Cyber Security CV: How to Get Security Interviews

Most cyber security CVs fail because they list tools and certificates instead of showing what the candidate investigated, fixed or decided. Hiring managers in security are flooded with applications: the UK government's Cyber security skills in the UK labour market 2026 report records employers overwhelmed by junior applications that lacked the right skills, and some suspected overclaimed skills or AI-written CVs. A good security CV is short, specific, honest and matched to one target role. This guide covers what a security CV has to prove, how to show technical and non-technical skills, how to tailor it for SOC, testing, GRC, engineering and identity roles, how to present certifications and labs, and how the CV changes as you progress. It is written for job seekers at every level and for hiring managers who want to know what good looks like. For the map of roles, see the Cybersecurity Careers Guide.

Key takeaways

Write for one role at a time. The National Careers Service advises matching your CV to the job advert and highlighting the skills asked for; in security that means a different version for a SOC, a GRC or a testing role.
Evidence beats adjectives. Describe each role or project with the STAR method (situation, task, action, result) and a number where you have one: alerts triaged, findings fixed, controls tested.
Entry-level competition is real. In the same 2026 report, only 16% of core UK cyber security job postings in 2025 asked for under one year's experience, so juniors need labs, projects and IT experience on the page.
Leave out what does not help. The National Careers Service says to exclude age, date of birth, marital status and nationality, and never to publish referees' contact details without consent.
Never overclaim. Every tool, technique and certification on a security CV can be tested at interview; one false claim loses the job and, in a trust-based profession, the reference.

What a security CV has to do

A security hiring manager reads a CV looking for three things: can this person do the tasks in the advert, can they be trusted with privileged access and sensitive information, and can they explain technical issues to other people. The US Bureau of Labor Statistics lists the important qualities of information security analysts as analytical, communication, creative, detail orientation and problem-solving skills. Your CV should prove each with an example, not claim it.

What the reader asks	Weak CV line	Strong CV line
Can you do the work?	"Experienced with SIEM tools"	"Triaged around 40 alerts per shift in Microsoft Sentinel; wrote two KQL detections for suspicious sign-ins that the team adopted"
Do you understand risk?	"Knowledge of ISO 27001"	"Collected evidence for 18 ISO/IEC 27001 Annex A controls for the first certification audit; no major nonconformities"
Can you communicate?	"Excellent communication skills"	"Wrote the monthly phishing report for the leadership team and ran three awareness sessions for 120 staff"
Are you curious?	"Passionate about cyber security"	"Built a home lab with Active Directory, Sysmon and Wazuh; published write-ups of 12 capture the flag challenges"
Can you be trusted?	"Honest and reliable"	"Administered privileged accounts for 300 users; designed the quarterly access review now used by IT"

The numbers in the strong examples are illustrations; use your own, and only ones you can explain.

Core skills and tools to show

The 2026 UK labour market report lists the skills most often requested in core cyber security postings in 2025: cyber security (66%), auditing (22%), governance (20%), ISO/IEC 27001 (20%), risk management (19%), incident response (18%), risk analysis (16%), Microsoft Azure (16%), automation (15%) and security controls (15%). AI skills appeared in 9% of postings, up from 4% in 2024. Use the advert's own words where they are true for you, because people and applicant tracking systems both look for them.

Technical skills section: group by area (networking, operating systems, cloud, scripting, security tooling) and keep it short. List only what you have used, and show where in the experience section.
Frameworks and standards: name the ones you have applied: ISO/IEC 27001, NIST CSF, MITRE ATT&CK, CIS Controls, OWASP. Say what you did with them, such as mapping detections to ATT&CK techniques.
Non-technical skills: report writing, stakeholder management, training others and incident communication. The report notes employers compete hardest for people who combine technical skills with people or management skills.
Language of the job: the NIST NICE Framework is a common language for cyber security work that employers use to write job descriptions and assess skills; ENISA's ECSF does the same in Europe. Mapping your experience to a NICE work role or ECSF profile helps you choose the right words. See the ENISA ECSF Skills Framework Guide.

Where identity fits: joiner, mover and leaver processes, access reviews, MFA rollouts, privileged accounts and service accounts or API keys appear in almost every security role. If you have done this work, even as a service desk analyst, put it on the CV in security terms. See the IAM Engineer Career Guide and the NHI and Machine Identity Engineer Career Guide.

Routes into the role: tailoring the CV

The National Careers Service structure works well for security: contact details (with a professional profile link if you have one), a short introduction on who you are and what you want, education, work history (most recent first) and optional references. Use a clear font at size 11 or larger, headings and bullet points. Place education before work history if you are early in your career; otherwise put work history first. Two pages is a common convention, though the official advice sets no length.

