SOC Analyst
Resume Template

A free SOC Analyst resume, pre-filled and ready to edit. Replace the highlighted placeholders (SIEM, EDR, email-security tooling, detection-rule counts, MTTD/MTTR numbers, phishing volumes) using the side panel on the left, and the resume rewrites itself as you type. Save as PDF when you're done.

Emmanuel Gendre - Former Google Recruiter and Tech Resume Writer

Authored by

Emmanuel Gendre

Tech Resume Writer

Interactive resume template generator

Interactive SOC Analyst Resume Template

Edit the side panel. The resume rewrites itself live. Save as PDF when you're done.

Edits update live as you type. Toggle Edit to rewrite paper text directly.

Edit mode is on. Click anywhere on the resume to rewrite text. Side-panel placeholders still update live.

Maya Chen SOC Analyst

Austin, TX socanalyst@gmail.com +1 512-555-0142

Profile Summary

  • SOC Analyst with 6 years of experience operating enterprise security operations centers across SaaS, financial services, and managed-security clients, specializing in SIEM-driven detection, EDR investigation, and phishing analysis.
  • Hands-on coverage across SIEM platforms (Splunk, Microsoft Sentinel), EDR/XDR (CrowdStrike Falcon, SentinelOne), email security (Proofpoint), SOAR automation (Splunk SOAR), threat intelligence (MISP), and scripting (Python, PowerShell) with strong fundamentals in MITRE ATT&CK mapping, on-call discipline, and audit-ready incident documentation.
  • Deep expertise in MITRE ATT&CK-aligned detection coverage, defense-in-depth response, alert-triage discipline, and threat-intel-driven hunting, leveraging methodologies such as follow-the-sun on-call rotations and weekly purple-team exercises to drive fast, well-documented incident response with measurable MTTD and MTTR improvements.
  • Engaged collaborator working cross-functionally with Detection Engineering, IT, and Legal teams in NIST CSF-aligned environments, contributing to incident bridges, tabletop exercises, and post-incident reviews with a calm, evidence-first temperament.
  • Emerging leader who shares technical excellence and fosters a culture of alert hygiene and postmortem discipline through case reviews and playbook authoring, while leading weekly detection-engineering study sessions and authoring widely used triage and IR templates.

Technical Skills

SIEM & Log Platforms:
Splunk, Microsoft Sentinel, IBM QRadar, Google Chronicle, Elastic Security
EDR & Endpoint Security:
CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, VMware Carbon Black
Email Security:
Proofpoint, Mimecast, Defender for O365, Cofense, KnowBe4
Threat Intelligence & Hunting:
MISP, Recorded Future, ThreatConnect, MITRE ATT&CK, OSINT pivoting
Detection Engineering & Query:
Sigma, KQL, SPL, YARA, Snort/Suricata, Splunk SOAR, Cortex XSOAR
Frameworks & Compliance:
MITRE ATT&CK, NIST CSF, ISO 27001, SOC 2, PCI DSS, NIST 800-61
Forensics & Network Analysis:
Volatility, FTK Imager, Autopsy, Wireshark, Zeek, tcpdump, Velociraptor
Scripting & Automation:
Python, PowerShell, Bash, REST APIs, Jupyter notebooks

Education

The University of Texas at Austin B.S. in Computer Science, minor in Information Security
Austin, TX Sep 2015 - May 2019

