SOC Analyst Resume Template
A level 1 SOC analyst resume built from a real job ad: the target job as the title, the tools from the ad with what you did with them, and a home lab that counts as experience.
The candidate of this template is fictional: keep the structure, replace the content with yours.
This template belongs to a level 1 SOC analyst applying to a public job ad from a major bank in Douala, Cameroon, on a permanent contract. The job is to monitor the bank's information system around the clock: analyse alerts (SIEM, EDR, firewall, IDS/IPS, antivirus, DLP), qualify incidents, escalate them to level 2, keep tickets up to date, track the security coverage of workstations, servers and cash machines, and run vulnerability scans. The ad asks for a three- or four-year degree in computing, cybersecurity, networking or telecoms, and 1 to 2 years of experience. The candidate is fictional and the numbers are examples: keep the structure and the way each line is written, then replace the content with your own career. Here you will find the words from the ad that matter, one resume line for each, and a template ready to download as PDF or Word.
A SOC recruiter reads a resume like an alert: they look for tool names and facts, not adjectives. "Dynamic young graduate" or "Proficient in Word, Excel and the Internet" tells them nothing. Write the target job, the tools from the ad and what you did with them.
What the recruiter is really looking for
Someone who can read an alert, decide whether it is serious and hand it over cleanly. Take the words from the ad and back each one with a concrete line.
Level 1 SOC analyst
Put the target job as your title, right under your name, with your degree: SOC Analyst, Level 1 · Master's year 1 in networks and security. The recruiter knows in one second that your resume answers their ad.
Splunk, ELK, QRadar
These three names are written in the ad: they are SIEMs, the tools that gather alerts. Name the ones you have really used, and say how: SIEM: ELK (Elasticsearch, Kibana), Splunk (labs), basics of QRadar. Do not list a tool you have never opened: you may be asked to use it in the interview.
Alert analysis and qualification
For a first job, a home lab weighs as much as an internship. Install a free version of ELK or Wazuh at home, simulate an attack and write what you detected: Home ELK lab: simulated SSH attack, 214 attempts detected, alert rule written in Kibana.
Dashboards and activity reports
The SOC reports on its work. Your final-year project can show it: ELK alert dashboard for the campus network: 4 alert types, thresholds and an escalation procedure. If you know the basics of Power BI, say so too: the ad mentions it.
ITSM tickets and escalation to level 2
The ad talks about tickets and escalation to the level 2 SOC team lead. If you have worked in support, you have already done it: Incidents qualified and tracked in Jira: about 25 tickets a week, escalated to level 2 with the evidence attached.
Vulnerability scans (Qualys, Tenable, OpenVAS)
OpenVAS is free: it is the easiest one to practise with. Write how often and what came out of it: Monthly vulnerability scans with OpenVAS and a report of the fixes to apply.
TCP/IP, DNS, HTTP/HTTPS, SMTP, Windows, Linux
These are the basics of the job. Group them in your skills line, without burying them in a list of office software.
Adapting this template to your application
- Under your name, write the exact job title from the ad and your degree.
- In your skills, start with the tools named in the ad (SIEM, EDR, IDS/IPS, vulnerability scanner), with what you used them for.
- Put the Projects section before your experience if you have less than 2 years in the field: your lab and your final-year project are your best evidence.
- In your experience, reuse the words of the job: alerts, incidents, tickets, escalation, coverage, reports. A support or network administration job counts.
- Add your certifications, even in progress (CCNA, Security+, Splunk Core Certified User), marked "in preparation" if you do not have them yet.
- Keep it to one page. Before sending, check how to apply: for this ad, applications are accepted only online, on the employer's careers page, not by email.
The .docx can be edited in Word; the PDF is ready to send. Replace the example numbers with your own: a recruiter may ask you to rebuild your lab in front of them.
Frequently asked questions
Is this resume template free?
Yes. The template can be downloaded for free as PDF and Word.
I have never worked in a SOC. What should I write?
A home lab and your final-year project. Install a free SIEM, simulate an attack, and write one line: what you built, the tool you used, what you detected. Add your support or network administration experience too: qualifying incidents and handling tickets are part of it.
I know neither Splunk nor QRadar. Is that a problem?
No, if you know another SIEM. ELK and Wazuh are free and work on the same principles. Name what you really master, and write "basics" or "labs" when that is the case.
Should this resume have a photo?
This template has none, and the ad does not ask for one. Without a photo, your resume reads faster and gets through screening software more easily.
Does this resume get through screening software?
Yes. Stack is a single column, with your name first in the text and simple headings: screening software reads the text in the right order.
Does this template suit another job?
Yes: network administrator, support technician, security engineer, developer or any technical job where tools and projects matter. Keep the structure and replace the keywords with those from your own ad.