Target role	Lead with	Evidence that convinces	Related guide
SOC analyst	Monitoring, triage, escalation	Lab detections, log analysis write-ups, service desk incidents handled	SOC Analyst Career Guide
Penetration tester	Authorised testing, reporting	Capture the flag rankings, sample report with a clear finding and fix, bug bounty acknowledgements	Penetration Tester Career Guide
GRC analyst	Risk, audit, policy	Controls tested, audit evidence collected, policies written, risks tracked to closure	GRC Analyst Career Guide
Security engineer	Building and automating controls	Infrastructure as code, scripts, hardening baselines, cloud configuration	Security Engineer Career Guide
IAM engineer	Access lifecycle and authentication	SSO, MFA, provisioning and access review projects	IAM Engineer Career Guide

By starting point

Student or graduate: projects, dissertation, labs, competitions, society roles and part-time jobs that show responsibility. The 2026 report found 77% of core postings asked for at least a bachelor's degree or equivalent, so state your degree clearly with relevant modules.
IT professional: BLS notes many analysts previously worked in IT, often as network and systems administrators. Rewrite IT achievements in security terms: patching, backups, account management, incident handling.
Career changer: lead with transferable achievements, such as audit, investigation, compliance or teaching, and show security learning since. See the Career Change into Cyber Security Guide.
Apprentice applicant: show enthusiasm through evidence and use the standard's language, such as monitoring and escalating events. See the Cyber Security Apprenticeships and Graduate Schemes.

Portfolio and links

A short projects section with links to write-ups, a GitHub profile or a blog gives the reader something to check. Keep it clean: never publish client data, real vulnerabilities in systems you were not authorised to test, or credentials in code. A portfolio that leaks a secret is worse than none. See the Building a Cybersecurity Home Lab Guide.

Certifications that help on a CV

BLS notes that many employers prefer certified candidates. Certifications help most when they match the role and you can show you used what they taught.

Show them precisely: full name, awarding body, year and credential ID if the body offers verification. Put "in progress" with a target date only if you have booked the exam.
Match the level: entry-level candidates gain more from the CompTIA Security+ Guide or the ISC2 Certified in Cybersecurity (CC) Guide options than from listing study towards senior credentials. The CISSP Certification Guide explains why CISSP needs years of experience.
Do not let them replace evidence: a line under each certificate saying what you applied it to is worth more than a longer list.

Progression: how the CV changes

Entry level: one page of evidence is often enough; skills, labs and education carry the weight.
Mid-level (2 to 6 years): the 2026 report found 64% of core postings sought this range. Lead with outcomes: incidents handled, programmes delivered, controls automated, risks reduced.
Senior and lead: show scope (team size, budget, number of systems), decisions you made and how you influenced the business. Drop tool lists to a single line.
Leadership: board reporting, strategy, regulatory engagement and building teams. See the Path to CISO Career Guide.

Measuring your CV

Interview conversion: interviews per ten applications; a low rate means targeting or content problems.
Tailoring rate: share of applications sent with a CV adjusted to the advert.
Evidence ratio: share of bullets that describe an action and a result rather than a duty.
Interview recall: whether interviewers ask about your projects; if they never do, the projects are not visible enough.

Common failure patterns

The tool dump: a block of 40 product names with no context.
Generic AI text: polished but empty bullets that read like everyone else's; employers in the 2026 report said they suspect AI-written CVs.
Oversharing: confidential client names, internal incident details or screenshots from an employer's systems, which tells a security hiring manager you leak.
Unauthorised testing presented as experience: "found vulnerabilities in local businesses" signals a legal problem, not a skill.
Personal data overload: date of birth, nationality, home address and a photo add nothing and raise risk; the CV will be stored and shared.
Trusting every recruiter: fake recruiters target security and developer candidates; the Contagious Interview Threat Actor Profile Guide shows how a fake coding test delivered malware. Verify the employer before running anything they send.

Once the CV works, prepare for the next stage with the Cyber Security Interview Preparation Guide.

Practitioner checklist

Pick one target role and read three current adverts for it before writing.
Write a three-line introduction that names the role you want and why you fit.
Rewrite every bullet as action plus result, with a number you can explain.
Use the advert's skill words where they are true for you.
Add a projects section with links to clean, authorised work.
List certifications with body, year and verification ID.
Remove age, date of birth, marital status, nationality and referees' details.
Check every claim is something you can discuss in depth at interview.
Ask someone else to proofread, then tailor again for each application.

Cyber Security CV: Writing a CV That Gets Security Interviews