Cybersecurity Resume Examples

Cybersecurity Resume Example

Meet Njeri Wanjiku, a fictional cybersecurity practitioner covering 4,200 endpoints across 3 facilities. This example shows a broad defensive role, with containment time, patch compliance, and awareness results all measured rather than asserted.

Njeri Wanjiku

(256) 555-0117 ◇ Huntsville, AL

njeri.wanjiku@example.com ◇ linkedin.com/in/njeri-wanjiku ◇ njeriwanjiku.com

Objective

Cybersecurity practitioner with 10 years defending regulated environments, owning security operations across 4,200 endpoints and 340 servers at 3 facilities. Cut mean time to contain a confirmed incident from 9 hours to 40 minutes, closes 1,400 vulnerability findings a year, and took critical patch compliance from 71% to 98%. A generalist who came up through systems administration.

Education

B.S. in Computer Science, Redstone Line University 2011 – 2015

Coursework in Networks, Operating Systems, Cryptography, and Systems Security.

Certified Information Systems Security Professional, ISC2 2021

Also holds CompTIA Security Plus and the GIAC Certified Incident Handler credential.

Skills

Security Operations

Incident response, containment and eradication, forensic triage, threat hunting, log analysis, tabletop exercises

Vulnerability Management

Scanning and validation, risk-based prioritisation, patch programme ownership, configuration hardening, exception governance

Governance

Policy and standard authoring, control mapping, audit evidence, security awareness programmes, vendor risk review

Tools & Platforms

Splunk, CrowdStrike, Tenable Nessus, Microsoft Defender, Wireshark, Active Directory, Linux, Python scripting

Experience

Cybersecurity Specialist 04/2020 – Present

Redstone Crown Defense Systems Huntsville, AL

Own security operations for an environment of 4,200 endpoints and 340 servers across 3 facilities.
Cut mean time to contain a confirmed incident from 9 hours to 40 minutes across 3 years.
Close about 1,400 vulnerability findings a year and raised critical patch compliance from 71% to 98%.

Information Security Analyst 06/2017 – 03/2020

Monte Sano Line Aerospace Huntsville, AL

Ran vulnerability management across 2,600 assets and 40 application teams.
Led the response to about 60 security incidents a year, of which 9 required formal reporting.
Built the awareness programme that cut phishing click rates from 22% to 4%.

Systems Administrator 07/2015 – 05/2017

Monte Sano Line Aerospace Huntsville, AL

Administered 180 Windows and Linux servers supporting about 900 users.
Hardened 120 servers to a published benchmark, closing 40 configuration findings.
Automated patch deployment across 180 servers, cutting a 3-day cycle to 6 hours.

Projects

Containment Time Reduction. Took mean time to contain from 9 hours to 40 minutes by pre-authorising isolation actions and rehearsing them quarterly. The delay had never been technical, it was waiting for permission to unplug something.

Risk-Based Patching. Rebuilt patching around exposure and exploitability rather than raw severity score, which took critical compliance from 71% to 98% while the team actually patched fewer things per cycle.

Awareness Programme. Cut phishing click rates from 22% to 4% by replacing annual training with short monthly simulations and same-day feedback, and by removing the blame from reporting a mistake.

Extra-Curricular Activities

Mentor 4 analysts a year through a regional cybersecurity association programme.
Volunteer security advisor to 2 nonprofits, reviewing their systems annually.
Attend a Huntsville security meetup monthly and presented twice on incident response drills.

Leadership

Serve as incident commander for a security team of 6 across 3 facilities.
Trained 40 application owners on vulnerability triage and remediation ownership.
Introduced the quarterly incident response exercise now run across the whole organisation.

Use this resume

Cybersecurity Analyst Resume Example

Meet Kazimir Volkov, an analyst working a 24-hour security operations centre. This example is written for detection and investigation work specifically, built on alert volume per shift, false positive reduction, and confirmed incidents led.

Kazimir Volkov

(210) 555-0163 ◇ San Antonio, TX

kazimir.volkov@example.com ◇ linkedin.com/in/kazimir-volkov ◇ kazimirvolkov.com

Objective

Cybersecurity analyst working a 24-hour security operations centre covering 11,000 endpoints, triaging about 90 alerts a shift. Cut false positive volume 58% by tuning 140 detection rules across 3 log sources, and leads 24 confirmed incident investigations a year including 4 involving credential compromise. Detection and investigation work rather than engineering or advisory.