Work Experience

Cloudflare Senior SOC Analyst
Austin, TX Mar 2022 - Present
  • Owned security monitoring and alert triage across Cloudflare's global edge and corporate environment supporting 3,200+ employees, working 18,000+ alerts per week across SIEM-driven detection, multi-tool alert correlation, and on-call escalation on Splunk and Microsoft Sentinel.
  • Drove end-to-end incident investigation for 220+ confirmed incidents spanning endpoints, identity providers, AWS workloads, and edge logs, applying signal correlation across SIEM and EDR, attacker-timeline reconstruction, and scope-and-impact assessment, lifting the true-positive rate from 6% to 22%.
  • Ran endpoint detection and response on CrowdStrike Falcon and SentinelOne across 4,500+ endpoints, executing one-click host isolation playbooks, process-tree investigation, and IOC sweep automation, pulling attacker dwell time from 14 hours down to 38 minutes.
  • Led detection engineering and rule tuning using Sigma rules for SIEM-agnostic coverage, KQL queries in Microsoft Sentinel, and Splunk correlation searches, authoring 120+ detection rules that cut the false-positive rate from 71% to 18% and lifted MITRE ATT&CK coverage from 41% to 78%.
  • Conducted log analysis and first-responder forensics across firewall, DNS, proxy, identity, and cloud audit logs, performing memory acquisition with Volatility, packet analysis in Wireshark and Zeek, and endpoint artifact triage with Velociraptor, root-caused 95+ incidents within the first 48 hours.
  • Built threat intelligence enrichment on MISP sourced from MISP, sector ISACs, and commercial vendor feeds, applying IOC enrichment on every alert, ATT&CK TTP mapping for known actors, and threat-actor profile briefings, contextualized 90% of high-severity alerts within 5 minutes of triage.
  • Ran phishing and email threat analysis on Proofpoint for 8,000+ user-reported emails per year, working header and routing analysis, URL detonation in Proofpoint TAP, and attachment sandbox triage, cutting the phish click-through rate from 4.1% to 0.6%.
Optiv SOC Analyst
Austin, TX Jun 2019 - Feb 2022
  • Operated the incident response and containment program driving endpoint isolation, account disablement in Okta and AD, and IP and domain blocks at the proxy across 60+ SEV1 and SEV2 incidents, compressing mean time to respond from 2.8 hours to 34 minutes within the first year.
  • Maintained the team's SOC playbook and runbook library including 45+ incident-response playbooks, alert-triage runbooks per detection class, post-incident reports, and MTTD/MTTR dashboards for leadership, adopted as the SOC standard across 12 client environments.
  • Worked closely with client IT, Threat Intelligence, and Legal across 12 client environments to coordinate containment windows, phishing takedown requests, and detection-rule rollouts, tuning 70+ existing detection rules that became the org's triage baseline and onboarding 5 new analysts.

Done editing? Download as a real, vector PDF. Selectable text, ATS-friendly, US Letter format.

About this template

A SOC Analyst
Resume Template, by a Cybersecurity Resume Writer.

Quick intro: 12 years recruiting tech, many of those at Google. I run a cybersecurity resume writer service for IT and engineering candidates, and SOC Analyst rewrites come in steadily. Security operations is one of the busiest funnels I see. Net result: I read these CVs from the recruiter side of the table, not from a SANS deck or a course. Different lens on what makes a SOC resume actually land an interview.

Most folks who land here pay for the full custom rewrite. We go deep into the alerts you actually triaged, the incidents you led, the detections you wrote, the phish you killed, the dwell time you cut. Sometimes that's more than you need. If a clean skeleton with SOC-shaped placeholders is what's missing, this template fills the gap. ATS-clean, free, no signup. Have a swing at it.

How it works

How to use this template
to write a SOC Analyst resume

The structure here was written by a former Google recruiter. The placeholders force you to be specific exactly where it matters: tools, the detection surface, the practice behind the work, and metrics.

Strong SOC bullets aren't typed out in one go. They build in five layers. Layer one names the action. Layers two and three add the tooling you triaged in and the surface you were watching. Layer four shows the investigative or response practice behind the work. Layer five quantifies what changed. Bullets that complete layer five are the ones a security hiring manager flags for the phone screen. The framework lives in How to Write Bullet Points for Tech Resumes.

  1. 01 Task What you did
  2. 02 Tools Splunk, CrowdStrike, MISP
  3. 03 Surface Endpoints, identity, email
  4. 04 Practice Triage, IR, tuning, hunting
  5. 05 Metric Quantified impact

This template hard-wires the five layers into your bullets so the framework runs in the background. The side panel maps clean: SIEM and EDR picks fill layer 2, the surface and log-source fields fill layer 3, the practice-pattern fields fill layer 4, the metric inputs land at layer 5. The sentence skeletons cover layer 1. Why this matters: you only need to drop in real tools and real numbers. The structure handles the rest, and the resume reads at layer 5.

