix leans toward software makers, security vendors, cloud platforms and venture-backed firms, and these counts speak for that segment of hiring. A regional bank or a county government may weigh things differently, and its posting is still the best guide to what it wants.

Python is the shared language of the field

Python appeared in 236 of the 500 postings (47.2%), more than any tool, platform or framework, and it ran across specialties: 36 of the 50 application security postings named it, 33 of the 50 penetration testing and red team postings, 32 in cloud security, 31 in threat intelligence and 25 in security operations. Only leadership postings mostly left it out (6 of 50). Go came next among languages, named in 123 postings (24.6%) and especially in application security (29 of 50). The practical reading is that a security resume without any programming on it now looks thin for most roles below management. That does not mean you must be a software engineer. It means the resume should show where you used a language to do security work: a parser, an enrichment script, an automation that closed tickets, a detection written as code.

Cloud is assumed, and the provider is named

A specific cloud provider appeared in 203 postings (40.6%): AWS in 189, Google Cloud in 148 and Azure in 133, often listed together as "AWS, Azure or GCP". Kubernetes appeared in 132 (26.4%), and infrastructure as code, Terraform included, in 85 (17.0%). Cloud security postings named AWS in 38 of 50 and Kubernetes in 34. For a resume this has a simple consequence: write the provider you actually used and the services you secured, because "cloud security experience" matches nothing a recruiter types into a search box, while "AWS (IAM, Organizations SCPs, GuardDuty)" matches several things.

Category words beat brand names

Detection tooling shows a pattern worth understanding. The bare word "SIEM" appeared in 91 postings, while Splunk appeared in 13 and Microsoft Sentinel in 7. Words for endpoint detection (EDR, XDR, "endpoint detection") appeared in 56 postings, while CrowdStrike appeared in 12, leaving out CrowdStrike's own postings. Employers mostly describe the category and leave the product open, because they know an analyst who has run one SIEM can learn another. So a resume should carry both: the category word, which matches the posting, and the product, which proves you have touched a real one. "SIEM (Splunk, Elastic)" does both jobs in four words.

Frameworks are specialty signals

ISO 27001 appeared in 81 postings (16.2%), NIST guidance of any kind in 76 (15.2%), SOC 2 in 69 (13.8%) and MITRE ATT&CK in 58 (11.6%). These cluster by specialty far more than tools do: ISO 27001 sat in 35 of the 50 GRC postings, ATT&CK in 18 of the 50 operations postings. Section 8 maps them specialty by specialty, which is how a resume should use them, by naming the frameworks your target specialty works in rather than every framework you have heard of.

Postings ask for writing more often than for any security product

A request for clear written or verbal communication appeared in 204 postings (40.8%), and the word "stakeholder" in 172 (34.4%). Both outnumber every security product in the sample. Hiring managers know that security work ends in writing: a ticket, an incident report, a risk memo, a finding a developer must understand. On a resume, the way to answer this is not the phrase "excellent communication skills". It is a bullet that shows writing doing work: a runbook others used, a report an executive acted on, a finding developers fixed because it was clear.

Most postings ask for years, and the middle is five

Of the 500 postings, 317 (63.4%) stated a number of years of experience. Taking the first figure each one gave, the middle was five years, and 233 of those 317 asked for five or more. Only 34 asked for two years or fewer.

Two things follow for the page. Your years must be easy to compute, which means month and year on every role and a total stated once near the top ("six years in security operations"). And if you have fewer years than a posting asks, the resume has to make the years you do have dense with evidence, a problem section 10 takes up in detail.

A degree is named by one posting in three, and often with a way around it

Only 166 of the 500 postings (33.2%) mentioned a degree at all, and 82 of those offered equivalent experience or extra years as an alternative. Two postings in three said nothing about education. That supports a common layout choice: education goes near the bottom of an experienced person's resume, short and factual, and only moves up when it is your strongest card (a recent graduate, a security-specific master's, a program the posting names).

Certifications: the board-wide count

Certifications appear far less often than course sellers imply. Across all 2,144 open postings on 11 November, 26.2% named any certification the board tracks, CISSP led at 16.7% and Security+ was named in 4.2%; the sample agreed closely (28% naming any, 17.2% naming CISSP). The board's certifications page also shows that postings naming no certification stated a middle salary of $214,000 a year, higher than for postings naming any single certification. That figure says more about which jobs mention credentials than about what a credential is worth: certifications are named mostly where a contract, a regulator or a client needs them, and in GRC. For most postings a certification is supporting evidence on your resume, not the deciding line. Section 9 covers how to present one.

3. The application form screens before the resume does

The forms deserve as much attention as the resume, and they get almost none in resume advice. Of the 500 sampled postings, 396 had an application form the board could read in full (the rest sit on systems that show the form only after you start applying). Of those 396 forms, 369 asked at least one question beyond name, contact details and file uploads, the middle form asked six, and 114 included at least one question needing a written answer.