Education

B.S. in Cybersecurity, Alamo Line University 2014 – 2018

Coursework in Network Defense, Digital Forensics, Malware Analysis, and Operating Systems.

GIAC Certified Intrusion Analyst, GIAC 2022

Also holds CompTIA Security Plus and the Splunk Core Certified Power User credential.

Skills

Alert Triage

Alert investigation, severity classification, escalation criteria, shift handover, evidence preservation, case documentation

Detection

Detection rule writing and tuning, log source onboarding, false positive reduction, MITRE ATT&CK mapping, threat hunting

Investigation

Endpoint and network forensics, credential compromise analysis, phishing analysis, timeline reconstruction, root cause reporting

Tools & Platforms

Splunk, Microsoft Sentinel, CrowdStrike Falcon, Proofpoint, Wireshark, VirusTotal, Python, ServiceNow

Experience

Cybersecurity Analyst 05/2021 – Present

Alamo Crown Financial Services San Antonio, TX

Triage about 90 security alerts a shift in a 24-hour operations centre covering 11,000 endpoints.
Cut false positive volume 58% by tuning 140 detection rules across 3 log sources.
Lead about 24 confirmed incident investigations a year, including 4 involving credential compromise.

Security Operations Analyst 07/2019 – 04/2021

San Pedro Line Managed Security San Antonio, TX

Monitored 40 client environments and worked about 70 alerts a shift.
Wrote 60 detection rules and 30 response runbooks used across a team of 18 analysts.
Reduced average time to first analyst touch from 22 minutes to 5.

IT Support Technician 06/2018 – 06/2019

San Pedro Line Managed Security San Antonio, TX

Resolved about 40 tickets a week for 12 client organisations totalling 2,000 users.
Documented 25 recurring issues into runbooks used by a support team of 8.
Completed a security certification within 9 months and moved into the operations centre.

Projects

False Positive Reduction. Tuned 140 rules after tracking which alerts had never once led to action across 6 months. False positives fell 58%, which mattered because analysts had started closing a whole rule family without reading it.

Credential Compromise Playbook. Wrote the investigation playbook for credential compromise after 4 cases showed the team was checking the account but not the session tokens or the mail rules left behind.

Triage Time. Took time to first analyst touch from 22 minutes to 5 by reordering the queue on asset criticality rather than alert arrival order, so the environments that mattered were looked at first.

Extra-Curricular Activities

Compete in 4 capture the flag competitions a year, twice placing in the top 20 teams.
Maintain a home detection lab and publish rule write-ups to a personal blog.
Volunteer with a cyber skills programme, coaching about 20 students a year.

Leadership

Serve as shift lead for a security operations team of 9 on a 24-hour rotation.
Onboarded 5 analysts on triage practice and the escalation criteria.
Wrote 30 response runbooks now used across an operations centre of 18.

Use this resume

Fresher Cybersecurity Resume Example

Meet Chidinma Eze, a cybersecurity graduate with Security Plus, a 6-month internship, and competition results. This example shows how labs, capture the flag events, and detection rules that reached production carry a resume before the first permanent role.

Chidinma Eze

(201) 555-0148 ◇ Jersey City, NJ

chidinma.eze@example.com ◇ linkedin.com/in/chidinma-eze ◇ chidinmaeze.com

Objective

Cybersecurity graduate seeking a first security role, holding Security Plus and a 6-month security operations internship. Triaged about 40 alerts a day under supervision, documented 22 investigations end to end, and built 8 detection rules of which 5 reached production. No permanent security title yet, so this resume rests on alerts actually worked and rules that shipped.

Education

B.S. in Cybersecurity, Hudson Line University 2021 – 2025

GPA 3.8; coursework in Network Defense, Digital Forensics, Cryptography, and Secure Programming.

CompTIA Security Plus, CompTIA 2024

Completed 40 hours of hands-on labs and placed in the top 10% at 2 national capture the flag events.

