Lead with security domain, environment and credentials
Open with a short summary that states your focus—SOC analysis, incident response, vulnerability management, security engineering, cloud or identity, or GRC and audit support—and the environments you know, such as enterprise IT, cloud, OT-adjacent networks or a regulated industry. Mention seniority cues like shift lead, detection-rule ownership, incident commander duties, control testing or audit coordination when they are accurate.
Place current certifications and, where relevant, clearance or citizenship notes where a scanner can find them quickly: Security+, CySA+, GCIA, GCIH, CISSP, CISM, OSCP or cloud security certificates only if they are current and you can discuss them. Mirror posting language only when it matches work you have done. Claiming threat hunting, purple-team work or SOC 2 ownership without examples invites a hard screen.
Write bullets that show investigation, control or audit outcomes
Strong security bullets name the environment, the work and a non-sensitive result. For SOC and IR roles, describe alert volume or sources at a high level, triage and investigation, containment or escalation, and improvements such as fewer false positives, faster mean time to detect or respond, or a playbook you wrote. For GRC, describe the framework (for example NIST CSF, ISO 27001 or SOC 2), control testing, policy updates, evidence collection, risk register work or audit findings closed.
Never invent metrics or disclose exploit details, unpatched production weaknesses, customer names or internal detections that could help an attacker. The fictional examples below illustrate wording only. They are not Make.CV performance claims and should not be copied as your own. Replace every figure with results you can support from tickets, metrics dashboards or audit trackers, and keep descriptions at a level your employer would approve in a public CV.
Show tools, frameworks and labs without jargon stuffing
Group skills into readable categories such as detection and SIEM, incident response, vulnerability and cloud security, identity, and GRC frameworks. Prioritize technologies named in the posting when you have genuine experience. A short accurate list of a named SIEM or EDR, ticketing workflow, cloud security reviews you performed, and the control frameworks you have used beats a long inventory of every vendor logo you have seen.
Tie important tools back to experience bullets. Saying you use a SIEM is more convincing when a bullet explains the data sources, the kind of detections you tuned and a measurable drop in noise or missed handoffs. Home labs, ranges or capture-the-flag work can support early-career applications when labeled honestly and tied to a method; they should not be presented as production incident ownership. Keep confidential architecture diagrams out of public CVs.
Choose a clean layout and review the export
Use a readable template with standard headings so domain, certifications, tools and outcomes stay easy to find. Keep dates consistent and leave room for quantified, non-sensitive bullets. Browse Make.CV templates if you want to compare layouts before writing.
Build your CV in the free maker with live preview, then download a PDF with no watermark. Check that certification initials, tool names and framework labels wrap cleanly. Confirm the exported text remains selectable before you submit.
Frequently asked questions
How should I shape a cybersecurity CV for SOC versus GRC roles?
Lead with the function in the posting. SOC and incident-response applications should emphasize monitoring, investigation, playbooks and response times. GRC applications should emphasize control frameworks, audits, policy, risk tracking and evidence. Keep shared fundamentals such as risk awareness, but do not force detection metrics onto a compliance role or audit language onto a SOC role.
Where should certifications or security clearance go?
Put current certifications, and clearance or eligibility when the role requires or prefers them, high on the page or in a dedicated Credentials section so screeners do not have to hunt. List only credentials that are current and that you can discuss.
Can I describe incidents and vulnerabilities in detail?
Stay high-level and non-actionable. Describe the type of event, your role, the response and a non-sensitive outcome. Do not publish exploit steps, unpatched weaknesses, exact detections or confidential customer or system names.
Do home labs or capture-the-flag work belong on the CV?
Yes when you are early-career or changing into security and the work shows relevant methods. Label it as lab or competition work, keep the description concise and lead with paid or operational experience when you have it.