The pattern is clear. The questions most likely to end an application have nothing to do with skill: whether you need sponsorship (261 forms), whether you are authorized to work in the country (218), whether you can work from the stated location or come to the office on the stated days (184). Export control and citizenship questions appeared on 69 forms, typically asking whether you qualify as a "U.S. person" under export rules, and clearance questions on 30. These are exactly the yes-or-no questions an auto-reject rule is built on. A brilliant resume cannot rescue a disqualifying answer, and a misleading answer that gets you through is discovered at the offer stage, where it costs far more.

Three practical habits follow. Read the location and schedule lines in a posting before you write a word for it, because a hybrid requirement of three office days is a gate, not a preference. Put your city and region on the resume, so a human reader is not left guessing whether you fit. And where it is true and relevant, state your work authorization or citizenship in one plain line ("U.S. citizen" for an export-controlled role; "Authorized to work in the UK, no sponsorship needed"), because a human reviewer reads the resume beside the answers.

Skill questions were rarer than gate questions. Only 36 forms asked about years of experience directly and only 12 asked which certifications you hold, but the written questions carry real weight: a form that asks you to describe an AI security risk you mitigated, or a tool you built, is a writing sample read alongside the resume. Keep those answers consistent with the resume, specific, and in your own words.

The upload fields tell their own story. A resume file was required on 344 of the 396 forms. A LinkedIn profile was required on 105 and offered as optional on 251, so a profile that contradicts the resume is likely to be seen. A cover letter was required on only 5 forms and optional on 266. A website field appeared on 141 forms and a GitHub field on 59, which is where a portfolio of write-ups or code can enter the process for roles that value it.

Salary expectation questions appeared on 57 forms. Answer them with a range grounded in what comparable postings state rather than a guess: the board's salary pages for each specialty, such as security operations pay or GRC pay, show the ranges open postings state by seniority, workplace and employer. Twenty forms also asked applicants to certify that everything submitted is true and complete, a reminder that the resume is a document you sign.

4. File and layout that parsers and people read cleanly

The safest file is the plainest one. Greenhouse accepts .doc, .docx, .pdf, .rtf and .txt uploads - Greenhouse Support, and its own troubleshooting article lists three reasons a resume fails to import: too little information, a non-standard file type, or characters its text parser does not recognize - Greenhouse Support. A text-based PDF or a .docx exported from an ordinary word processor avoids all three. A PDF that is really a scanned image, or a design-tool export with text drawn as shapes, can arrive as an empty record.

Layout decisions follow from how the text is extracted. A parser reads text in order, so a single column reads in the order you meant, while two columns can interleave a skills list into the middle of a job description. Text boxes, tables used for layout, icons in place of words and contact details placed in a page header are all common places for content to go missing. Standard section names (Summary, Skills, Experience, Projects, Certifications, Education) are recognized everywhere; a heading such as "Where I've made an impact" is not. Dates in a consistent "Mar 2023 to Present" or "03/2023 to present" format let both software and readers compute your years.

Human readers want the same simplicity. A 2018 eye-tracking study by the job site Ladders, as HR Dive reported it, found recruiters skimmed resumes for an average of 7.4 seconds, and that simple layouts with clear sections and headings held attention while cluttered pages, multiple columns and long sentences lost it - HR Dive. The study is old and small, but its lesson matches what every security hiring manager says: they are scanning for evidence of specific work, and anything that slows the scan works against you.

Length is a judgment rather than a rule in the private sector. One page suits someone with under five or so years of relevant work, and two pages suit most experienced practitioners. Beyond two, the reader is doing your editing for you. (Federal applications now have a hard limit, covered in section 11.) Whatever the length, the first third of page one carries most of the weight, which is why section 5 spends so long on it.

A few small choices help too. Name the file with your name and the target role ("Priya-Shah-Cloud-Security-Engineer.pdf"). Write links to your GitHub, write-ups or portfolio as visible text addresses rather than hiding them under words, since some parsers keep the text and drop the link. And never hide keywords in white text or tiny type: a model checking criteria shows the recruiter its reasoning, a recruiter opening the file sees what the parser saw, and a security reviewer who finds an attempt to game a system will draw the obvious conclusion about the applicant.

There is a security angle to the file itself. A resume travels to strangers and sits in databases you do not control, so leave off what you would not give a stranger: your street address (city and region are enough), date of birth, and any identity number. Leave off internal hostnames, client names you are bound not to disclose, and details of vulnerabilities that may still be open. A security employer reads discretion on the page as a skill.

