On this page
- Resume guide for a cyber security resume
- How to write a cyber security resume
- Choosing the best resume format for a cyber security resume
- Include your contact information
- Make use of a summary
- Right vs wrong: the same cyber security summary, twice
- Outline your security experience
- Map every claim to a named control framework function
- Build a snapshot of your key skills
- List your education and certifications
- Choose the right layout and design
- Cyber security job market and outlook
- What salary you can expect in cyber security
- Key takeaways for a cyber security resume
- Related information technology resume examples
- FAQ
In short, a cyber security resume is a one to two page document that names the control framework your work sits inside, the assessments you were in scope for, and the findings you closed or documented as accepted risk.
"Cyber security" is not one job. In fact, it covers the person who writes the policy, the person who runs the access review, the person who answers the auditor, and the person who tells the board what the residual risk is. A hiring manager is reading to work out which of those you are; however, most files answer by claiming all of them and evidencing none. Still, there is a published vocabulary for answering properly, and your readers already argue in it.
Resume guide for a cyber security resume
Specifically, this guide and the corresponding cyber security resume example will cover:
- How to write a cyber security resume, section by section
- Mapping every claim to a named control framework function
- Three adaptable summaries: first security role, practitioner and lead
- The assessment record: findings closed, and exceptions accepted
- What the job market looks like and what you can expect to earn
How to write a cyber security resume
Overall, six sections: contact header, summary, certifications, a control and assessment block, security experience, and education. Generally, one page in your first three years, two once you own a control area and face an auditor.
Certifications sit high because here they are often a posting filter rather than a flourish. The control and assessment block sits beneath them because it says what kind of security person you are.
SectionWhat it is answeringWhere it goes
- CertificationsDoes this file clear the bar the posting wrote down?Under the summary, with authority and year
- Control and assessment blockWhich functions do they cover, and who has audited their work?Its own block, before experience
- ExperienceWhat did they change, and what evidence exists that it changed?Reverse chronological, with numbers
- EducationDoes it clear the stated degree line?Bottom, unless you graduated this year
Name the framework and its version, not 'industry best practices'
NIST published NIST CSWP 29, "The NIST Cybersecurity Framework (CSF) 2.0", on 26 February 2024, and it organizes cybersecurity risk management into six Core Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER.
"Control library mapped to the six CSF 2.0 Core Functions, reviewed annually" is a sentence a reader can test in an interview. "Familiar with security frameworks and industry best practices" is not, and it is in half the folder. A named framework with a version gives the reader a map; an unnamed one gives them a mood.
Run the finished file through the ATS resume checker first. Regulated employers and government contractors parse applications into a structured record before anyone opens them.
Choosing the best resume format for a cyber security resume
Reverse chronological, then, with the control and assessment block breaking the pattern between your certifications and your first job. One page for your first three years, two after that.
Functional formats fail because security hiring is a trust decision, and trust is read off continuity: how long you held a control area, and whether you stayed long enough to see a remediation through.
Include your contact information
Marcus Vanhooser
Information Security Analyst, Governance and ControlsCISSP, CompTIA Security+(614) 555-1722, marcus.vanhooser@example.com, Columbus, OHMarcus Vanhooser
Cyber security professional seeking a challenging roleMultiple security certifications(614) 555-1722, cyberguy1722@email.exampleAlso, put the shape of your work in the title line. "Cyber Security Specialist" does not say whether you write policy, run access reviews, test controls or answer auditors, and those are four separate openings. At the same time, leave off any system, vendor or finding identifier from an audit report.
Make use of a summary
In short, four lines: your function coverage, your years, who checks your work, and one number tied to controls or findings.
First security role adaptable resume summary example
Practitioner adaptable resume summary example
Lead adaptable resume summary example
Right vs wrong: the same cyber security summary, twice
For example, the left column can be handed a control area on Monday. The right column, on the other hand, has read a job advert, and a hiring manager with an audit in nine weeks is not hiring a reader.
Outline your security experience
Then list employer, function coverage, dates, and one line on the environment: sector, regulator, size. Then three to five bullets, each naming something that changed and what proves it did.