  1. Pick your stack

    Tap a chip to swap Splunk for Sentinel or Chronicle, CrowdStrike for SentinelOne or Defender, Proofpoint for Mimecast, Splunk SOAR for XSOAR. Every mention updates at once.

  2. Drop in your numbers

    Alert volume, true-positive rate, dwell time, MTTR, detection-rule count, false positives, ATT&CK coverage, phish click-through. Don't have yours yet? The defaults pass for a senior SOC resume.

  3. Save as PDF

    Click Download. The page generates a real vector PDF with selectable text and clean US Letter formatting. ATS-parsable.

Resume Sample

SOC Analyst Resume Examples

Three sample SOC analyst resumes at different career stages: a junior career changer triaging alerts at an MSSP, a senior detection-engineering IC at Mandiant, and a lead running a 9-analyst SOC team at a financial-services Fortune 500. Use them as inspiration when filling the template above.

Entry-level SOC Analyst Resume Sample 2 years

Junior SOC Analyst Resume Example

Career-changer from helpdesk. Splunk triage, phishing investigations, and 24/7 SOC rotations at a managed-hosting MSSP.

Hector Diaz

Junior SOC Analyst

San Antonio, TX · hector.diaz@gmail.com · +1 210-555-0139 · linkedin.com/in/hectordiaz

Profile Summary
  • Junior SOC Analyst with 2 years of MSSP experience triaging alerts in Splunk and CrowdStrike Falcon on a 24/7 tier-1 rotation, transitioning from a 3-year Geek Squad helpdesk background.
  • Hands-on coverage across Splunk (basic searches, dashboards), CrowdStrike Falcon (alert triage), Microsoft Sentinel (basic), Office 365 + Defender, and ServiceNow SIR, with foundational knowledge of MITRE ATT&CK.
  • Eager collaborator working alongside 4 tier-2 analysts and 2 incident responders, contributing to phishing investigations, alert tuning suggestions, and runbook updates under structured mentorship.
  • Holds CompTIA Security+ with a BS in Cybersecurity from UTSA, and currently working toward Splunk Core Certified User.
Technical Skills
SIEM & Triage:
Splunk (basic searches, dashboard consumption), Microsoft Sentinel (basic KQL), ServiceNow SIR
EDR & Endpoint:
CrowdStrike Falcon (tier-1 triage), Microsoft Defender for Endpoint, Defender for Office 365
Email & Phishing:
Microsoft 365 Defender, VirusTotal, URLScan, PhishTool, basic header analysis
Frameworks & OS:
MITRE ATT&CK (familiarity), basic Linux command line, Windows event log review
Documentation:
Runbook authoring, Confluence, ServiceNow knowledge articles, shift-handover notes
Certifications:
CompTIA Security+ (in progress: Splunk Core Certified User, Microsoft SC-200)
Education
University of Texas at San Antonio B.S. in Cybersecurity San Antonio, TX · Sep 2019 - May 2023
Work Experience
Rackspace Technology Junior SOC Analyst San Antonio, TX · Oct 2023 - Present
  • Triaged an average of 42 Splunk and CrowdStrike alerts per week on the tier-1 queue, escalating high-fidelity hits to tier-2 within the 15-minute SLA.
  • Investigated 120 phishing reports using VirusTotal and URLScan over the first 12 months, paired with a senior analyst on the 18 cases that escalated to incident response.
  • Built 4 Splunk dashboards for shift-handover visibility on alert backlog, EDR coverage gaps, and top destination domains.
  • Contributed to 9 SOC runbooks covering account-compromise triage, BEC response, and EDR isolation workflows.
  • Completed CompTIA Security+ within the first 6 months and started Splunk Core Certified User coursework with the team's training budget.
Best Buy Geek Squad Advanced Repair Agent San Antonio, TX · Jul 2020 - Sep 2023
  • Resolved 30 to 45 client tickets per week covering Windows malware cleanup, account recovery, and home-network reconfiguration.
  • Authored the store's checklist for suspected ransomware intakes, adopted by 6 nearby precincts after a regional QBR.
  • Mentored 3 new agents on diagnostic workflows and customer communication during the holiday surge.