5. What a reader sees first: title line, summary and skills

The title line

Under your name, write the role you are applying for in the words employers use. Titles on this board are dominated by one word: "engineer" appeared in 1,194 of the 2,151 open role titles on 11 November (55.5%), "analyst" in 178 (8.3%), and "manager" in 211 (9.8%). Seniority words were common too: "senior" in 32.2% of titles and "staff" or "principal" in 18.5%. If you are applying for "Security Engineer, Detection and Response", a title line reading "Security Engineer, Detection and Response" or "Detection and Response Engineer" matches the search a recruiter runs.

That title line is a statement of what you are targeting, not a record of past jobs. Past job titles in the experience section must stay exactly as your employer gave them, because a background check will compare them. If your official title undersells the work ("IT Specialist II" for a role that was mostly incident handling), keep the title and let the first bullet say what the work was.

The summary

A summary earns its three lines when it does what the title line cannot: states your specialty, your years, the environment you worked in, and one piece of proof. Objectives ("seeking a challenging role where I can grow") tell the reader what you want rather than what you offer, and they waste the most valuable space on the page.

Security engineer with 6 years in detection and response for SaaS companies
on AWS. Built and maintain 140 detections in Splunk mapped to MITRE ATT&CK;
cut mean time to triage from 45 to 12 minutes with Python enrichment.

GRC analyst with 4 years running SOC 2 Type II and ISO 27001 programs for
B2B software companies. Took a 300-person company through its first ISO 27001
certification with no major nonconformities; owns 180-control evidence calendar.

Each of those lines carries terms a search would find (detection and response, AWS, Splunk, MITRE ATT&CK, Python; SOC 2, ISO 27001) inside sentences a person would want to read. That is the balance to aim for. A summary that lists twelve keywords in a row reads as an attempt to game the screen, and a summary with none reads as vague.

The skills block

The skills block is the part of the resume most directly written for search, and it is also where most resumes go wrong, by listing every tool the applicant has ever opened. A skills block works when it is short, grouped, and honest. Group by category, name the category word and the product, and spell out an acronym once so that either form matches:

Detection and response: SIEM (Splunk SPL, Microsoft Sentinel KQL), EDR (CrowdStrike Falcon),
  SOAR playbooks, incident response, MITRE ATT&CK mapping
Cloud: AWS (IAM, CloudTrail, GuardDuty, Security Hub), Terraform
Identity: Identity and access management (IAM), Okta, Microsoft Entra ID, SAML, OIDC
Languages: Python, SQL, PowerShell
Frameworks: NIST Cybersecurity Framework, SOC 2

Only list what you can discuss in an interview. ISC2 found that 84% of the organizations it surveyed use skills-based assessments or tests for entry and junior applicants - ISC2 2025 hiring trends study, and security interviews at every level tend to start from a line on the resume: "You list Sentinel. Write me a query that finds impossible travel." A tool you cannot use is a liability on the page, not an asset.

The data in section 2 suggests a test for each line in the block. Does a posting you are targeting name it, or its category? If yes, it belongs, in the posting's own spelling. If no posting you want mentions it and you are short of space, it can go.

6. Experience bullets that prove security work

Experience bullets are where a security resume wins or loses the human reader, and where a criteria checker finds most of its evidence. The weakest bullets describe duties ("Responsible for monitoring alerts"). The strongest describe a change: what you did, to what, with what, at what scale, and what happened as a result.

A useful pattern is action + target + method + scale + result. "Wrote 60 detections for credential abuse in Microsoft Sentinel (KQL), mapped to MITRE ATT&CK, cutting account-takeover dwell time from days to under an hour." Not every bullet can carry all five parts, but each should carry at least an action, a target and either a scale or a result.

Security work produces good numbers if you know where to look. The list below is a menu, not a checklist, and every number you use must be one you can explain and defend.

• Operations: alerts triaged per shift, cases closed, mean time to detect or respond, false positive rate before and after a tuning project, detections written, ATT&CK techniques covered.
• Engineering: endpoints or hosts covered by a control, logs onboarded per day, guardrails rolled out across accounts, secrets removed from code, time saved by an automation.
• Vulnerability work: findings remediated within the agreed window, mean time to remediate by severity, scanner coverage of assets.
• Identity: applications moved to single sign-on, share of accounts with phishing-resistant MFA, access reviews completed, joiners and leavers automated.
• GRC: controls mapped, audits passed and their findings, vendor reviews completed, questionnaires answered and the turnaround time.
• Offensive: engagements led, findings by severity, findings the client fixed, tools or techniques built.

Here is how the same work reads before and after.

Two honesty rules apply to every bullet. The first is that numbers must be real. An approximate figure stated as approximate ("about 35 alerts a shift") is honest; an invented percentage is not, and it is precisely the kind of claim an interviewer probes. If you do not know the number, describe the scale in words ("across every production account") rather than making one up. The second is confidentiality. Describe what you did without naming a client you are bound not to name, an internal system's real hostname, or a weakness that may still be exploitable. "A financial services client" and "an authentication bypass in a customer-facing API, fixed before release" say enough.