- Instead of
Responsible for security policies and procedures
UseOwn 14 security policies mapped to the CSF 2.0 Core Functions, reapproved by the risk committee in March 2026
- Instead of
Performed user access reviews
UseRun quarterly access recertification across 41 applications and 2,300 accounts; the first cycle removed 318 entitlements nobody could name an owner for
- Instead of
Assisted with audits
UseRan evidence collection for two external audits and nine customer security assessments, cutting the evidence request cycle from 14 days to 4
- Instead of
Improved the security posture
UseTook multifactor authentication from 62% to 100% of staff and administrative accounts in two quarters
Adaptable resume employment history example
Information Security Analyst, Muskingum Mutual Insurance Group, Columbus, OH, June 2020 to Present
Property and casualty insurer, about 1,900 staff, examined by the state insurance department and subject to annual external audit.
Maintain the control library mapping 14 security policies to the six NIST Cybersecurity Framework 2.0 Core Functions, with a named owner and a test method on every control.
Ran evidence collection for two external audits and nine customer security assessments last year; the request cycle fell from 14 days to 4 after I built a standing evidence set refreshed quarterly.
Closed 61 of 74 assigned findings inside their agreed dates; the remaining 13 carry written exceptions with compensating controls, named risk owners and review dates.
Run quarterly access recertification across 41 applications and about 2,300 accounts, removing 318 unowned entitlements in the first full cycle.
Map every claim to a named control framework function
This is what separates a security resume from a page of security words; moreover, it is built on a document the reader can open.
Specifically, NIST published NIST CSWP 29, "The NIST Cybersecurity Framework (CSF) 2.0", on 26 February 2024. For example, it organizes cybersecurity risk management into six Core Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER. GOVERN, in particular, is the function added in 2.0, and NIST defines it as the function under which "the organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored".
Therefore, write one line of what you can genuinely evidence under each. Indeed, the honest empty ones are informative too.
| Function | What a resume can actually evidence under it | What fails |
|---|---|---|
| GOVERN | The policy you wrote, who approved it and when; the risk register you keep; the exception process you run; the committee you report to | "Supported governance activities" |
| IDENTIFY | The asset inventory and what share of the estate it covers; the data classification you applied; the risk assessment you performed and what it changed | "Maintained asset lists" |
| PROTECT | The control you took from partial to complete, with a before and an after: authentication coverage, privileged access review cadence, training completion | "Implemented security controls" |
| DETECT | The visibility you added: which system classes send logs now that did not before, and the monitoring gap you closed | "Monitored for threats" |
| RESPOND | The plan you wrote or rewrote, the exercise you ran with a participant count, and the change the exercise produced | "Responded to incidents" |
| RECOVER | The recovery objectives you agreed with each business owner and wrote down, and who may declare recovery complete | "Assisted with disaster recovery" |
GOVERN and DETECT on a cyber security resume
GOVERN is the line most applicants leave blank, and it is the most valuable one on the page: it distinguishes a candidate who can be left alone with a regulator from one who cannot. If you have written a policy, run a risk register entry to closure, or presented to a committee, that belongs at the top of your block rather than buried in a bullet about meetings.
DETECT is where a general security resume most often drifts into somebody else's job. If you worked a monitoring queue, that is its own occupation and our SOC analyst resume example is written for it. If not, write DETECT as coverage: what the organization can now see that it could not before you arrived.
The assessment record
Then the part that turns the map into evidence: who checked your work, and what they found.
The assessment you were in scope for. Name the kind, not the report: an internal audit, an external audit with an IT general controls scope, a customer security assessment, a penetration test, a regulator examination. Say what was in scope, how often it runs, and your role in it.
The finding you closed. One line each for the two or three worth writing down: what it was about, the rating the assessment gave it in its own scale, what actually closed it, and the date it was accepted as closed. That last clause makes it a fact rather than an intention. "Remediated a high-rated finding on privileged account review by moving the review into a quarterly attestation with a named approver; accepted as closed in the November 2025 follow-up" is a complete claim.
The exception you documented rather than fixed. This is the line that reads as senior, and it is almost never on a resume because people assume it is an admission. It is the opposite: security work that cannot say no gracefully is not a program. Write the compensating control, the named risk owner and the review date.
