Security hiring has an evidence problem. Certifications are easy to list and hard to interpret, so hiring managers have learned to look past them for signs you have actually detected, investigated and contained something. That is what your CV needs to demonstrate.
What hiring managers screen for
Detection and response experience. Alerts triaged, incidents investigated, dwell time, false-positive rate. Concrete numbers here separate people who have worked a SOC queue from people who have studied for an exam.
Tooling depth over tooling breadth. Genuine fluency in one SIEM is worth more than a list of six. Interviewers ask how you built a detection rule, how you tuned it, and what it missed.
Judgement about risk. Security work is a constant negotiation between control and friction. Evidence that you have made that trade-off deliberately — and can explain a case where you accepted a risk — is a senior signal.
Communication. Much of the job is persuading engineers and executives to do something inconvenient. Bullets showing you drove adoption of a control matter as much as the control itself.
Metrics that make security work credible
- Alerts triaged per week, and false-positive rate before and after tuning
- Mean time to detect and mean time to respond
- Incidents investigated, and how many were true positives
- Vulnerabilities remediated, weighted by severity, and time-to-patch
- Phishing simulation click-through rate before and after training
- Coverage: endpoints, systems or business units monitored
- Audit or compliance outcomes — findings closed, controls passed
Before and after: security bullets
Weak: "Monitored security alerts and responded to incidents using Splunk."
Strong: "Triaged ~400 alerts/week in Splunk across 12k endpoints, and cut false positives 62% by rewriting 40 detection rules — reducing analyst time on noise by roughly 15 hours/week."
Why: monitoring alerts is the job description. Volume, coverage and the tuning work show you improved the queue rather than just working it.
Weak: "Performed vulnerability assessments and reported findings."
Strong: "Ran quarterly authenticated scans across 800 hosts and drove critical-severity time-to-patch from 45 days to 9 by agreeing SLAs with four engineering teams and publishing a shared remediation dashboard."
Why: finding vulnerabilities is easy; getting them fixed is the hard part and the part that reduces risk. The SLA negotiation shows the influence dimension of the role.
Weak: "Assisted with security awareness training for employees."
Strong: "Redesigned phishing simulation and training for 2,400 staff, cutting click-through from 18% to 4% over three campaigns and raising report rate to 61%."
Why: the report rate is the detail that shows real understanding — reducing clicks matters, but training people to report is what shortens detection time on a genuine attack.
A summary that positions you
Security analyst with 4 years in a 24/7 SOC covering 12k endpoints. Cut alert false positives 62% by rewriting detection logic, and reduced critical time-to-patch from 45 days to 9 by negotiating remediation SLAs with engineering. GIAC-certified, strongest in detection engineering and incident triage.
Certifications: which ones, and where
Certifications matter more in security than in most disciplines, because they are frequently used as hard filters. Security+ for entry level, GIAC certifications (GCIA, GCIH) for detection and response depth, CISSP for senior and management-track roles, OSCP where offensive skill is relevant.
List them prominently — a dedicated line near the top rather than buried at the bottom. Write the acronym and the full name, since postings vary in which they use. But keep them in proportion: a CV that leads with five certifications and contains no evidence of applied work reads as someone who studies rather than defends.
Skills worth listing
Core: SIEM operation and detection engineering, incident response, threat hunting, vulnerability management, log analysis, network fundamentals, malware triage, MITRE ATT&CK, risk assessment.
Tools: Splunk, Microsoft Sentinel, CrowdStrike, Wireshark, Nessus, Qualys, Burp Suite, Suricata, Python, PowerShell.
What gets security CVs rejected
- Certifications with no applied evidence. The most common pattern, and hiring managers are explicitly wary of it.
- Long tool lists with no depth in any one.
- No volume or coverage numbers, which makes the environment you worked in impossible to gauge.
- Vague incident language. "Responded to security incidents" without type, scope or outcome tells a reviewer nothing.
- Overclaiming. Security interviewers probe hard, and inflated claims fail fast in a discipline built on scepticism.
Next steps
See security analyst CV examples, or check your CV's ATS score free to find which sections are costing you points before you apply.