Order matters as much as wording. Put the bullets most relevant to the target posting first under each role, give recent roles more lines than old ones, and let roles from more than ten years ago shrink to a title, employer and dates. A criteria checker and a person both read the first lines of each job most closely.

Finally, write so that each requirement in the posting meets its own line. Ashby's guidance to recruiters is to keep each criterion standalone and focused on a single skill - Ashby documentation, and Workday's grading assesses each qualification on its own - Workday HiredScore release notes. A bullet that braids Splunk, Python, incident response and AWS into one long sentence makes each of those harder to credit than four clean bullets would.

7. The SOC analyst and security analyst resume

Security operations is where most people's first security job sits, and the postings for it ask for a recognizable set of things. In the 50 sampled operations postings, incident response appeared in 33, a SIEM in 30, endpoint detection in 26, Python in 25, detection engineering or written detections in 22, forensics in 21 and MITRE ATT&CK in 18. Shift or on-call work was mentioned in 27, more than in any other specialty. Windows (17) and Linux (16) appeared about equally. Among certifications, GIAC credentials were named in 10 of the 50, Security+ in 4, CISSP in 4 and CySA+ in 3.

The titles are worth studying before you write your title line. Of the 308 security operations and incident response roles open on the board on 11 November, 147 carried "engineer" in the title and 80 carried "analyst"; 78 carried "detection". Many teams now title the seat that triages, investigates and writes detections "Security Engineer, Detection and Response", even when the daily work overlaps heavily with an analyst's. A SOC analyst resume should therefore use both vocabularies: "SOC analyst" where that was your title, and "detection and response" where it describes the work.

Weighed by how much each counts, a SOC resume needs to show four things:

1. That you triage well. Volume, the tools, and the judgment: what share of alerts you closed as benign, what you escalated, how quickly.
2. That you investigate across systems. An investigation that moved from an identity provider's sign-in log to an endpoint's process tree to a cloud audit trail shows the range employers want.
3. That you improve the system. Tuning that cut noise, a detection you wrote, a playbook you automated. This is what separates tier 1 from tier 2 on paper.
4. That you write clearly. Incident notes, handovers, a post-incident report.

SOC Analyst (Tier 1), Northline Managed Security, Denver, CO        Jun 2024 to Present
- Triage about 35 alerts per 12-hour shift across 40 client environments in Splunk
  and CrowdStrike Falcon; median time to first decision 9 minutes.
- Investigated 120 phishing and account-takeover cases end to end (Okta logs, EDR
  process trees, Microsoft 365 audit); escalated 14 confirmed compromises.
- Tuned 22 noisy rules with the detection team, cutting false positives on the
  password-spray rule by 70% without losing a true positive in review.
- Wrote a Python enrichment script (VirusTotal and WHOIS lookups) now run on
  every phishing case by the whole shift.

That excerpt uses a fictional employer to show the shape; your own should use your real ones. Notice what it does: every line names the tools in the posting's words, gives a scale, and ends in a result. It mentions the shift pattern, which matters to a hiring manager staffing nights. And it shows movement toward tier 2 work (tuning, scripting) without claiming a title the person does not hold.

The generic title "security analyst" needs a separate word of caution. On 11 November only 53 of 2,151 open titles on the board contained "security analyst", and the work behind that title varies: some are SOC seats, some are vulnerability management, some are GRC roles under a different name. Read the duties before you tailor, and mirror the duties rather than the title. The board's security operations guide describes the work at each tier, the SOC salary page shows what postings state by seniority, and the entry-level roles page lists the analyst seats open today that are written for beginners.

8. Specialty by specialty: what to put first

Each specialty screens for its own vocabulary. The table summarizes what the 50 sampled postings in each one named most often, the certifications they named most, and the middle number of years they asked for (among those that stated one). Use it to decide what goes in your title line, summary and skills block.

Security engineering

Security engineering is the largest specialty on the board and the most varied, which is why its postings named fewer terms consistently than the others. Python (28 of 50) and AWS (23) were the only terms named by roughly half. The resume therefore has to declare which kind of security engineer you are: detection platform, infrastructure, endpoint, vulnerability management, or product. Put that in the title line and summary, then lead with bullets that show you built and ran controls rather than only operated them: "Built a log pipeline moving 2 TB a day from 900 hosts into Elastic, with schema validation and dead-letter alerting." The security engineering pay page shows how sharply pay rises with the seniority word in a title, which is a reason to state your level accurately.