Adaptable resume control and assessment block example
Framework: control library mapped to the six NIST Cybersecurity Framework 2.0 Core Functions, 14 policies, every control with an owner and a test method.
GOVERN: own the cybersecurity risk management policy and the risk register; report quarterly to the enterprise risk committee.
IDENTIFY: asset inventory covering 100% of servers and 97% of managed endpoints, reconciled monthly against the identity directory.
PROTECT: multifactor authentication on 100% of staff and administrative accounts, from 62% two years ago; quarterly access recertification across 41 applications and about 2,300 accounts.
DETECT: log coverage extended to all internet-facing systems and all domain controllers during the 2025 program.
RESPOND: rewrote the incident response plan in 2025; facilitate an annual tabletop for 22 participants across 6 business units.
RECOVER: recovery objectives agreed and recorded with the business owner of each of 31 in-scope applications.
Assessments: two external audits and nine customer security assessments a year, plus a state insurance department examination in 2024. 61 of 74 findings closed inside agreed dates; 9 open exceptions, each with a compensating control, a named owner and a review date.
After all, audit and examination reports belong to your employer and are often covered by an agreement you signed. Consequently, give the shape of the work, the counts and the outcome, and no more.
Build a snapshot of your key skills
Twelve to eighteen entries in four labeled groups, so a reader scanning for one gap finds it in a single pass.
Adaptable resume skills example
Governance and risk: Security policy authoring, risk register ownership, risk exception and acceptance, third-party security review, awareness program, committee reporting
Controls and assurance: Control design and testing, evidence collection and sampling, internal and external audit support, customer security assessments, remediation tracking
Technical practice: Identity and access management, privileged access review, multifactor authentication rollout, vulnerability remediation coordination, cloud configuration baselines, encryption and key handling
Resilience and communication: Incident response planning, tabletop facilitation, recovery objective setting, plain-language briefing for non-technical executives, SQL and PowerShell for evidence sampling
Also note what is missing: adjectives. "Detail-oriented" occupies a line that "privileged access review" wanted.
List your education and certifications
Certifications first with authority and year, then the degree. Meanwhile, two credentials do most of the gating.
| Credential | What the authority publishes about it | Authority |
|---|---|---|
| CompTIA Security+ | Current exam series SY0-701, launched 7 November 2023. Five domains with published weightings: general security concepts 12 percent; threats, vulnerabilities and mitigations 22 percent; security architecture 18 percent; security operations 28 percent; security program management and oversight 20 percent | CompTIA, September 2026 |
| ISC2 CISSP | A published requirement of five years of work experience, which is why it belongs on a lead file and not on a first-role file | ISC2, September 2026 |
Read the Security+ weightings as a description of the job rather than a study plan. Security operations is the largest single domain at 28 percent, but program management and oversight at 20 percent and architecture at 18 percent together outweigh it. However, a resume built only around operations describes a quarter of the published body of knowledge.
Adaptable resume education and certifications example
Certifications: ISC2 CISSP (2023). CompTIA Security+, SY0-701 (2017, current).
Bachelor of Science, Information Systems, The Ohio State University, Columbus, OH, 2015
Choose the right layout and design
Likewise, single column, 10 or 11 point body type, plain headings, no photograph, no graphics, no skill bars. PDF unless the portal asks otherwise. After all, two-column templates are where parsing breaks, and a file whose certifications arrive interleaved with its education has lost the screen looking for CISSP.
Do
- Name the framework and its version.
- Write one evidence line per function and leave the honest gaps visible.
- Give the assessment type, the finding count and the date findings were accepted as closed.
- Write one exception with its compensating control and review date.
Don’t
- Do not write "improved the security posture"; it evidences nothing.
- Do not name a system, vendor, auditor or finding reference from a report you worked on.
- Do not list a certification you are studying for as though you hold it.
- Do not claim the monitoring work of a team you were not on.
