Cyber Security Analyst Skills for Your Resume

Top cyber security skills for a resume

For freshers, labs and CTF progress prove skills; for seniors, programme results and compliance matter.

• SIEM alert triage
• Incident response
• SOAR playbooks
• Detection tuning
• Vulnerability management
• Phishing awareness
• Threat hunting
• Home lab and CTFs
• ISO 27001
• Regulatory reporting
• Mentoring analysts
• Security programme leadership

What the official job profile lists for a cyber security analyst

India's National Qualification Register lists a Security Analyst qualification at NSQF Level 5, submitted by the IT-ITeS Sector Skills Council NASSCOM and aligned to NCO-2015 code 2522.0201. It describes the job as protecting an organisation's data by monitoring and analysing threats, coordinating responses to security incidents, managing and securing cloud environments, and defending against phishing and social engineering, while keeping compliance with industry standards.

Those four duties are the four core modules of the 480-hour course, which includes 90 hours of on-the-job training. The assessed tasks are specific: monitor alerts from firewalls, IDS and the SIEM; classify attacks with MITRE ATT&CK; preserve digital evidence and run forensic analysis; configure SOAR tools; run vulnerability assessments; manage MFA, access reviews and DLP in the cloud; and design phishing simulations. It also expects analysts to explain findings to both technical and non-technical people, which is why the written incident report is part of the job, not an extra.

The example bullets below are illustrative: every figure is made up. Use your own numbers.

Detection and response skills for a cyber security analyst resume

• SIEM alert triage: Reading alerts from firewalls, IDS and the SIEM, checking them against other logs and deciding which are real. India's Security Analyst qualification puts this first in its threat-monitoring module. Give alert volume and the true positives you escalated. Example: Triaged 900+ Splunk alerts and escalated 34 true positives with evidence.
• Incident response: Collecting and preserving evidence, isolating affected systems and finding the root cause. The qualification assesses each of these steps and ends with a written incident report. Say how many incidents you handled and how fast you contained them. Example: Led 18 investigations, containing 2 ransomware attempts within the hour.
• SOAR playbooks: Automating the routine parts of detection, investigation and containment. Setting up SOAR tools is a named outcome in the qualification's incident module. Response time before and after your playbooks is the number a security manager wants. Example: Cut mean time to respond from 4 hours to 50 minutes with Sentinel playbooks.
• Detection tuning: Rewriting rules so analysts see fewer false alarms without missing real attacks. Name the platform and the rule count, then give the drop in false positives. Tuning shows you understand both the attacks and the environment. Example: Reduced false positives by 60% across 40 analytic rules.

Defence skills for a cyber security analyst resume

• Vulnerability management: Running regular scans, ranking findings by risk and pushing IT teams to patch. The qualification lists vulnerability assessments and patch coordination as assessed tasks. Show the age or count of open critical findings, before and after. Example: Cut critical vulnerabilities older than 30 days by 85%.
• Phishing awareness: The qualification gives phishing and social engineering a whole module, including designing simulations and studying how staff respond. Click rates before and after your campaign, and the number of staff covered, are the proof. Example: Brought phishing click rates from 14% to 3% with monthly simulations.
• Threat hunting: Searching for attackers your alerts missed, using a hypothesis and a query language. Mapping what you find to MITRE ATT&CK is one of the qualification's assessed tasks. State how often you hunted and what turned up. Example: Ran 12 hunts a quarter using KQL, finding 3 undetected persistence cases.
• Home lab and CTFs: The qualification's lab set-up includes Wireshark, Graylog as a SIEM, Wazuh for endpoints, Linux and Windows. A home lab using similar tools, plus ranked CTF or training-platform progress, is how freshers show hands-on skill. Example: Reached the top 3% on TryHackMe SOC and Blue Team paths.

Governance and team skills for a cyber security analyst resume

• ISO 27001: ISO 27001 and NIST are the frameworks the qualification names for security standards and compliance. Say what part you owned: risk register, controls, internal audit or the certification audit itself, and the scope it covered. Example: Achieved ISO 27001 certification for a 5,000-person GCC in 9 months.
• Regulatory reporting: CERT-In's 2022 directions require organisations to report listed cyber incidents within 6 hours of noticing them, and to keep ICT logs for a rolling 180 days within India. Say what process you built or ran to meet that. Example: Set up a CERT-In reporting process meeting the 6-hour window.
• Mentoring analysts: Teaching L1 analysts to triage, write up and escalate well is the usual first step toward a lead role. Say how many people you coached and what happened next, such as promotions or fewer escalations bounced back. Example: Mentor 5 L1 analysts, 2 promoted to L2 within a year.
• Security programme leadership: Running people, budgets and metrics across the security functions. The qualification's progression runs from security analyst to security architect and SOC specialist. Show team size, functions covered and one programme result. Example: Lead a security team of 8 across SOC, VM and GRC.

Which cyber security analyst skills to lead with, by experience

Entry level: Lead with networking, Linux and Windows basics, log analysis and one SIEM, then your lab and CTF work. The national qualification's lab uses free tools such as Wireshark, Graylog and Wazuh, so build with those or similar and describe what you detected. Add an entry certificate such as Security+ and any internship in a SOC or IT support.

Experienced: Lead with outcomes: incidents contained, response time cut, false positives removed, critical vulnerabilities closed. Name your SIEM, EDR and cloud platform in the advert's words. Then show reach beyond your queue: playbooks written, hunts run, analysts mentored, audits passed, and regulatory reporting such as CERT-In incident reports. That is the step toward lead, architect or manager roles.

Certifications for a cyber security analyst resume

• CompTIA Security+ or CEH.
• Microsoft SC-200, Splunk or vendor SOC certifications.
• OSCP for VAPT; CISSP or CISM for managers.

What to leave off a cyber security analyst resume

• A long list of hacking tools with no result attached. A security manager wants to know what you found or stopped, not what you installed.
• Offensive skills on a blue-team application with no context. Keep VAPT work, but explain it was authorised and what it fixed.
• Internal IP ranges, client names or details of real breaches. Sharing them on a resume is itself a security failure an interviewer will notice.
• Certifications you are still preparing for, listed as if passed. Write "in progress" with the expected date instead.

Action words that show cyber security analyst skills

Investigated, Contained, Detected, Triaged, Hardened, Remediated, Automated, Tuned, Audited, Led.

Skills for related jobs

• Data Engineer skills

Sources

Checked on 4 October 2026.

• National Qualification Register (NCVET): Security Analyst qualification file (IT-ITeS SSC NASSCOM), NSQF Level 5
• CERT-In: Directions under section 70B(6) of the IT Act, 28 April 2022