Cloud security

Cloud security postings were the most concentrated of all: AWS in 38 of 50, Kubernetes in 34, containers in 30. A cloud security resume should name the provider, the services and the guardrails in specific terms (service control policies, permission boundaries, a cloud security posture tool, a workload identity setup), and show the infrastructure as code you wrote. One strong bullet about preventing a class of misconfiguration across every account beats five about individual findings. AWS certifications were named in 8 of these 50 postings, more than anywhere else, so a current one belongs near the top here. The cloud security pay page lists what those postings state.

Application security

Application security postings read like software engineering postings with a security core: Python (36) and Go (29) for code, threat modeling (26) for design reviews, CI/CD (18) and SAST, DAST or SCA tooling (17) for the pipeline, OWASP (15) as shared vocabulary. Certifications mattered little (9 of 50 named any). What persuades here is code and judgment: secure code reviews you led, a class of bug you eliminated with a framework change, a scanner you integrated without drowning developers in noise. Link a repository if you can. A bullet such as "Replaced ad hoc input validation in 14 services with a shared library; injection findings from the external test fell from 9 to 0" is the kind of evidence this specialty screens for. See the application security pay page.

Identity and access management

Identity postings named IAM in 37 of 50 and federation protocols (SAML, OAuth, OIDC) in 26, with directory platforms (Active Directory, Entra ID) in 20, Okta in 16 and privileged access tools in 15. They also asked for more years than most (a middle of seven), reflecting how many identity seats are senior. An IAM resume should show the lifecycle: joiners, movers and leavers automated, access reviews run, single sign-on rolled out, privileged access brought under control. Numbers come naturally here ("Moved 140 applications to Okta SSO; 98% of staff on phishing-resistant MFA"). If you came from IT support, your account administration work is genuine identity experience: describe it in identity terms. The identity pay page shows the ranges.

Penetration testing and red team

Offensive postings were the most certification-minded of the technical specialties: OSCP in 18 of 50 and OffSec's advanced certifications in 15, with GIAC in 9. They named Python (33), red teaming (27), Linux (24), Burp Suite (16) and attack frameworks such as Metasploit or Cobalt Strike (14). A tester's resume should list engagements by type and scope (external, internal, web application, cloud, physical, social engineering), findings by severity, and the tools or techniques you built. Public evidence counts heavily: published research, conference talks, acknowledged vulnerability disclosures (credited with the vendor's permission) and capture-the-flag results. Never put client names or unreleased findings on the page. The penetration testing pay page shows what open postings state.

Threat intelligence and security research

Threat intelligence postings asked for Python (31), malware analysis or reverse engineering (20), detection work (17), MITRE ATT&CK (14) and SQL (14). This is a writing specialty as much as a technical one, and 22 of the 50 named written communication. A resume here should show the full cycle: what you collected, how you analyzed it, what you published, and what defenders did with it. Cite public reports you wrote or contributed to, YARA or Sigma rules you published, and tracking work you can describe at an unclassified level. Sigma, the open format for writing SIEM detections, keeps more than 3,000 community rules in its public repository - SigmaHQ on GitHub, and a rule you contributed there is evidence any reviewer can open. See the threat intelligence pay page.

Governance, risk and compliance

GRC postings had the clearest vocabulary of all: ISO 27001 in 35 of 50, SOC 2 in 28, risk assessment in 22, NIST in 19, then GDPR, PCI DSS and FedRAMP. They were also the most certification-heavy, with CISSP in 21, CISA in 20 and CISM in 16, and 26 of the 50 named at least one certification. They named stakeholders in 25 and documentation in 23. A GRC resume should name each framework you have operated against and what you delivered under it: audits passed, certifications achieved, controls designed, risk registers built, questionnaires turned around. Under NIST's Cybersecurity Framework 2.0, released in February 2024, the framework's functions are Govern, Identify, Protect, Detect, Respond and Recover, with Govern newly added - NIST, so a GRC resume that speaks of governance work in those terms matches current postings. Technical literacy stands out here: a bullet showing you verified a control in a cloud console, rather than only collecting a screenshot, is rare and valued. The GRC pay page lists the ranges.

Architecture and leadership

Architecture and leadership postings asked for a middle of seven years and leaned on frameworks and breadth more than tools. Architecture postings mentioned stakeholders in 29 of 50, the highest of any specialty, and zero trust in 14. Leadership postings named incident response, SOC 2, NIST and ISO 27001 most, and CISSP in 15 of 50. Resumes at this level are judged on decisions and outcomes: programs built, budgets owned, teams grown, audits passed, incidents led, risk reduced in terms the board understood. Keep one or two technical specifics per role so a technical interviewer can find the thread, and cut the tool lists that served you earlier in your career. See the architecture pay page and the leadership pay page.

9. Certifications, degrees and clearances on the page

How to write a certification

A certification line should let a reader verify it in under a minute: the full name with its abbreviation, the issuer, the month and year earned, and a credential ID or verification link where the issuer provides one. "Certified Information Systems Security Professional (CISSP), ISC2, Mar 2024, ID 123456" is better than "CISSP", because it matches searches for either form and invites verification instead of doubt.