Skills

Security Fundamentals

Alert triage, log review, phishing analysis, indicator lookup, escalation practice, case documentation

Technical Foundations

Networking and TCP/IP, Windows and Linux administration, packet analysis, basic malware triage, Python scripting

Detection Practice

Detection rule authoring, MITRE ATT&CK mapping, lab environment building, capture the flag problem solving

Tools & Platforms

Splunk, Microsoft Sentinel, Wireshark, Nmap, Burp Suite, VirusTotal, Kali Linux, Git

Experience

Security Operations Intern 01/2025 – 06/2025

Hudson Crown Financial Technology Jersey City, NJ

Triaged about 40 alerts a day under supervision in an operations centre covering 6,000 endpoints.
Documented 22 investigations end to end, 3 of which were escalated as confirmed incidents.
Built 8 detection rules in the training environment, 5 of which were promoted to production.

Undergraduate Teaching Assistant 09/2023 – 05/2025

Hudson Line University Jersey City, NJ

Supported a networks and security course of 120 students across 4 semesters.
Graded about 400 lab reports and ran weekly help sessions for groups of 20.
Built 6 hands-on lab exercises on packet analysis kept in the permanent course material.

IT Help Desk Assistant 06/2022 – 08/2023

Hudson Line University Jersey City, NJ

Handled about 30 support requests a week for 5,000 students and staff.
Imaged and deployed 140 laptops across 2 academic semesters.
Assisted a campus password reset affecting 5,000 accounts after a phishing campaign.

Projects

Home Detection Lab. Built a lab of 6 virtual machines with a log pipeline, then generated attacks against it to write and test detections. Five of the rules developed there were later adapted into production during the internship.

Capture the Flag Competition. Placed in the top 10% at 2 national events across forensics and network analysis categories, and published write-ups explaining the reasoning rather than only the answer.

Packet Analysis Labs. Built 6 teaching labs on packet analysis after watching students struggle with the same concepts, and the course kept them in the permanent material.

Extra-Curricular Activities

President of the university cybersecurity club, running 14 sessions a year for about 80 members.
Competed in 5 capture the flag competitions across 3 years of study.
Volunteer tutor for 12 first-year students in networking fundamentals across 2 semesters.

Leadership

Led a cybersecurity club of about 80 members through 14 sessions and 3 guest speakers a year.
Ran weekly help sessions for 20 students at a time across 4 semesters.
Built 6 lab exercises now used permanently in a course of 120 students.

Use this resume

Entry Level Cybersecurity Resume Example

Meet Broderick Hensley, 14 months into security after 9 years in IT operations. This example shows the career changer path, where deep knowledge of the estate and a real ransomware recovery become the argument for the move.

Broderick Hensley

(217) 555-0192 ◇ Springfield, IL

broderick.hensley@example.com ◇ linkedin.com/in/broderick-hensley ◇ broderickhensley.com

Objective

Entry level security analyst 14 months into a first security role after 9 years in IT operations at the same organisation. Handles about 55 alerts a shift across 3,400 endpoints, closed 320 vulnerability findings, and took ownership of monthly access reviews covering 1,200 accounts within 5 months. Knowing the estate before defending it is the advantage an operations background gives.

Education

B.S. in Information Technology, Lake Springfield Crown University 2012 – 2016

Coursework in Systems Administration, Networking, Databases, and IT Service Management.

CompTIA Security Plus, CompTIA 2024

Also completed a 200-hour cybersecurity programme in 2025 and is working toward CySA Plus.

Skills

Security Practice

Alert triage, vulnerability ticket handling, access review execution, phishing response, patch verification, escalation

Transferable Depth

Windows server administration, Active Directory, backup and recovery, endpoint imaging, change management, estate knowledge

Healthcare Context

Clinical system uptime constraints, patching around care schedules, protected health information handling, audit evidence

Tools & Platforms

Microsoft Defender, Microsoft Sentinel, Tenable Nessus, Active Directory, ServiceNow, PowerShell, Splunk

Experience

Security Analyst 07/2025 – Present

Sangamon Crown Health Network Springfield, IL

Handle about 55 alerts a shift and 15 vulnerability tickets a week across 3,400 endpoints.
Closed 320 vulnerability findings in 14 months, prioritised by exposure rather than severity alone.
Took ownership of monthly access reviews covering 1,200 accounts within 5 months of joining.