Senior SOC Analyst Resume Sample 6 years

Senior SOC Analyst Resume Example

MSSP threat-hunt IC. Detection engineering in Splunk and Sentinel, with deep EDR + cloud telemetry.

Aliyah Thompson

Senior SOC Analyst

Reston, VA · aliyah.thompson@gmail.com · +1 703-555-0124 · linkedin.com/in/aliyahthompson

Profile Summary
  • Senior SOC Analyst with 6 years of MSSP experience hunting threats across cloud and endpoint telemetry, specializing in detection engineering, threat hunting, and Sentinel/Splunk SPL+KQL.
  • Hands-on coverage across Splunk Enterprise (SPL, correlation searches), Microsoft Sentinel (KQL), CrowdStrike Falcon, Carbon Black, Cortex XSOAR playbooks, and YARA / Sigma rule authoring.
  • Deep expertise in AWS CloudTrail and Azure Activity log hunting, MITRE ATT&CK mapping for FedRAMP customers, and lightweight malware analysis using CAPA and FLOSS.
  • Engaged collaborator partnering with detection engineering, threat intel, and incident response across 15 enterprise customers, contributing to monthly threat-hunt cycles and major-incident war rooms.
  • Mentor and detection lead, guiding 3 mid-level analysts through SPL coursework and authoring the team's cloud-telemetry hunt playbook adopted by the regional SOC.
Technical Skills
SIEM & Detection:
Splunk Enterprise (SPL, correlation searches), Microsoft Sentinel (KQL), Sigma rule authoring
EDR & Endpoint:
CrowdStrike Falcon, VMware Carbon Black, Microsoft Defender for Endpoint, Sysmon
SOAR & Automation:
Palo Alto Cortex XSOAR (playbooks, integrations), Python scripting, REST API enrichment
Cloud Telemetry:
AWS CloudTrail, GuardDuty, Azure Activity, Defender for Cloud, GCP audit logs (basics)
Threat Hunting:
MITRE ATT&CK mapping, Atomic Red Team, hypothesis-driven hunts, YARA rules
Malware & Forensics:
CAPA, FLOSS, PEStudio, INetSim (sandbox basics), memory analysis with Volatility (basic)
Frameworks & Standards:
MITRE ATT&CK + D3FEND, NIST CSF, FedRAMP Moderate, PCI-DSS (consumer)
Languages & Scripting:
SPL, KQL, Python, PowerShell, Bash, regex, Git
Education
Howard University M.S. in Cybersecurity Washington, DC · Sep 2016 - May 2018
Work Experience
Mandiant Senior SOC Analyst Reston, VA · Aug 2022 - Present
  • Own 62 production detection rules across Splunk Enterprise and Microsoft Sentinel, tuned to maintain false-positive rate under 8% across 15 enterprise customers.
  • Authored 7 Cortex XSOAR playbooks for phishing, credential abuse, and EDR isolation, cutting average tier-2 handle time by 46% (from 38 to 20 minutes).
  • Run the team's monthly threat-hunt cycle: published 9 hunt reports over the last year, including 2 that surfaced live adversary activity in customer AWS environments.
  • Integrated 4 new log sources (Okta, GitHub Audit, Netskope, CrowdStrike Falcon Data Replicator) into Splunk and Sentinel, with corresponding detection content for each.
  • Wrote 22 Sigma rules committed to the team's internal detection repository, with about 70% auto-translated to KQL via Sigma converter.
  • Mentor 3 mid-level analysts through SPL and KQL coursework, including weekly hunt reviews and rotating presenter slots in the detection-engineering forum.
Optiv SOC Analyst Reston, VA · Jul 2018 - Jul 2022
  • Triaged roughly 90 alerts per shift on the tier-2 queue across Splunk and Carbon Black for 8 mid-market customers.
  • Co-authored 14 detection rules for commodity malware and credential stuffing, with documented MITRE ATT&CK technique coverage.
  • Led 4 customer-facing incident response engagements, contributing timelines and root-cause writeups to the final reports.
  • Built the team's first Atomic Red Team test harness, validating 35 detections across 3 customer Splunk tenants.

Lead SOC Analyst Resume Sample 11 years

Lead SOC Analyst Resume Example

Financial-services detection-engineering lead. Manages a 9-analyst SOC team across two regions and the org's detection backlog.