Where the certification goes depends on the posting. If the posting names it as a requirement, or the role falls under a rule that requires it (Department of Defense cyber roles, a client contract), put it near the top: in the summary or a short line under it. Otherwise a certifications section after experience is fine. In the sample, GRC and offensive security postings named certifications most often (26 and 19 of 50), and identity and application security postings least (8 and 9 of 50).

Two situations call for care. The first is the CISSP exam passed without the required experience. ISC2 calls such a person an Associate of ISC2, with up to six years to earn the CISSP's experience - ISC2, and its rules for using its marks are explicit: Associates are not certified and may not use any mark or description other than "Associate of ISC2" - ISC2 membership policies. So the resume line is "Associate of ISC2", never "CISSP" or "CISSP (Associate)". The second is a certification you are still studying for. Listing it as if held is the kind of claim a background check or a verification lookup catches. A line such as "CompTIA Security+ (exam booked for January 2027)" is honest and still tells the reader where you are heading.

Expired certifications are best left off, or marked as such with their dates, because many postings that name a certification (particularly defense ones) mean an active one.

Degrees

Two postings in three in the sample did not mention a degree, and half of the rest accepted experience instead. For an experienced practitioner, an education section of one or two lines at the bottom is enough: degree, field, institution, year. A recent graduate should move it up, add relevant coursework or a capstone project only where it is security work, and include GPA only if it is strong or a posting asks for it (federal applications do; see section 11). A security-specific degree or a graduate certificate earns a mention in the summary when it is your main qualification.

Clearances and citizenship

Clearance mentions were concentrated: 32 of the 500 sampled postings (6.4%) mentioned a clearance, and 30 of the 396 forms asked about one. Where they apply, they decide everything, and the cleared roles page lists the open roles that ask for one by the level each names.

A ClearanceJobs article from September 2026 sets out how to write the line. The level of access eligibility is unclassified and belongs on a resume, ideally in compact form with the status a recruiter checks first, such as "Active TS/SCI (T5), no break in access". Digraphs and trigraphs and program nicknames never go on a resume, and classified work must be described in unclassified terms even for a cleared employer, keeping the skill, the scale and the outcome while dropping the target, source, method, location and program. The same article warns that individually unclassified details can become classified when compiled, and that resumes are indexed in applicant tracking systems - ClearanceJobs. When in doubt about a line, ask your security officer before you send the resume, not after.

Citizenship works differently. In the sample, 79 postings (15.8%) mentioned U.S. citizenship or "U.S. person" status, often because of export controls rather than clearances, and 69 forms asked about it. For those roles, a plain line in the contact block helps a human reviewer.

10. A cybersecurity resume with no security experience

The numbers here are sobering, and it is better to plan with them than around them. On the evening of 11 November, the board's entry-level roles page listed 59 open roles whose titles marked a starting rung, at 40 employers, out of more than 2,100 open roles. In the sample, only 34 postings asked for two years of experience or fewer. A resume with no security experience is competing for a small share of seats, so it has to do two jobs at once: prove the foundations, and show security work done outside a security job.

The encouraging evidence comes from the hiring managers themselves. Asked whom they would consider for an early-career seat, nine in ten of ISC2's surveyed managers (90%) accepted IT work as someone's sole background and 89% an entry-level security certification as their sole credential, each scoring above a relevant degree held alone - ISC2 2025 hiring trends study. So the no-experience resume should lead with whichever of those you have, and back it with projects.

The structure that works

For someone without a security job, the order of sections changes. A workable layout is:

1. Summary, stating the target role and the strongest evidence you have.
2. Skills, grouped as in section 5, limited to what your projects prove.
3. Projects and labs, moved above experience, because they are your security experience.
4. Experience, written to surface the security-adjacent parts of past jobs.
5. Certifications and education.

JORDAN REYES
Junior SOC Analyst | Phoenix, AZ | github.com/your-handle | example.com/writeups

SUMMARY
IT support technician (3 years, 600-person company) moving into security operations.
CompTIA Security+ (Oct 2026). Home SIEM lab with 25 detections mapped to MITRE ATT&CK
and 6 published investigation write-ups.

PROJECTS AND LABS
Home detection lab (Wazuh, Sysmon, 3 Windows and Linux VMs)            2026
- Simulated 18 ATT&CK techniques with Atomic Red Team; wrote and tuned 25 detections,
  published as Sigma rules on GitHub with test data for each.
Phishing investigation write-ups                                        2026
- Six case write-ups from public datasets: what fired, what I checked, what I
  concluded, what I would change. Average 1,200 words each.

