Writing your first cybersecurity resume can feel difficult when you do not have professional security experience yet. That is normal. When employers review students for internships or entry-level roles, they do not expect years of experience. They are looking for evidence that you are willing to learn, can solve problems, and will contribute to a team.
Your resume can show that evidence through:
- Projects you completed at school or on your own
- Education, certifications, and relevant coursework
- Cybersecurity clubs, competitions, conferences, and other activities
- Work experience, even when it is not related to security
- Specific technical skills you have practiced
The goal is not to make yourself look like a senior security engineer. The goal is to clearly show what you have done, what you have learned, and what you could bring to the role.
A redacted copy of my own resume is in the appendix if you want something concrete to look at first.
Start with the role you want
A strong resume is written for a particular type of job. Read several job descriptions for the roles that interest you and look for recurring responsibilities, skills, and technologies.
For example, a security engineering role might emphasize coding and automation. A security operations role might emphasize log analysis, alert investigation, and networking. Your resume should highlight the experiences that are most relevant to the role you are applying for.
Do not misrepresent your experience or fill the page with keywords. Use the job description to decide which of your real skills and experiences deserve the most attention.
Keep a main copy of your resume in Google Docs or another editable service. This makes it easy to:
- Share it with other people for review
- Make a copy tailored to each application
- Keep backups
- Review how it has changed over time
Build a simple header
Your header should make it easy for an employer to identify and contact you. Include:
- Your name
- A professional-looking email address
- Your city and state
- Your GitHub profile, if you have one
- Your LinkedIn profile, if it is complete and presentable
City and state give a remote employer a sense of where you are based. You do not need to include your full home address. A phone number is optional. I leave mine off because I prefer to be contacted by email, but some application systems require one.
A short tagline or summary is optional. It can be useful when it quickly explains the direction you want to take. The tagline on the example resume told employers I wanted to build software and solve security problems, though the wording is vaguer than I would write today. A student version might read:
Aspiring security engineer interested in automation, detection, and incident response.
Turn experience into evidence
Include your work experience even if it is not related to cybersecurity. A restaurant, retail, volunteer, or other job can demonstrate skills that employers value:
- Problem-solving
- Responsibility
- Teamwork
- Communication
- Leadership
- Time management
As you gain relevant experience, you can drop the unrelated jobs. The example resume has none left.
For each position, include your job title, employer, location, and dates. Then add a few bullets that explain your contributions.
Start each bullet with a strong action verb such as:
- Built
- Developed
- Performed
- Documented
- Investigated
- Improved
- Automated
- Collaborated
Do not stop at describing a task. Explain the value your work created.
Instead of:
Helped train new employees.
Try:
Trained three new employees on closing procedures, helping the team complete nightly tasks consistently and on time.
Think through these questions when writing each bullet:
- What did I do?
- What skill did I use?
- Who did it help?
- What became faster, safer, easier, or more reliable?
- Can I support the result with a number or another concrete detail?
Use numbers when they are accurate and meaningful. For example:
- Cut weekly report generation time by 20 percent by automating the data pull
- Analyzed alerts for more than 20 customers across 5 industries
- Wrote detection rules that caught three malware families in the first month
Numbers like these are harder to find than they sound. You often do not measure your work while you are doing it, and by the time you write the resume the details are gone. I do not always include them, and the example resume has none. If you do not have a useful number, describe the qualitative benefit instead. Never invent a statistic just to make a bullet sound more impressive.
Keep verb tense consistent. One common approach is to use present tense for your current position and past tense for previous positions.
Use education to show what you are learning
If you are still in school, your education section can include:
- School and expected graduation date
- Degree, program, or pathway
- GPA, if you want to share it
- Relevant classes
- Cybersecurity program coursework and experiences, such as the Lakota Cyber Academy
- Certifications you have earned or are actively pursuing
As you gain professional experience, details such as GPA and coursework may become less important. Early in your career, however, they help show the foundation you are building.
Make projects a major part of the resume
Projects help compensate for limited professional experience. They show that you can choose a problem, learn the necessary technology, work through setbacks, and produce something you can explain.
A project does not have to be completely original. Choose an area related to the job you want, then use technology to solve a common problem or build a useful lab. For example:
- Build a small website to practice software development
- Configure a firewall to learn network security
- Create a homelab and investigate sample logs
- Set up a gaming server to learn Linux and system administration
- Write a Python script that automates a repetitive task
- Complete a detection or incident-response lab and document what you found
For each project, briefly explain:
- The problem or goal
- The technologies you used
- What you personally built or configured
- A challenge you encountered
- The result and what you learned
Be ready to discuss every project during an interview. A small project you understand deeply is more valuable than an ambitious project you cannot explain.
Include relevant activities
Extracurricular activities can show that you learn and collaborate with other people. You might include:
- Cybersecurity clubs
- National Cyber League or other security competitions
- Conferences and community events, such as Queen City Con, DEF CON, or Objective by the Sea
- Capture-the-flag events
- Volunteer work
- Relevant student organizations
When possible, describe your contribution or result. For a competition, you could include your placement as a rank or percentile. For a club, mention an event you organized, a presentation you gave, or a lab you helped complete.
As your projects and professional experience grow, you may decide to shorten or remove this section.