Krish Patel

Lead SOC Analyst

Foster City, CA · krish.patel@gmail.com · +1 650-555-0192 · linkedin.com/in/krishpatel

Profile Summary
  • Lead SOC Analyst with 11 years of detection-engineering and incident-response experience in financial services, specializing in SOC leadership, multi-cloud detection programs, and audit-aligned detection content.
  • Hands-on coverage across Splunk Enterprise Security + UEBA, Microsoft Sentinel + Defender XDR, CrowdStrike Falcon Complete, Tines and Cortex XSOAR SOAR platforms, and multi-cloud detection across AWS, GCP, and Azure.
  • Deep expertise in detection-engineering CI/CD with Sigma and GitLab, PCI-DSS and SOX-IT-controls evidence collection, and MITRE ATT&CK + D3FEND coverage mapping at the program level.
  • Cross-functional leader partnering with Threat Intel, Cloud Security, IAM, and Internal Audit, including chairing the monthly Detection Engineering Review and serving as SOC liaison for the CISO and Audit Committee.
  • People manager for a 9-analyst SOC team across two regions, owning hiring loops, on-call rotations, and the org's annual detection-engineering roadmap.
Technical Skills
SIEM & Analytics:
Splunk Enterprise Security + UEBA, Microsoft Sentinel, Sigma rule authoring, detection-as-code in GitLab
EDR & XDR:
CrowdStrike Falcon Complete, Microsoft Defender XDR, Carbon Black, SentinelOne (consumer)
SOAR & Automation:
Tines, Palo Alto Cortex XSOAR, Python, GitLab CI/CD for detection content
Multi-Cloud Detection:
AWS GuardDuty, GCP Security Command Center, Azure Defender, CloudTrail, GCP audit logs
CASB & DLP:
Netskope CASB, Microsoft Purview DLP, Symantec DLP (legacy), cloud-app risk scoring
Frameworks & Compliance:
MITRE ATT&CK + D3FEND, NIST CSF, PCI-DSS, SOX IT controls, ISO 27001 (familiarity)
Leadership:
Team management (9 analysts), hiring loops, CISO and Audit Committee reporting, multi-region SOC integration
Languages & Tooling:
SPL, KQL, Python, Bash, Git, Jira, Confluence
Education
Stevens Institute of Technology M.S. in Cybersecurity Hoboken, NJ · Sep 2011 - May 2013
Work Experience
Visa Lead SOC Analyst Foster City, CA · Apr 2021 - Present
  • Lead a 9-analyst SOC team across Foster City and Singapore, owning the org's detection backlog of roughly 280 production rules in Splunk ES and Microsoft Sentinel.
  • Defined and rolled out the detection-as-code pipeline in GitLab (Sigma + KQL/SPL), cutting rule deployment time from 11 days to under 48 hours and adding peer review on every change.
  • Led 6 major incident-response engagements last year, including 2 cloud-credential abuse cases and 1 third-party intrusion that triggered the customer notification process.
  • Drove the multi-cloud detection program across AWS, GCP, and Azure, lifting MITRE ATT&CK coverage on cloud techniques from 34% to 71% over 14 months.
  • Owned the SOC's evidence stream for PCI-DSS and SOX IT audits, passing 4 consecutive audits with zero detection-related findings.
  • Presents quarterly detection-coverage and incident metrics to the CISO and Audit Committee, including KRI trends and threat-landscape briefings.
  • Hired and onboarded 4 senior analysts over 2 years, running structured interview loops and 30/60/90 onboarding plans tied to detection-content milestones.
PayPal Senior SOC Analyst San Jose, CA · Jun 2013 - Mar 2021
  • Owned 140 Splunk correlation searches covering account takeover, payment-fraud signals, and insider-risk patterns across PayPal's core platform.
  • Led the SIEM migration from ArcSight to Splunk Enterprise Security across 18 months, retiring 320 legacy rules and rebuilding 95 high-value detections.
  • Authored the SOC's cloud-detection playbook for the Braintree integration, covering AWS CloudTrail abuse patterns and IAM credential exposure.
  • Mentored 5 mid-level analysts on SPL, threat-hunt design, and detection tuning, with 3 promoted to senior during my tenure.
  • Acted as SOC incident commander on 9 Sev 1 events over 4 years, including 2 with regulator-facing reporting requirements.

