SOC Analyst Resume
Skills & ATS Keywords

Aim for somewhere between 28 and 44 named products and frameworks: the SIEM you live in, the EDR you isolate hosts on, the email-security stack that feeds your phishing queue, the threat-intel platforms you pivot through, the case-management system you close tickets in, the forensics utilities you run during a containment, and the scripting languages you automate triage with, all stitched under 7 to 9 row labels. Drop below 22 and the file looks like an early L1 chair pretending to a T2 ladder; push past 48 and the page reads like a SANS cert vendor wall. Each chip has to pair with a story you can defend in a screen: the Splunk saved search you tuned that killed a 40 percent FP rate, the CrowdStrike RTR session that contained an intrusion at 2am, the phish takedown you ran with Proofpoint TRAP. The row carries the inventory; alerts-per-shift, MTTR, incidents led, escalation rate, and FP reduction are what prove you actually worked the queue.

Drop it right under the Profile Summary, before Work Experience. SOC hiring leads spot-check applicants in the seconds between two queue alerts, and the parsers sitting in front of security-ops req pipelines (Greenhouse, Lever, Ashby, Workday) tag a Splunk, Sentinel, or CrowdStrike token with more confidence when it sits inside a labeled Skills block near the top of page one. Push it onto page two and your SIEM-plus-EDR-plus-IR story leaks out into the job paragraphs and loses parser weight. Keep the page to 7 to 9 grouped rows so a SOC lead can read your operational surface in a single sweep before opening the first incident bullet.

Copy the req into a scratch doc and underline every named SIEM, EDR, email-security gateway, threat-intel feed, case-management product, sandbox, forensic utility, scripting language, and certification body. Highlight the ones that surface twice or more in the posting. Set that list next to your current Skills rows and check for missing chips. When a product recurs in the JD but is absent from your file, fold it onto the matching row only when you can defend it on a triage call, then make sure at least one bullet pins the same product to an alerts-per-shift figure, an MTTR delta, an incident-count, or an FP-reduction percentage. Once the rows look right, run the resume through an ATS Checker as the final pass so the labels and structured fields still parse cleanly without a token getting swallowed by the layout.

A SOC Analyst page is pitched at the operator who runs the queue: Splunk or Sentinel alert triage by tier, CrowdStrike or SentinelOne live-response sessions, phishing-triage cycles through Proofpoint or Defender for O365, threat-hunt notebooks running ATT&CK-aligned hypotheses, IR playbook execution on SEV1 and SEV2 incidents, IOC sweeps off MISP or Recorded Future feeds, and shift-handoff notes that hold up under a postmortem read. A Security Engineer page is pitched at the builder of the platform underneath: AppSec scanner rollouts, CSPM coverage across cloud accounts, IAM-at-scale policy design, detection-as-code authorship in Sigma and KQL, secrets-vault migrations, WAF rule sets, and Python automation gluing controls together. If your day is working the alert queue, leading the early IR call, and tuning saved searches the engineering side wrote, the file belongs in the SOC pile. If your day is rolling Snyk across product teams or standing up Wiz across 40 AWS accounts, the file belongs in the Security Engineer pile. Splitting the difference dilutes the operational evidence a SOC hiring lead reads the page for.

Lead with whichever one carries the deeper story for the chair you are aiming at. Read the top 5 reqs in your inbox: if four out of five say Splunk Enterprise Security, push Splunk to the front of the Detection & SIEM row and pin a bullet to a saved-search-tuning win, a notable-event chain, or an ES correlation-search authorship line. If the postings are Microsoft Sentinel and Defender heavy, KQL goes first and the bullet anchors a hunting notebook, a workbook you authored, or a Logic App playbook you handed off to a junior. Trying to weight them as equals on the row reads like a fence-sit, and the JD-side parser scores a single front-loaded platform name harder than a tied pair. Carry the second platform inside the row but let the first one own the lead chip and the matched bullet.

CompTIA Security+ is the entry filter HR routes a T1 file through before a SOC lead ever sees it; treat it as table stakes by month six on the job. CySA+ pairs naturally with a T1-to-T2 promotion case and reads well alongside a shift of triage experience. GCIA (Intrusion Analyst) carries weight on packet-heavy and network-detection chairs and pairs cleanly with Zeek, Suricata, and Wireshark mentions. GCIH (Incident Handler) is the credential most US SOC leads check for at T2 and above, because it maps onto NIST 800-61 IR work on the resume. GCFA shifts the file toward DFIR-tier postings and works well when a Volatility or KAPE bullet is on the page. BTL1 from Security Blue Team has gained ground at L1 and L2 because it is hands-on and budget-friendly, and a growing share of T2 reqs list it as acceptable. List the credentials on a single Certifications row near Education, name the issuing body next to each (CompTIA, SANS, Security Blue Team), and skip any in-progress lines unless the sit date is locked in.

Six number families hold the weight on a 2026 SOC Analyst page. Alerts triaged per shift with the platform named (worked 70 to 110 Splunk alerts per shift across a 9-person SOC). Mean time to respond on incidents inside an SLA window (cut SEV2 MTTR from 47 minutes to 11 minutes across the past 2 quarters via runbook automation). Escalation rate to the tier above (held T1-to-T2 escalation at 12 percent of queue volume, lifting from a baseline of 28 percent through saved-search tuning). Incidents led by tier (lead investigator on 14 SEV1 and SEV2 events over the year, owning the IR bridge through containment). Threat-hunt cycles run (authored 22 hypothesis-driven hunts mapped to ATT&CK Initial Access and Lateral Movement, surfacing 6 confirmed persistence findings). False-positive reduction on a tuned detection family (dropped FP rate from 71 percent to 18 percent across 38 saved searches). Bare numbers without a platform, a framework, or a queue context land as filler in 2026; a credible bullet wires one or two of those figures to a named SIEM or EDR and a real outcome.