EXPERIENCE
IT Support Technician, Coastline Logistics, Phoenix, AZ          Jan 2023 to Present
- Handled 30 to 40 tickets a day; first responder for user-reported phishing,
  triaging about 15 reports a week and escalating 9 confirmed credential thefts.
- Ran joiner and leaver access changes in Entra ID for 600 staff; wrote a
  PowerShell script that cut leaver deprovisioning from 40 minutes to 5.

The example uses invented names and figures to show the layout; yours must be real. Look at what it does. The title line names the target seat. The summary leads with the IT experience that ISC2's managers value, then the certification, then the proof. The projects read like work, with scale and outcomes. And the support job is written in security language without inflating it: phishing triage, access lifecycle, an automation. Every line there is something the person really did at a help desk.

What counts as security experience before your first security job

More than most career changers think, as long as you describe it honestly. Help desk work includes identity administration, endpoint management and phishing response. Systems administration includes hardening, patching, logging and backup recovery. Development includes secure code, dependency updates and fixing findings from a scanner. Audit and compliance work includes controls, evidence and risk. Military service may include operations, discipline under pressure and a clearance. The test is simple: could you explain to a security interviewer what you did, why, and what happened?

Projects fill the rest. The ones hiring managers open are a home lab with real logs and detections, written investigations, scripts that solve a real problem, contributions to open-source security tools, capture-the-flag results with your team's placement, and volunteer security work for a nonprofit or a small business (with permission, and described without exposing them). A course certificate on its own is not a project; what you built during the course might be.

Three things weaken a no-experience resume more than the lack of experience itself: a skills block of forty tools, the word "expert" anywhere, and a list of courses posing as experience. The internships page lists the student and graduate roles open today, and the board's guide on how to get into cybersecurity covers the routes into a first seat in depth.

11. Federal resumes and cleared contractor resumes

Federal applications changed in 2025, and much of the long-form advice still online is now wrong. Under the Office of Personnel Management's Merit Hiring Plan, USAJOBS has restricted every resume to two pages since 27 September 2025, covering resumes stored in a profile, uploaded files and resumes made with its builder. Where the only resume an applicant submits runs past two pages, the guidance says the applicant is ineligible for further consideration - OPM.

The same OPM guidance spells out what a federal resume should contain within those two pages. For each relevant job it asks for the job title and employer (with series and grade for federal posts), start and end dates as month and year, and the hours worked per week, with experience described in terms that line up with the announcement's required qualifications. It recommends uploading a PDF, a sans-serif font such as Lato or Calibri, half-inch margins, and roughly 14-point type for titles and 10-point for body text, and it lists a current security clearance among the details to include when relevant - OPM. The hours-per-week detail is the one private-sector resumes never carry, and its absence can cost you credit for experience.

Defense work adds the qualification rules. DoD Manual 8140.03 replaced the older 8570 manual in 2023 and allows experience to serve as an alternative to the foundational qualifications of education, training and certification - Nextgov. Contractor postings have kept using both numbers; the board's certifications page counted 26 postings citing one or the other on 11 November. On a contractor resume, put the certification that meets the posting's baseline and its status where a recruiter checking compliance sees it immediately, along with the clearance line from section 9.

12. AI, honesty and checks employers run

AI has changed both sides of the resume. On the applicant side, ISC2's 2025 report notes that recruiters are seeing more than 1,000 applications on the first day of some postings, which it attributes to AI-polished resumes submitted through automation - ISC2 2025 hiring trends study. When a thousand resumes all claim the same keywords in the same smooth prose, the polish stops distinguishing anyone, and the details that are hard to fake (specific numbers, specific tools, links to real work) carry the decision.

Employers have started to respond on the forms themselves, and the sample shows how. On 11 November, Chainguard's application asked candidates to pick whether they were "a human" or "an AI, bot, or automated program", and its written questions asked candidates not to use AI for any part of the application. Ramp's form asked applicants to work out a hidden answer in an earlier question, partly to prove they were not a bot applying automatically. Coinbase took the opposite tack for a security role and asked candidates for a short example of using AI to build and deploy automation for a security problem. Anthropic's forms carried a yes-or-no question about its policy on AI use in applications. The employers disagree about AI, but they agree that they want to know who, or what, wrote the application.

The practical line is easy to state. Use AI to check your resume, not to write claims for it: to find a missing requirement, catch a typo, tighten a sentence, compare your wording to a posting. Do not let it invent a metric, a tool you have not used, or a story you cannot tell. Twenty of the forms in the sample asked applicants to certify that everything submitted was true, and security interviews are built to test claims: ISC2 found 84% of organizations use skills-based assessments or tests for entry and junior applicants, and 54% of hiring managers had rejected a candidate because of social media activity - ISC2 2025 hiring trends study. Treat every line on the resume as a question you will be asked, and rehearse the answers: the board's interview practice lets you run the rounds a security interview uses and get written feedback on each answer.