Systems Administrator 06/2019 – 06/2025

Sangamon Crown Health Network Springfield, IL

Administered 240 Windows servers and 3,400 endpoints across 9 clinical sites.
Cut patch compliance gaps from 26% to 4% across 240 servers over 3 years.
Recovered 2 ransomware-affected file servers with 0 data loss using tested backups.

IT Support Technician 07/2016 – 05/2019

Lake Springfield Line Manufacturing Springfield, IL

Resolved about 45 tickets a week for 700 users across 2 manufacturing plants.
Deployed 300 workstations across 2 refresh cycles with 0 unplanned downtime.
Wrote 30 procedures into a knowledge base used by a support team of 6.

Projects

Ransomware Recovery. Recovered 2 encrypted file servers with 0 data loss because the backups had been restore-tested quarterly rather than assumed. That incident is what prompted the move from operations into security.

Vulnerability Prioritisation. Closed 320 findings in 14 months by ranking on actual exposure rather than severity score alone, which meant internet-facing systems were fixed weeks before internal ones with the same rating.

Access Review Ownership. Took on monthly reviews of 1,200 accounts at 5 months in, work nobody wanted, and found 90 accounts belonging to people who had left or changed roles.

Extra-Curricular Activities

Attend a Springfield technology meetup monthly while studying toward further certifications.
Volunteer technology support at a community clinic roughly 2 Saturdays a month.
Mentor 3 IT staff a year who want to move into security roles.

Leadership

Serve as the security team point of contact for 9 clinical sites during patching windows.
Trained 12 IT staff on phishing escalation and endpoint isolation procedure.
Mentor 3 colleagues a year making the same move from operations into security.

Use this resume

Cybersecurity Engineer Resume Example

Meet Rania Sarkis, an engineer who builds controls rather than watching alerts. This example covers detection pipelines, response automation, cloud guardrails, and attack surface reduction across 900 cloud accounts.

Rania Sarkis

(703) 555-0125 ◇ Reston, VA

rania.sarkis@example.com ◇ linkedin.com/in/rania-sarkis ◇ raniasarkis.com

Objective

Cybersecurity engineer who builds and runs controls rather than watching alerts, owning security tooling across 900 cloud accounts. Cut mean time to detect from 6 hours to 11 minutes by rebuilding log pipelines across 40 sources, and automated 60 response actions that now handle 74% of containment steps without an analyst.

Education

B.S. in Computer Engineering, Potomac Line University 2010 – 2014

Coursework in Networks, Operating Systems, Distributed Systems, and Applied Cryptography.

AWS Certified Security Specialty, Amazon Web Services 2022

Also holds CISSP earned in 2019 and a GIAC cloud security automation credential.

Skills

Security Engineering

Endpoint detection deployment, log pipeline design, detection as code, response automation, tool integration, capacity planning

Cloud Security

Multi-account guardrails, infrastructure as code policy, identity and network controls, attack surface reduction, key management

Network Controls

Firewall rule lifecycle, segmentation design, rule review and pruning, zero trust patterns, egress control

Tools & Platforms

AWS, Terraform, CrowdStrike, Splunk, Wiz, Python, GitHub Actions, Kubernetes, Palo Alto firewalls

Experience

Cybersecurity Engineer 03/2020 – Present

Potomac Crown Cloud Services Reston, VA

Own security tooling across 900 cloud accounts covering endpoint detection, logging, and guardrails.
Cut mean time to detect from 6 hours to 11 minutes by rebuilding log pipelines across 40 sources.
Automated 60 response actions, which now handle 74% of containment steps without an analyst.

Security Engineer 06/2016 – 02/2020

Occoquan Line Technologies Herndon, VA

Deployed endpoint detection to 7,000 devices and tuned it to a 3% false positive rate.
Built infrastructure guardrails that blocked 1,200 non-compliant deployments in the first year.
Reduced the external attack surface from 340 exposed services to 46 across 18 months.

Network Security Administrator 07/2014 – 05/2016

Occoquan Line Technologies Herndon, VA

Managed 40 firewalls and about 900 rules across 6 sites and 2 data centres.
Removed 400 obsolete firewall rules after a full review, with 0 service disruptions.
Implemented segmentation across 12 subnets to isolate production systems.

