SOC Analyst resume keywords
A required certification often comes first, then SIEM and EDR products and incident handling. These are the terms recruiters search the ATS for, written the way postings write them.
Licenses and certifications
- CompTIA Security+
Tools, systems and languages
- Splunk
- CrowdStrike Falcon
Skills and methods
- Incident Response
- Threat Hunting
- MITRE ATT&CK
Domain knowledge
- Security Information and Event Management
- Endpoint Detection and Response
- Phishing Analysis
How to use them
- Use the posting's exact wording. If it says a term one way, write it that way at least once.
- List certifications by full name and acronym in a Certifications section: "Certified Information Systems Security Professional (CISSP)"
- State a clearance precisely: level and that it is active
- Name the product, not the category: "Splunk" and "CrowdStrike Falcon", not only "SIEM" and "EDR"
- Only list what is true for you. A keyword you can't back up in an interview costs more than it gains.