SOC Analyst Resume Examples & Free Template (PDF, Word)

1. 1

   Title, years and scope

   Your target title, how many years you have, the type of SOC you’ve worked in (MSSP, in-house, MDR) and your specialty. By the end of this line, a recruiter should be able to tell your tier.

2. 2

   Your stack

   The tools you use every shift, grouped by type: SIEM (Splunk, Sentinel), EDR (CrowdStrike), email security, SOAR and scripting. ATS keyword matching hits this line before anything else on the page.

3. 3

   Domain expertise

   What you’re best at (investigation, detection tuning, hunting), the methods behind it and what came out of it. This is where “knows Splunk” turns into “cut the false-positive rate in half”.

4. 4

   Collaboration

   The teams you work with (IT, detection engineering, legal, client contacts) and the places they see you: incident bridges, tabletop exercises, post-incident reviews. A SOC runs on handovers, so recruiters look for this.

5. 5

   Leadership

   The things the team still uses after your shift ends: runbooks, playbooks, the analysts you trained. This one doesn’t need a lead title. It shows you make the whole shift better, not just your own queue.

1. 1

   Alert Triage & Escalation

   You sort real threats from noise in the alert queue, every single shift. Hiring managers care because one missed alert can turn into a breach, and every false escalation wastes tier 2’s time. Show how you used severity scoring and enrichment in Splunk or Sentinel to hit your escalation SLA.

   Techniques

   severity scoring, alert enrichment, escalation runbooks

   Tools

   Splunk Enterprise Security, Microsoft Sentinel, ServiceNow SIR

   Metrics

   alerts per shift, SLA met, escalation accuracy

2. 2

   Log Investigation & Correlation

   You dig through logs to work out what an attacker actually did. Legal, IT and leadership all wait on the answer to “what did they touch?” before they act, so hiring managers want analysts who get there fast. Explain how you used SPL or KQL queries and timeline building across firewall, DNS and identity logs to scope incidents sooner.

   Techniques

   SPL and KQL queries, timeline building, root-cause analysis

   Tools

   Splunk, Microsoft Sentinel, Zeek, AWS CloudTrail

   Metrics

   incidents investigated, time to scope, root causes found

3. 3

   Endpoint Investigation & Isolation

   You investigate infected machines and cut them off before the damage spreads. Most intrusions touch a laptop or a server at some point, so EDR depth is something a SOC lead checks early. Describe how you used process trees and host isolation in CrowdStrike Falcon or Defender for Endpoint to bring dwell time down.

   Techniques

   process-tree analysis, host isolation, IOC sweeps

   Tools

   CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Velociraptor

   Metrics

   endpoints covered, dwell time, hosts isolated

4. 4

   Incident Handling & Containment

   You run confirmed incidents from containment all the way to the final report. Leadership and regulators judge the SOC on how incidents were handled, so hiring managers look for calm, well-documented responses. Walk them through how you used the NIST SP 800-61 phases and a clear bridge routine to contain incidents and stop them from coming back.

   Techniques

   containment, evidence collection, post-incident reviews

   Tools

   NIST SP 800-61, ServiceNow SIR, KAPE, Volatility

   Metrics

   SEV1 and SEV2 incidents, time to contain, repeat incidents

5. 5

   Detection Tuning & ATT&CK Coverage

   You tune the detections that decide what lands in the queue. Noisy rules waste analyst hours and hide real attacks, so teams value anyone who makes the alerts more accurate. Point out how you used Sigma or KQL rules and MITRE ATT&CK mapping to cut false positives and close coverage gaps.

   Techniques

   rule tuning, Sigma rules, ATT&CK mapping

   Tools

   Splunk, Microsoft Sentinel, Sigma, Atomic Red Team

   Metrics

   false-positive rate, rules tuned, ATT&CK coverage

6. 6

   Threat Hunting & Intel Enrichment

   You hunt for attackers that none of your alerts caught. It proves you can think like an attacker instead of waiting for the queue, and that’s exactly what senior SOC roles ask for. Mention how you used hypothesis-driven hunts and intel from MISP or an ISAC to find compromises earlier.

   Techniques

   hypothesis-driven hunts, IOC enrichment, actor profiling

   Tools

   MISP, Recorded Future, VirusTotal, Velociraptor

   Metrics

   hunts run, compromises found, alerts enriched

7. 7

   Phishing & Email Threat Response

   You shut down phishing campaigns before more people click. Phishing is still one of the most common ways in, so a fast, repeatable process for reported emails matters to every security team. Tell them how you used header analysis and sandbox detonation in Proofpoint or Defender for Office 365 to purge campaigns quickly.

   Techniques

   header analysis, URL detonation, mailbox purges

   Tools

   Proofpoint, Microsoft Defender for Office 365, ANY.RUN, urlscan.io

   Metrics

   reports handled, time to purge, campaigns blocked

8. 8

   Playbooks & SOC Automation

   You automate the repetitive parts of the job so analysts can focus on real cases. SOC teams are short on people, so every hour a SOAR playbook or a script saves goes straight back into investigations. Detail how you used Splunk SOAR or Python and clear runbooks to cut the manual work behind each alert.

   Techniques

   SOAR playbooks, enrichment scripts, runbooks

   Tools

   Splunk SOAR, Cortex XSOAR, Tines, Python

   Metrics

   playbooks built, hours saved, time per alert

Cover all 8 areas and your current job can easily reach 8 bullets or more. That’s fine. A hiring manager won’t mind a long job entry, only a vague one, and Step 4 fixes that. No SOC job yet? On an entry-level SOC Analyst resume, treat your home lab or projects as your current job and write them up against the same 8 areas.

1. Level 1Task

   What did I work on? Pick one real piece of work, like an incident or a project. A task on its own doesn’t give anyone a reason to call you.

   Tuned the SOC’s detection rules.

2. Level 2+ Techniques

   How did I do it? Add the techniques. They show you made choices instead of just following the runbook.

   Tuned the SOC’s detection rules, rewriting noisy correlation searches and adding allowlists for known admin activity.

3. Level 3+ Tools

   Which tools did I use? Write the product names the way the job posting does. Splunk and Sentinel are free keyword matches.

   Tuned the SOC’s detection rules in Splunk Enterprise Security and Microsoft Sentinel, rewriting noisy correlation searches in SPL and KQL and adding allowlists for known admin activity.

4. Level 4+ Method

   Which method did I follow? Add the framework behind the work, like MITRE ATT&CK or NIST SP 800-61. Few candidates do, and hiring managers notice.

   Tuned the SOC’s detection rules in Splunk Enterprise Security and Microsoft Sentinel, rewriting noisy correlation searches in SPL and KQL and adding allowlists for known admin activity, each mapped to a MITRE ATT&CK technique.

5. Level 5+ Metric

   What was the result? End on one number, with the before and after if you have it. That’s what makes the bullet believable.

   Tuned 120+ detection rules in Splunk Enterprise Security and Microsoft Sentinel, rewriting noisy correlation searches in SPL and KQL and adding allowlists for known admin activity, each mapped to a MITRE ATT&CK technique, and cut false positives from 68% of the queue to 21%.

   1. 01 Task What you worked on
   2. 02 Techniques How you did it
   3. 03 Tools The stack you used
   4. 04 Method The method you followed
   5. 05 Metric The result, one number

Most SOC Analysts already track these numbers without thinking about it. They’re in the SIEM dashboards, the ticket queue and the monthly report to the CISO. They just haven’t made it onto the resume yet.