Frequently asked

Your Questions about the SOC Analyst Resume Template, Answered

Yes, fully free. No signup, no email gate, no upsell hidden behind a paywall. Open the page, fill in the side panel, save the PDF, you are done.

Yes. The exported PDF is single-column with the standard section headers ATS systems already understand (Profile Summary, Technical Skills, Education, Work Experience). No tables, no graphics, no two-column layouts. Workday, Greenhouse, and iCIMS parse it cleanly. Run it through our ATS Checker after if you want a second pair of eyes on the export.

Yes. Hit Edit at the top of the preview, then click into any sentence on the paper and type. The side-panel placeholders keep flowing in as you change them; the rest of the text is plain editable copy.

Click Download. The browser builds the PDF on the spot, no print dialog, no signup, no server in the loop. The output is real vector text on US Letter, parsed by ATS systems the same way they parse any clean resume export.

Swap it. The defaults lean Splunk + CrowdStrike Falcon + Proofpoint + MISP because that is the most common 2026 enterprise SOC stack, but every reference is a placeholder. Use the chips to swap Splunk for Microsoft Sentinel, IBM QRadar, Google Chronicle, or Elastic. Swap CrowdStrike for SentinelOne, Defender for Endpoint, or Carbon Black. Swap Proofpoint for Mimecast or Defender for O365. The side panel updates the resume across every mention.

SOC Analyst leans toward security operations: alert triage on a SIEM, EDR investigation on endpoints, phishing analysis, threat-intel enrichment, detection-rule tuning, and incident response. The Cloud and Network Engineer templates lean toward building and running infrastructure. If your day is triaging Splunk alerts, isolating endpoints in CrowdStrike, writing Sigma rules, and running phishing takedowns, pick this one. If your day is shipping Terraform modules or configuring BGP, the Cloud or Network Engineer templates fit better.

No. Hiring managers screen on substance: the alerts you actually triaged, the incidents you contained, the dwell time you cut, the detections you wrote, the phish you killed. Layout origin is not on the rubric. What does cost interviews is a template padded with vague security-speak, which this one is structured to prevent. The skeleton came from a former Google recruiter; the substance is yours.

Why trust this template

Emmanuel Gendre, former Google recruiter and tech resume writer

Emmanuel Gendre

Former Google recruiter · Tech resume writer

I built this SOC Analyst template from the patterns I saw work, not from generic advice. Below is the data behind every bullet, skills line, and metric placeholder.

  • Experience Hundreds of SOC Analyst resumes screened across SaaS, financial services, MSSPs, and federal-contractor security shops during my Google recruiter years and at TechieCV. The Profile Summary and Skills sections mirror what survived the 6-second screen on a security recruiter's desk.
  • Expertise Bullets modeled on senior offers. The Cloudflare section is structured the way Senior and Lead SOC Analysts write their experience when they land top-tier security-team interviews: alert-volume ownership, true-positive uplift, dwell-time compression, detection-rule output with false-positive deltas, forensic root-cause work, and phishing click-through reduction.
  • Trust Stack reflects the 2026 hiring bar. Splunk + Microsoft Sentinel + CrowdStrike Falcon + SentinelOne + Proofpoint + MISP + Splunk SOAR is what hiring managers expect today; suggestion chips cover realistic alternatives (QRadar, Chronicle, Elastic, Defender, Carbon Black, Mimecast, XSOAR, Tines, Recorded Future, ThreatConnect) so you can match your real toolchain without losing keyword fit.
Read my full story →

Filled the template? Get a recruiter's eyes on it.

The template gives you a recruiter-vetted skeleton. The next step is making sure your specific bullets, metrics, and stack hold up under a 6-second screen.

Free, personally reviewed within 12 hours by a former Google recruiter.

Get a Free Resume Review today

I review personally all resumes within 12 hrs

PDF, DOC, or DOCX · under 5MB

Disclaimer. This template is a starting point. Defaults are illustrative; replace every metric and tool with values that reflect your real work. Tailor wording to each job description.