Be specific about technical skills
List technologies and skills you have actually used and could discuss in an interview. For an early cybersecurity resume, examples might include:
- Log analysis
- Linux administration
- Networking
- Virtualization
- Ethical hacking
- Python
- Git
- Security Onion
It can help to group skills into categories such as:
- Security
- Operating systems and infrastructure
- Programming languages
- Tools and platforms
Avoid rating yourself with progress bars or vague labels. If you want to communicate your level of experience, your project and experience bullets should provide the evidence.
Keep the final document easy to review
Unless you already have substantial relevant experience, aim for one page. Employers may review many applications, so the important information should be easy to find.
Before submitting it:
- Check spelling, grammar, punctuation, and verb tense
- Use consistent fonts, spacing, headings, and bullet styles
- Remove anything that does not help your application
- Confirm that every link works
- Ask classmates, instructors, mentors, friends, or family to review it
- Export it as a PDF. Word and Google Docs files can reflow when someone opens them on a different machine
- Name the file clearly, such as
FirstName LastName Resume.pdf
Review the exported PDF before uploading it. Make sure no content was cut off and that the document is readable at a normal zoom level.
Your resume is a living document
Your first resume will not be your last. Update it as you complete projects, learn skills, earn certifications, participate in competitions, and gain work experience. Tailor it for each type of role, as described in Start with the role you want.
Beyond the resume
A resume is only one part of starting your career. You can also:
- Create a LinkedIn profile and connect with classmates, mentors, and coworkers. Use that network to find jobs; many openings come through people you know
- Keep public social media presentable
- Join local and online communities with similar goals
- Follow changes in the security industry. Conference talks are posted online if you cannot attend in person
- Learn about the tools attackers and defenders currently use
- Keep building projects that give you something meaningful to discuss
- Prepare for the conversation itself: see Interviewing for internships
None of this is about appearing finished. It shows that you are learning, contributing, and ready for the next opportunity.
This guidance comes from my own experience applying for security engineering roles. It is one perspective, not a universal formula. Read advice from other professionals, compare examples, ask people to review your work, and keep what is useful for your goals.
The best first step is simple: create the document and write down what you have already done. You can improve the wording and formatting after the evidence is on the page.
Appendix: an example to work from
Below is a redacted, older version of my own resume. It was tailored for security engineering roles, which lean toward coding and automation. Your first resume will not look like this yet, and that is fine. It is here so the advice above has something concrete to point at.
Firstname Lastname
City, OH | firstname.lastname@example.com | github.com/username | linkedin.com/in/username
Passionate software engineer living at the intersection of code and security
Experience
Security Engineer, Vulnerability Management, financial services company, City, OH, June 2020 to present at the time
- Design, propose, and implement Python ETL applications that are deployed to GCP through a Jenkins pipeline, delivering vulnerabilities to stakeholders
- Evolve vulnerability reporting services from manual generation to an API that developers can interact with directly, leading to quicker remediation
- Balance long-term and short-term needs by creating immediate practical solutions for the team before adapting them to meet long-term business goals
- Provide leadership with automated metrics describing the state of our risk across the asset inventory
- Cross-collaborate with other engineering teams to bring various security services to the rest of the company
Software Engineer, consulting firm, City, OH, May 2019 to June 2020
- Developed Python plugins for a network file carving service to query machine learning container models and score the threat of a file or URL
- Operated MISP instances in AWS, enabling customers and internal teams to share threat intelligence
- Collaborated with a team to propose and architect a new file carving service using AWS managed services
Junior Reverse Engineer, consulting firm, City, OH, June 2018 to May 2019
- Developed a Python web app that scanned files for malicious indicators using Laika BOSS and our internal detection rules, then displayed the results in Cytoscape.js, saving significant time in SOC analysis
- Reverse engineered malware to extract intelligence and developed YARA rules to detect future occurrences
- Tracked and documented malware campaigns in a wiki to help analysts communicate with customers
Intrusion Analyst, consulting firm, City, OH, June 2016 to June 2018
- Developed Python scripts to automate threat hunting on network sensors, enabling analysts to quickly parse events
- Performed real-time, host-centric analysis on endpoint, network, and email data for customers from diverse industries
Education
BS in Information Technology, Concentration in Cyber Security, University of Cincinnati, graduated 2018
Projects
- URL Scanner: Angular/Flask web app that scans URLs for malicious indicators using Chrome DevTools and open threat intelligence
- Pykeeb: Angular/Flask web app that displays and tracks mechanical keyboard prices in the Reddit marketplace
- Finance Tracker: Tracks financial goals and expenses using Jupyter Notebook and Pandas
Skills
- Security platform integrations: Qualys, Rapid7, ServiceNow, Prisma Cloud, SentinelOne, Airlock Digital, Google Workspace
- Languages: Python (proficient), TypeScript and JavaScript (familiar), Go (familiar)
- Frameworks and libraries: Pandas, Flask, FastAPI, Selenium, JupyterLab, Asyncio, Pre-commit, Pytest
- Tools: MITRE ATT&CK, Git, Agile, CI/CD (Actions, GitLab, Jenkins), Docker Swarm, Kubernetes, MongoDB, Postgres, DynamoDB, Terraform, Jamf, Intune, Ansible, CNAB, Helm, Munki, YARA, Zeek, OLE tools, IDA Pro, x64dbg
This resume is not perfect, and the advice above applies to it. There are no numbers in any bullet. The bullet about balancing long-term and short-term needs describes an attitude rather than a result, and I would cut it today.