Cybersecurity Analyst CV: what to include

Updated 16 September 2026 · 2 min read

A cybersecurity analyst CV must show real security capability while keeping sensitive details confidential. Employers want evidence that you can detect and investigate threats, understand controls, and handle access responsibly. This guide explains how to present that evidence, and what to avoid.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Start with the advert

List the required qualification, experience, tools and skills, such as SIEM experience, incident response or vulnerability management. Make each requirement easy to find in your CV, using the advert's terms where they honestly describe your work.

Describe security work without revealing secrets

You can show experience without exposing an employer's weaknesses. Write "Investigated phishing campaigns and led remediation, including credential resets and removal of malicious mailbox rules" rather than naming specific systems or unresolved vulnerabilities. Panels notice when candidates handle confidentiality well.

Show results and scale

Specific details strengthen a CV: "Monitored alerts for an organisation of 2,000 users", "Reworked a noisy detection rule, freeing analyst time for real investigations" or "Coordinated remediation of critical vulnerabilities across 150 servers". Numbers that show scale help, as long as they are accurate.

Labs, competitions and certificates

If your professional security experience is limited, add a section on labs, capture-the-flag competitions and projects, describing what you built or investigated. List certificates with dates, such as Security+ or CySA+.

Show your reasoning, not only your tools

Security panels care how you think. Where space allows, describe an investigation in one line that shows method: what you noticed, what you checked and what you concluded. A CV entry such as "Investigated repeated failed logons, traced them to a misconfigured service account and corrected it with the system owner" demonstrates more capability than a list of platforms you have opened.

A clear structure

Contact details and a short, security-focused profile.
Experience, most recent first, emphasising security tasks.
Education.
Certificates with dates.
Technical skills grouped by area: monitoring, network security, identity, vulnerability management and scripting.
Referees.

Mistakes to avoid

Listing security tools without showing what you did with them.
Revealing confidential details about a previous employer's systems or incidents.
Overstating experience, which technical interviews quickly expose.
Leaving out the foundational IT experience that makes you a stronger analyst.

Open adverts for this position

No open Cybersecurity Analyst advert matched when the jobs board was last checked. It is refreshed every morning.

Browse every open vacancy

Common questions

Should I include my capture-the-flag results?

Include notable results or completed challenges when they are relevant, and describe the skills they demonstrate rather than only the ranking.

Should I list every certificate I have?

List the relevant ones, most advanced first. Foundational IT certificates are still worth including early in a security career.

How do I describe work covered by a confidentiality agreement?

Describe the type of work and your role in general terms, without naming clients, systems or incidents. If in doubt, leave the detail out and explain in the interview what you are able to share.

Should I put my home lab on my CV?

Yes, when your professional security experience is short. Describe what you built and what you investigated with it, because that is evidence of skill rather than of enthusiasm alone.