Job seekers in security are also a target, and the resume is often the bait. A message offering to fast-track your application if you pay for a "certified resume rewrite", a recruiter who wants your identity number or bank details before any written offer, or an "interview" in a chat app that ends with a request to buy equipment are all classic patterns. The US Federal Trade Commission's advice is blunt: honest employers, the federal government included, will never ask you to pay to get a job - FTC. If a message about your application looks wrong, paste it into the board's job scam checker, which compares its links and senders with the real domains and careers systems of the employers the board follows.

13. A last pass before you press apply

Tailoring every resume from scratch is not realistic, but a fifteen-minute pass per application is, and it is where most of the value lies. Work through it in this order.

1. Read the gates first. Location, office days, sponsorship, citizenship, clearance. If one rules you out, stop here and save the time.
2. Mark the requirements. Copy the posting's requirements and preferences into a list. Note which are basic (in Workday's grading they decide whether you reach the top grades at all) and which are preferred.
3. Find each requirement on your page. For every requirement you genuinely meet, check that it appears in plain words, in the posting's spelling, in a bullet that proves it. Add or reword where it does not. Leave out what you do not meet.
4. Adjust the title line and summary to the role's title family and specialty.
5. Reorder bullets so the most relevant evidence sits first under each job.
6. Check dates and years. Month and year on every role; the total in the summary matches.
7. Check the file. Text-based PDF or .docx, single column, standard headings, links written out, file named with your name and the role.
8. Prepare the form answers. Salary range from the specialty pay pages, written answers consistent with the resume, LinkedIn consistent with both.
9. Proofread once on paper or out loud. Security work is detail work, and a typo in a tool name ("Splunck") is noticed by exactly the people you want to impress.

Keep each tailored version with the posting it was written for. If an interview comes weeks later, you will want to know exactly what you claimed.

14. Questions people ask about cybersecurity resumes

How long should a cybersecurity resume be?

One page for most people with under about five years of relevant experience, two pages for most experienced practitioners. Past two pages, cut older roles to a single line each. Federal applications through USAJOBS are capped at two pages by rule, and a longer resume makes the application ineligible.

Should a cybersecurity resume have a summary or an objective?

A summary. Three lines stating your specialty, years, environment and one piece of proof do more work than an objective, which describes what you want rather than what you offer. Put the key terms of your target specialty inside those sentences.

Which keywords should a cybersecurity resume include?

The ones in the postings you are applying to, spelled as they spell them, and only those you can back up. Across 500 sampled postings, the most common were Python, a named cloud provider (AWS, Azure, Google Cloud), Kubernetes, SIEM, IAM, EDR and infrastructure as code; each specialty adds its own, from ISO 27001 and SOC 2 in GRC to Burp Suite and OSCP in penetration testing. Write the category word and the product together, such as "SIEM (Splunk)".

Do applicant tracking systems reject resumes automatically?

The automatic rejections the major vendors document are rules on the application form, set by the employer and triggered by your answers to questions such as visa sponsorship or location. Greenhouse says its AI does not score or rank applications, while Ashby and Workday offer AI features that check or grade resumes against requirements the employer writes, with people acting on the results. The protection is the same in every case: answer the form truthfully and make each requirement you meet visible in plain words.

Where should certifications go on a security resume?

Near the top when the posting requires one or the role falls under a rule that does (defense roles under DoD 8140, for example); otherwise in a certifications section after experience. Write the full name, abbreviation, issuer, date and a credential ID or verification link.

Can I list a certification I am still studying for?

Only as what it is: "CompTIA Security+ (exam booked for January 2027)" is honest and useful. Listing it as held is a claim a verification lookup or background check will catch. Someone who passed the CISSP exam without the experience is an Associate of ISC2 and must write it that way.

What should a cybersecurity resume with no experience include?

A summary naming the target role, a short skills block, a projects section placed above experience (home lab, detections, written investigations, scripts), past jobs described in their security-adjacent terms, then certifications and education. Section 10 shows a complete example.

How is a SOC analyst resume different from a security engineer resume?

A SOC analyst resume proves triage, investigation and clear writing, with alert volumes, tools (SIEM, EDR) and escalations. A security engineer resume proves you built and ran controls, with systems, scale and code. On this board many detection seats now carry an engineer title, so an analyst moving up should use both vocabularies.

Do security jobs need a cover letter?

Rarely as a requirement: only 5 of the 396 application forms read in the sample required one, while 266 offered an optional field. A short, specific letter can help a career changer explain a move, but written questions on the form, which 114 forms included, are where employers more often ask you to explain yourself.

Should I put my security clearance on my resume?

Yes, when you hold one and are applying for cleared work: state the level and status plainly, for example "Active TS/SCI (T5)". Never list program names, compartments, digraphs or trigraphs, and describe classified work only in unclassified terms. Check any line you are unsure of with your security officer first.