Projects

Detection Pipeline Rebuild. Took mean time to detect from 6 hours to 11 minutes by rebuilding ingestion across 40 log sources, most of which had been arriving batched overnight rather than streaming.

Response Automation. Automated 60 containment actions, from account disable to host isolation, with a human approval gate on the destructive ones. Analysts now handle judgement calls rather than repetitive steps.

Attack Surface Reduction. Cut exposed services from 340 to 46 by inventorying what was actually reachable from the internet, which found 200 services nobody had known were public.

Extra-Curricular Activities

Maintain an open-source cloud guardrail library with roughly 700 monthly downloads.
Speak at regional cloud security meetups about twice a year on detection engineering.
Mentor 3 engineers a year moving from infrastructure into security roles.

Leadership

Lead a security engineering team of 4 covering tooling for 900 cloud accounts.
Set the detection as code standard now followed by 3 teams and 20 engineers.
Mentored 4 engineers into senior security roles across 6 years.

Use this resume

Cybersecurity Consultant Resume Example

Meet Torsten Bergmann, advising 22 client organisations a year. This example shows client-facing advisory work, measured in audit pass rates, assessments delivered, and the ability to put security risk in terms a board will act on.

Torsten Bergmann

(410) 555-0159 ◇ Baltimore, MD

torsten.bergmann@example.com ◇ linkedin.com/in/torsten-bergmann ◇ torstenbergmann.com

Objective

Cybersecurity consultant advising 22 client organisations a year, from 40-person firms to 9,000-employee groups. Led 30 SOC 2 and ISO 27001 readiness engagements of which 28 passed audit on the first attempt, and delivered 60 assessments producing prioritised roadmaps rather than raw finding lists. Client-facing advisory work, where explaining risk to a board matters as much as finding it.

Education

B.S. in Information Assurance, Chesapeake Line University 2009 – 2013

Coursework in Risk Management, Security Policy, Audit Practice, and Network Security.

Certified Information Systems Security Professional, ISC2 2016

Also holds CISA earned in 2018 and an ISO 27001 Lead Auditor qualification.

Skills

Advisory

Security programme design, maturity assessment, risk quantification, roadmap prioritisation, board and executive briefing

Compliance

SOC 2 and ISO 27001 readiness, control design and testing, evidence preparation, gap remediation planning, audit liaison

Technical Assurance

Penetration test scoping and coordination, vulnerability programme review, architecture review, third-party risk assessment

Tools & Platforms

Vanta, Drata, Tenable, Qualys, ServiceNow GRC, Microsoft 365, Visio, Excel

Experience

Cybersecurity Consultant 05/2019 – Present

Chesapeake Crown Advisory Baltimore, MD

Advise 22 client organisations a year, ranging from 40-person firms to 9,000-employee groups.
Led 30 SOC 2 and ISO 27001 readiness engagements, of which 28 passed audit on the first attempt.
Delivered 60 security assessments producing prioritised roadmaps rather than raw finding lists.

Senior Security Consultant 07/2015 – 04/2019

Patapsco Line Security Group Baltimore, MD

Ran about 40 risk assessments a year across healthcare, finance, and manufacturing clients.
Coordinated 25 penetration tests a year and translated findings for non-technical boards.
Built the assessment methodology used by a consulting team of 14.

Information Security Analyst 08/2013 – 06/2015

Patapsco Line Security Group Baltimore, MD

Supported about 30 client engagements a year on policy, control testing, and evidence gathering.
Reviewed roughly 400 security controls a year against published frameworks.
Wrote 50 client reports covering findings, risk ratings, and remediation steps.

Projects

First-Attempt Audit Record. Took 28 of 30 clients through SOC 2 or ISO 27001 on the first attempt by testing evidence 8 weeks before the audit window rather than assembling it during one.

Roadmap Approach. Replaced finding lists with sequenced roadmaps costed by effort and risk reduction, which is what made 60 assessments actionable. Clients had previously received 200-item spreadsheets and done nothing.

Board Communication. Built a reporting format that expresses security risk in business terms, now used across 22 client engagements a year and adopted internally as the standard deliverable.

