Cybersecurity Analyst Resume Bullet Points
16 examples, each shown weak and strong
A strong security bullet says where you sat, whether SOC, incident response, vulnerability management or GRC, and what you investigated or fixed. Reviewers read for investigation over monitoring, so tie each tool to a detection you wrote, an incident you contained or a finding you closed.
How to use these
- Every [X%], [N] and [$X] is a blank for your own figure. Fill it from your records, or a careful estimate you could explain in an interview. If you have no number, describe the result in words.
- Only use a bullet for work you actually did. Change the details until it describes your job, not this page.
- The ticks are three plain checks done in code: it opens with an action verb, it has a number, and it says what changed. Strong bullets pass all three; weak ones miss at least one.
Alert triage and detection
SOC leads look for queue volume, false positive rates and detections you wrote, not a list of consoles you watched.
Weak
Monitored the SIEM for suspicious activity.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Triaged [N] alerts per shift in Splunk for a [N]-user environment, escalating [X%] to tier three and closing the rest with documented rationale inside SLA.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Created detection rules in Microsoft Sentinel.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Wrote [N] KQL detections in Microsoft Sentinel mapped to MITRE ATT&CK techniques, reducing false positives on lateral movement alerts by [X%].
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Responsible for tuning alerts.
- ✗ Action verb
- ✗ Number
- ✗ Result
Strong
Tuned [N] noisy correlation searches with allowlists and new thresholds, cutting daily alert volume from [N] to [N] without losing a true positive in replay testing.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Analyzed phishing emails reported by staff.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Investigated [N] user-reported phishing emails a month and scripted header and URL checks into a SOAR playbook, shortening average triage from [N] to [N] minutes.
- ✓ Action verb
- ✓ Number
- ✓ Result
Incident response
Describe one incident at a high level: what triggered it, how you scoped and contained it, and what changed afterward.
Weak
Participated in incident response activities.
- ✗ Action verb
- ✗ Number
- ✗ Result
Strong
Contained a business email compromise within [N] hours of the first alert by revoking sessions and resetting MFA, preventing [$X] in fraudulent wire transfers.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Responded to malware alerts on endpoints.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Isolated [N] endpoints in CrowdStrike Falcon within [N] minutes of a ransomware precursor alert, preventing encryption of any file server.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Wrote incident reports after security events.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Authored [N] incident reports with timelines and root cause, and drove [N] follow-up fixes to closure, including a mail flow rule that blocked a repeat attack path.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Helped improve incident response procedures.
- ✗ Action verb
- ✗ Number
- ✓ Result
Strong
Rewrote [N] incident response playbooks to follow NIST SP 800-61, cutting mean time to contain from [N] to [N] hours over the next [N] quarters.
- ✓ Action verb
- ✓ Number
- ✓ Result
Vulnerability management
Show the size of the scan scope, the SLA you worked against, and how much risk was actually closed.
Weak
Ran vulnerability scans with Nessus.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Scanned [N] servers and workstations weekly in Tenable Nessus and chased critical findings to patch, raising remediation within SLA from [X%] to [X%].
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Worked with IT to patch systems.
- ✗ Action verb
- ✗ Number
- ✗ Result
Strong
Prioritized [N] open vulnerabilities in Qualys by exploitability and asset value, reducing critical exposure on internet-facing hosts by [X%] in [N] weeks.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Tracked vulnerability remediation.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Built a remediation dashboard tracking [N] asset owners against SLA, and overdue critical findings fell from [N] to [N] in one quarter.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Performed security configuration reviews.
- ✗ Action verb
- ✗ Number
- ✗ Result
Strong
Hardened [N] Windows servers to CIS Benchmarks through Group Policy, lifting the average compliance score from [X%] to [X%].
- ✓ Action verb
- ✓ Number
- ✓ Result
Compliance and awareness
GRC reviewers want the framework, the audit, and evidence that the control actually worked.
Weak
Assisted with SOC 2 audit preparation.
- ✗ Action verb
- ✓ Number
- ✗ Result
Strong
Collected evidence for [N] SOC 2 controls and fixed [N] access review gaps before fieldwork, so the audit closed with no exceptions.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Ran phishing awareness training.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Ran quarterly phishing simulations for [N] employees in KnowBe4, lowering the click rate from [X%] to [X%] while the report rate climbed to [X%].
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Responsible for user access reviews.
- ✗ Action verb
- ✗ Number
- ✗ Result
Strong
Led quarterly access reviews for [N] applications in Okta, removing [N] stale accounts and closing an audit finding on terminated user access.
- ✓ Action verb
- ✓ Number
- ✓ Result
Weak
Mapped security controls to NIST CSF.
- ✓ Action verb
- ✗ Number
- ✗ Result
Strong
Mapped [N] existing controls to NIST CSF, identifying [N] gaps and closing [N] of them within the fiscal year.
- ✓ Action verb
- ✓ Number
- ✓ Result
Action verbs for cybersecurity analyst resumes
- Triaged
- Investigated
- Contained
- Detected
- Escalated
- Remediated
- Hardened
- Tuned
- Scanned
- Hunted
- Patched
- Audited
- Documented
More in the full list of resume action verbs.
Next steps
Rewrite your own bullet →
The Bullet Surgeon gives one of your lines three rewrites, free.
A complete cybersecurity analyst resume →
A graded example, with notes on why each line works.
What cybersecurity analyst reviewers check first →
Common mistakes and specific fixes for this role.
Would they interview you? →
Paste a cybersecurity analyst posting and five readers vote on your resume.