Cyber security job market and outlook
In summary, strong growth from a small base, an unusually favorable combination for a candidate.
| Measure | Value |
|---|---|
| Information security analyst jobs, 2025 | 192,900 |
| Projected change, 2025-35 | 21% (much faster than average), +40,600 |
| Projected annual openings | About 14,100 |
| Typical entry-level education | Bachelor's degree |
| Work experience in a related occupation | Less than 5 years |
| Median annual wage, May 2025 | $129,180 |
Above all, the line to read twice is the experience line. BLS records this occupation as typically requiring experience in a related occupation rather than being entered directly. If that is your route, the service desk or systems years are not filler: they are why your control claims are credible, and they belong on the page as security-adjacent work, naming what you hardened, reviewed and escalated.
Crossing from IT into security is worth $30,050 at the median
Information security analysts had a median annual wage of $129,180 as of May 2025. Network and computer systems administrators, the occupation many security practitioners transfer in from, had a median of $99,130 in the same cycle, a difference of $30,050. The wider computer and information technology group had a median of $109,470, so information security sits well above the middle of its own field (BLS, May 2025).
What makes the crossing happen is documentation rather than tooling. An administrator who has run an access review, produced audit evidence and written a procedure has already done security work; the resume only has to file it correctly.
What salary you can expect in cyber security
To begin with, the median annual wage for information security analysts was $129,180 as of May 2025, which is $62.11 an hour. The lowest 10 percent earned less than $75,090 and the highest 10 percent more than $199,850 (BLS, May 2025).
| Industry | Share of employment, 2025 | Median annual wage, May 2025 |
|---|---|---|
| Computer systems design and related services | ||
| Finance and insurance | ||
| Management of companies and enterprises | ||
| Information | ||
| Management, scientific and technical consulting services |
What moves you inside that band is breadth of function more than depth in any one. For instance, a candidate who can evidence work under five or six of the CSF 2.0 functions is priced as someone who can own a program; one who can evidence a single function is priced as someone who runs a process well.
The second lever, meanwhile, is who audits you. In particular, work under an external auditor, a regulator or a customer assessment program leaves an evidence trail a resume can cite and an interviewer can probe.
Finally, the third is the one candidates forget to write down. If you have presented to a risk committee, a board, or an executive outside technology, say so. Indeed, explaining residual risk to the people who will accept or reject it separates the top of that band from the middle.
Key takeaways for a cyber security resume
- First of all, name the framework and the version; CSF 2.0 was published 26 February 2024 with six Core Functions.
- Then write one evidence line per function, and let the honest gaps show.
- Fill GOVERN if you can; it is the function most applicants leave empty.
- Also give the assessment type, the findings closed, and the date they were accepted as closed.
- In addition, write one documented exception with its compensating control and review date.
- Similarly, keep a monitoring team's work off your page unless you did it, and never name a system or finding from a report.
- Finally, put certifications with their authority and year directly under the summary.
Related information technology resume examples
- SOC analyst resume
- Network engineer resume
- Network administrator resume
- System administrator resume
- IT specialist resume
- IT manager resume
- IT director resume
- Network systems analyst resume
- DevOps engineer resume
- Solution architect resume
- Computer engineering resume
- IT help desk resume
Cyber security resume questions, answered
How long should a cyber security resume be?
One page for your first three years, two once you own a control area, face an auditor or write policy. The control and assessment block earns its space at either length.
What certifications do I need for a cyber security job?
CompTIA Security+ is the usual first credential; its current exam series is SY0-701, launched 7 November 2023, with five published domains (CompTIA, September 2026). ISC2 publishes a five year work experience requirement for CISSP (ISC2, September 2026), so it is a mid-career credential. Beyond those two, read the posting.
How do I write a cyber security resume with no security job title yet?
File the security work you have already done under the framework functions. Access reviews and account provisioning are PROTECT. Asset inventory and patch scoping are IDENTIFY. Log coverage work is DETECT. Writing a procedure someone approved is GOVERN. BLS records related work experience as typical here, so a systems or support history is an asset.
Should I put specific findings or vulnerabilities on my resume?
No. Give the class of finding, the rating it carried in the assessment's own scale, what closed it and when it was accepted. Never name the system, the vendor, the reference number or the flaw. A reviewer who sees identifying detail from one report assumes you will do the same with theirs.
Is a degree required for a cyber security job?
BLS gives a bachelor's degree as the typical entry-level education for information security analysts, along with experience in a related occupation (BLS, 2025-35 projections). In practice many employers hire on demonstrated control work and a named certification.