Extra-Curricular Activities

Serve on the programme committee of a regional security association with about 400 members.
Provide pro bono security reviews to 3 nonprofits a year, about 30 hours each.
Guest lecture twice a year on risk management at a regional university.

Leadership

Lead engagement teams of up to 6 consultants across 22 client organisations a year.
Built the assessment methodology now used by a consulting practice of 14.
Mentored 5 analysts into senior consultant roles across 8 years.

Use this resume

Identity Access Management Architect Resume Example

Meet Sandhya Venkataraman, an identity architect covering 50,000 identities and 400 applications. This example treats identity as its own specialism, through privileged access reduction, lifecycle automation, and a single sign-on migration.

Sandhya Venkataraman

(972) 555-0186 ◇ Irving, TX

sandhya.venkataraman@example.com ◇ linkedin.com/in/sandhya-venkataraman ◇ sandhyavenkataraman.com

Objective

Identity and access management architect owning identity for 38,000 employees and 12,000 contractors across 400 applications. Cut standing privileged accounts from 2,400 to 180 by moving 9 platforms to just-in-time access, and reduced access request fulfilment from 6 days to 20 minutes by automating 240 entitlement workflows. Identity is the specialism, not a subset of general security.

Education

B.E. in Information Technology, Elm Fork Line University 2007 – 2011

Coursework in Directory Services, Networks, Databases, and Enterprise Systems.

Certified Information Systems Security Professional, ISC2 2017

Also holds SailPoint IdentityIQ and Okta Certified Consultant credentials, both kept current.

Skills

Identity Architecture

Single sign-on design, federation and SAML, identity governance, entitlement modelling, role design, zero trust access patterns

Privileged Access

Just-in-time elevation, privileged session management, credential vaulting, service account lifecycle, standing access reduction

Lifecycle & Governance

Joiner mover leaver automation, access certification campaigns, segregation of duties, orphaned account remediation, audit evidence

Tools & Platforms

SailPoint IdentityIQ, Okta, Microsoft Entra ID, CyberArk, Active Directory, PowerShell, Python, ServiceNow

Experience

Identity and Access Management Architect 02/2019 – Present

Elm Fork Crown Energy Irving, TX

Own identity architecture for 38,000 employees and 12,000 contractors across 400 applications.
Cut standing privileged accounts from 2,400 to 180 by moving 9 platforms to just-in-time access.
Reduced access request fulfilment from 6 days to 20 minutes by automating 240 entitlement workflows.

Senior Identity Engineer 06/2015 – 01/2019

Elm Fork Crown Energy Irving, TX

Migrated 400 applications onto single sign-on across 3 years with 0 unplanned outages.
Deployed multi-factor authentication to 38,000 users, reaching 99.4% enrolment in 8 months.
Built the joiner, mover, and leaver process that cut orphaned accounts from 3,100 to 40.

Directory Services Engineer 07/2011 – 05/2015

Elm Fork Line Systems Dallas, TX

Administered a directory of 22,000 accounts across 4 domains and 200 servers.
Consolidated 4 legacy domains into 1 forest across 18 months with 0 data loss.
Automated 80 recurring account tasks, removing about 1,100 manual actions a month.

Projects

Standing Privilege Elimination. Took privileged accounts from 2,400 to 180 by moving 9 platforms to just-in-time elevation. The hard part was proving to platform owners that elevation would be fast enough to use during an outage.

Joiner Mover Leaver Automation. Built lifecycle automation that cut orphaned accounts from 3,100 to 40. Movers were the real problem, since people changed roles and kept every entitlement they had ever been granted.

Single Sign-On Migration. Moved 400 applications onto single sign-on over 3 years with no unplanned outage, sequencing by user count so the noisiest failures would have happened on the smallest applications.

Extra-Curricular Activities

Speak at identity management conferences about twice a year on privileged access programmes.
Serve on a vendor customer advisory board representing about 30 enterprise organisations.
Mentor 4 engineers a year through a women in security mentoring programme.

Leadership

Lead an identity team of 7 covering 400 applications and 50,000 identities.
Chair an access governance board with 12 representatives from across the business.
Mentored 5 engineers into senior identity roles across 9 years.

Use this resume