I read resumes for a SOC hiring round once, about sixty of them in an afternoon, and the ones from people without a security job yet split into two piles. One pile had a cert at the top and a paragraph of adjectives under it. The other had the same cert and three lines that read like a shift handover: here is what I looked at, here is what I decided, here is the console I did it in. The second pile got the phone screens. You can land in that pile with nothing behind you but labs and maybe a help desk job.
What goes at the top when there is no security job
The top third of the page is the only part a recruiter reads on the first pass, so it has to answer “can this person work an alert” before they reach the part of your history that says Geek Squad or Starbucks. Name and contact on one line. Under that, a two-line skills summary written as plain sentences, naming the tools you have actually used. Something like: “Entry-level SOC analyst with a home lab built around Splunk and Wazuh, Security+ certified, and 40 hours of logged alert triage in a simulated SOC environment.” Then the certifications block, then projects, then work history.
Skip the objective statement. “Seeking a challenging role where I can grow” gives the reader nothing to act on and pushes the useful lines down the page.
Write every lab like a shift report
This is the section that separates the two piles. A lab entry that says “Set up a SIEM and practiced detection” is a hobby. The same lab written as an investigation is experience, and the difference comes down to three questions: what did you look at, what did you decide, and which tool did you decide it in.
So instead of “Completed phishing analysis labs,” write: “Investigated reported phishing emails by reading headers and SPF, DKIM and DMARC results, traced delivery to every recipient, and purged the message where the sender failed authentication. Closed each case with a verdict and a written note.” Instead of “Learned endpoint detection,” write: “Walked the process tree on a flagged host, checked the parent process and its outbound connections against threat intelligence, and isolated the host when the file hash came back known-bad.” A hiring manager can picture either one happening on their floor.
Count things where you honestly can, and name what you searched. Forty cases closed, twelve false positives, most of them opened with a log search on one user and one address. Numbers hand the interviewer something to ask about, which is how the SOC interview tends to open anyway.
If you came from a help desk, the same rewrite applies to that job. You already did security work there, filed under support. The password resets after a suspected compromise, the laptop you pulled off the network because it was talking to something odd, the phishing reports you forwarded to security. Those go in the help desk entry with the security angle leading, and the move from help desk to SOC gets easier when the resume already reads that way.
Which certs, and where they sit
Security+ is the one most filters key on, so if you hold it, it goes in the skills summary and in the certifications block both. CompTIA’s own pricing page put the SY0-701 voucher at $404 as of January 2025, so budget for exactly one attempt and study like it. CySA+ or BTL1 after that tells a reader you have worked alerts end to end, and the differences between the three are worth reading before you spend.
List each cert with the year you passed. An exam you have booked goes on the page as “scheduled,” with the month. Completion badges from a free training platform belong in the projects section, as the thing you did there, because next to a proctored exam they look thin.
The words the filter is reading for
Applicant tracking software does a dumb string match before any human sees your page, and the strings for a Tier 1 SOC posting are predictable: SIEM, EDR, phishing analysis, MITRE ATT&CK, incident triage, log analysis, threat intelligence. Then the product names the team runs, usually Splunk or Sentinel on the SIEM side and CrowdStrike or Defender on the endpoint side.
Use the ones that are true and put each inside a sentence that shows what you did with it. “Mapped each closed alert to its MITRE ATT&CK technique in the case note” passes the filter and survives the human. A skills section that is a comma-separated wall of acronyms passes the filter and then dies on the first read, because the human assumes, correctly, that you pasted it from the posting. Swap product names per posting wherever you have genuinely touched the product, and if you only know the open-source equivalent, name that one and let the category word carry the match.
What to cut, and why one page
Anything older than five years with no technical angle. The soft-skills line about being a team player. The GPA. The two-column layout with a sidebar, which the parser reads as one scrambled column. “References available on request.” The paragraph about your passion for cybersecurity, which every other applicant has too and which the reader stopped believing years ago.
One page is the rule at this level. A second page with no security job on it waters down the page that holds your labs. If it still will not fit, cut the oldest job first, then trim the help desk entry to the lines with a security angle, then tighten every lab line to a single sentence.
A project you can write up by the end of the week
If the projects section is thin, the fastest honest fix is to work cases somewhere that tells you afterward whether your verdict was right. The Security Simulator inside ServiceDesk Simulator is one option, in beta: a queue of alerts with the ATT&CK technique attached, consoles for log search, sign-in history, endpoint activity, threat intel and mailbox audit, and a close code plus a note on every case. The beta waitlist is open, and a lab you built yourself does the same job once it answers the same three questions.