Technology / Cyber

Cyber Security Analyst CV example (UK)

A UK cyber security analyst CV for SOC and security operations roles: monitoring, incident response, tools, certifications and security clearance.

Example CV profile

Cyber security analyst with [two] years' experience in a 24/7 security operations centre (SOC) for [a managed security provider]. Triages alerts in [Microsoft Sentinel and Splunk], investigates phishing and suspicious sign-ins, and escalates confirmed incidents with clear, timely write-ups. [CompTIA Security+] certified and [holds SC clearance / eligible for UK security vetting].

Key skills to include (if true for you)

• Alert triage and investigation in a SIEM (e.g. Splunk, Microsoft Sentinel)
• Incident response and escalation, following playbooks
• Phishing analysis and email security
• Endpoint detection and response (e.g. Microsoft Defender, CrowdStrike)
• Vulnerability scanning and remediation tracking (e.g. Nessus, Qualys)
• Networking and log analysis (TCP/IP, DNS, firewall and proxy logs)
• Threat intelligence and MITRE ATT&CK mapping
• Scripting for automation (e.g. Python, PowerShell, KQL)
• Clear incident reports for technical and non-technical readers

Example experience bullet points

• Triaged an average of [n] SIEM alerts per shift on a 24/7 rota, closing false positives and escalating confirmed incidents to second line.
• Investigated phishing reports end to end: analysed headers and links, removed malicious emails and blocked senders and domains.
• Wrote [n] KQL detection queries for suspicious sign-ins and impossible travel, cutting duplicate alerts for the team.
• Ran monthly vulnerability scans across [n] servers and tracked critical findings with system owners until they were fixed.
• Mapped incidents to MITRE ATT&CK techniques and contributed to monthly threat reports for clients.
• Updated [n] incident response playbooks after post-incident reviews, so the next analyst had clearer steps.
• Supported the organisation's [Cyber Essentials / ISO 27001] work by collecting evidence and checking controls.

Illustrative only. Replace with your own real roles, dates and results — never copy experience you don't have.

Education & training

• CompTIA Security+ – [year] (or other certifications you hold, e.g. Microsoft SC-200, Blue Team Level 1, ISC2 CC)
• BSc (Hons) [Cyber Security / Computer Science] – [University], [year] (say if it's NCSC-certified), or a cyber security apprenticeship, such as Cyber Security Technologist Level 4
• Home lab or capture-the-flag (CTF) practice – [platform], ongoing (describe what you've built or learned)

Keywords UK recruiters screen for

cyber security analyst · SOC analyst · SIEM · incident response · threat intelligence · vulnerability management · Splunk · Microsoft Sentinel · MITRE ATT&CK · ISO 27001 · SC clearance

Tips for a cyber security analyst CV

• Name your tools. Recruiters and applicant tracking systems search for SIEM, EDR and scanner names, so list the ones you've actually used.
• Give evidence of investigation, not just monitoring: what you found, what you did and what changed as a result.
• State your clearance accurately: the level you hold now, or that you're eligible and willing to go through UK security vetting. Never overstate it.
• List certifications with the year, and only call them "in progress" if you've booked the exam.
• Moving from IT support? Lead with the security parts of your job: account lockouts, phishing reports, patching and access reviews.
• Keep it to two pages, and put a short technical skills section near the top so it's easy to scan.

Cyber security analyst pay varies widely by seniority, sector and clearance level, and some roles add shift allowances for 24/7 SOC rotas. Check the advert for the salary range. Salary checker (ONS data).

Official sources and further reading

• National Careers Service: Cyber intelligence officer job profile (routes, skills and vetting)
• GOV.UK: National security vetting: clearance levels
• NCSC: NCSC-certified degrees
• NCSC: Cyber Essentials overview

What hiring managers look for in a cyber security analyst

Security operations adverts vary, but most come back to the same evidence:

• Hands-on tools. A SIEM, endpoint detection and response, email security and vulnerability scanners. Name the products.
• Investigation, not just monitoring. How you triaged an alert, what you found and what you did next.
• Clear writing. Incident notes and reports that a manager or client can act on.
• Frameworks. MITRE ATT&CK, NIST, ISO 27001 or Cyber Essentials, where you've genuinely used them.
• Clearance and trust. Especially for public sector, defence and government suppliers.

The National Careers Service's cyber profile lists tasks such as identifying common weaknesses in IT networks, analysing threats, monitoring new threats and producing threat assessment reports. Paste the advert into the free job ad keyword extractor to see which tools and frameworks it asks for.

Security clearance on your CV

For public sector work, the National Careers Service says you may need to go through UK Security Vetting. GOV.UK's national security vetting clearance levels guidance says Security Check (SC) is for posts that "require them to have long-term, frequent and uncontrolled access to SECRET assets and/or occasional, supervised access to TOP SECRET assets". Developed Vetting (DV) is for posts that "require them to have frequent and uncontrolled access to TOP SECRET assets or require any access to TOP SECRET codeword material".

On your CV:

• if you hold clearance, state the level and that it's current, such as "Active SC clearance"
• if you don't, but meet the advert's eligibility, say "Eligible and willing to undergo UK security vetting"
• never overstate your level. It's checked before you start

Breaking in: IT support, apprenticeships and graduates

Many analysts move across from IT support. In England, the National Careers Service lists routes including a degree, apprenticeships such as the Cyber Security Technologist Level 4 Higher Apprenticeship, and working your way up from an IT role. Apprenticeship names and levels differ in Scotland, Wales and Northern Ireland. On your CV, show:

• the security side of your IT work: phishing reports, account lockouts, patching, access reviews, backups
• a home lab: what you built, which logs you collected and what you detected
• capture-the-flag challenges or online labs, described as skills rather than scores

See the IT support technician CV example and the graduate CV example. For the cover letter, the software developer cover letter example is the closest technical model.

Check it before you send it

Run your CV through the free CV checker to see how an applicant tracking system reads your skills section, with a suggested fix for each issue. Starting from scratch? Try the free CV builder, and read how to tailor your CV to a job description.

FAQs

Related examples

• IT Support Technician CV example
• Software Developer CV example
• Data Analyst CV example
• Business Analyst CV example
• Graduate CV example

UK CV format · Skills to put on a CV · How to tailor your CV to a job description · Cover letter examples · All UK CV examples