Cybersecurity Student Resume Example

A cybersecurity student resume gets screened for certifications first and hands-on work second. Security+ or a vendor networking cert gets you past the applicant filter; a SOC internship, a capture-the-flag record and a documented home lab get you the interview.

The Sample resume below is a junior in Colorado Springs who passed Security+ in his second year, captains the campus CTF team, works as a student technician for campus IT and finished a summer internship in a managed security operations center. The SOC bullets say how many alerts he triaged, in which SIEM, and what he escalated.

Security hiring for students runs through internships at MSSPs, defense contractors and the security teams of large companies, and almost all of them ask about Security+ or an equivalent. If you do not have a certification yet, write the exam date. For the roles this page leads to, read the network engineer example and the system administrator example; the information technology student example covers the help desk route many security analysts start on. Rules every student page shares are on the business student example.

Updated . The person and employers in this Sample resume are fictional.

Cybersecurity Student sample resume

Gabriel Lindqvist

Cybersecurity Student, Class of 2027 | CompTIA Security+ | SOC Intern | CTF Team Captain

Colorado Springs, COgabriel.lindqvist@example.com(719) 555-0126

Summary

Junior cybersecurity major at Rampart Range University, graduating May 2027 with a 3.6 GPA, CompTIA Security+ and Network+. Completed a twelve-week SOC analyst internship at a managed security provider triaging alerts in Splunk, captain a 20-member capture-the-flag team and maintain a documented home lab for detection engineering. US citizen, eligible for a security clearance. Seeking a summer 2026 security operations or detection engineering internship.

Experience

SOC Analyst Intern (Tier 1), Granite Shield Security Operations

–

Colorado Springs, CO

  • Triaged an average of 45 alerts per shift in Splunk Enterprise Security for 14 client networks, closing about 70 percent as benign with documented reasoning and escalating the rest to Tier 2 within the 15-minute SLA.
  • Wrote three Splunk correlation searches for suspicious PowerShell execution patterns that the detection team tuned and deployed to all clients, reducing a recurring false-positive alert by about 300 events a week.
  • Investigated a credential-stuffing attempt against a client's VPN and produced the timeline and indicator list the incident lead used in the client report.
  • Documented the Tier 1 playbook for phishing-report triage in the team wiki, which replaced a set of email notes.
Student Technician, Campus IT Security, Office of Information Technology, Rampart Range University

– Present

Colorado Springs, CO

  • Run the campus phishing simulation program with a full-time analyst, sending monthly campaigns to about 6,000 accounts and reporting click and report rates to the security office.
  • Review vulnerability scan results in Tenable for student-facing servers and file remediation tickets with the server team, tracking 140 findings to closure over two semesters.
  • Staff the help desk security queue for compromised-account resets, handling about 25 cases a week.
Captain, Capture-the-Flag Team, Cybersecurity Club, Rampart Range University

– Present

Colorado Springs, CO

  • Lead a 20-member team through six online CTF events a year; placed 14th of 310 university teams in a national collegiate CTF in spring 2025.
  • Run weekly practice sessions on web exploitation, forensics and reverse engineering, writing six challenges a semester for newer members.
  • Grew the roster from 9 to 20 by pairing each first-year with a returning member for the first two events.
Home Lab (ongoing), Independent project

– Present

Colorado Springs, CO

  • Run a Proxmox lab with Windows Server, Active Directory, two Linux hosts, pfSense and a Wazuh SIEM, used to test detections for techniques mapped to MITRE ATT&CK.
  • Published 11 write-ups on GitHub covering detections built in the lab, including a Sigma rule for Kerberoasting that the CTF team now uses for practice.

Education

Bachelor of Science in Cybersecurity (expected May 2027)

Rampart Range University, Colorado Springs, CO

GPA 3.6. Courses: Network Security, Operating Systems, Digital Forensics, Secure Scripting (Python), Incident Response, Cryptography, Cloud Security Fundamentals. Program is a National Center of Academic Excellence in Cyber Defense designee.

Skills

  • Splunk Enterprise Security and Wazuh (SIEM)
  • Alert triage and escalation
  • Phishing analysis and simulation
  • Vulnerability management (Tenable)
  • Windows and Active Directory
  • Linux administration
  • Python scripting for log parsing
  • Sigma and Splunk SPL detections
  • MITRE ATT&CK mapping
  • Wireshark and packet analysis
  • Networking (TCP/IP, VLANs, firewalls)
  • Incident documentation

Certifications

  • CompTIA Security+, CompTIA,
  • CompTIA Network+, CompTIA,
  • Splunk Core Certified User, Splunk,

Start yours from this example

Opens this sample in the editor, in one of the templates below. Swap in your details, then tailor it to each posting in about two minutes.

Use this example

Templates for the cybersecurity student resume

All templates

How the resume changes with experience

The same cybersecurity student resume, written at three levels: a summary and three bullets for each.

Entry level

Zero to two years, or a first role in the title

First-year cybersecurity student with CompTIA A+ earned in high school, a home lab started last year and a seat on the campus CTF team, with Security+ scheduled for March, applying for a campus IT security student position.

  • Built a two-virtual-machine lab with a Linux attacker box and a Windows target to work through beginner CTF challenges.
  • Finished A+ as a high school senior through a career and technical education program and scheduled Security+ for spring break.
  • Joined the CTF team as the only first-year and asked to be paired with the forensics lead rather than spread across every category.

Mid level

Three to seven years, owns a process or a workload

Junior cybersecurity student with Security+ and Network+, a SOC internship, a CTF captaincy and a documented home lab, applying for summer 2026 security operations and detection engineering internships.

  • Triaged about 45 alerts a shift across 14 client networks in a managed SOC and met the 15-minute escalation SLA on every shift.
  • Three correlation searches I wrote were deployed to all clients and cut a recurring false positive by about 300 events a week.
  • Chose a Tier 1 SOC internship over a better-paid help desk job because alert triage is the work I want to be hired for.

Senior

Eight years or more, leads people, budgets or programs

Graduating cybersecurity senior with two security internships, Security+, CySA+ and an in-progress clearance sponsored by a summer employer, seeking a full-time SOC analyst or detection engineer role starting June 2027.

  • Second internship on a defense contractor's internal security team covered endpoint detection tuning across 4,000 hosts and a purple-team exercise write-up.
  • Senior capstone built a detection coverage map against MITRE ATT&CK for the campus network, adopted by the security office as its gap list.
  • Took the CySA+ in the fall of senior year rather than a penetration testing cert because defensive roles are where the entry openings are.

Skills to put on the cybersecurity student resume

Hard skills

CompTIA Security+
It is the certification most entry security postings name, it satisfies baseline requirements for many federal and contractor roles, and students can earn it in their second year.
SIEM triage experience
Naming Splunk, Sentinel or Wazuh with an alert volume tells a SOC manager you can sit at a queue on day one.
Networking fundamentals
Network+ or a networking course with packet analysis is what separates students who understand an alert from those who read it.
Windows, Active Directory and Linux
Most incidents involve an identity or a host, and a home lab with both proves you can navigate them.
Scripting in Python or PowerShell
Parsing logs and automating a lookup are daily tasks, and a script linked on GitHub is the evidence.
A documented home lab
It is the security student's portfolio; write-ups on GitHub give an interviewer something concrete to ask about.
MITRE ATT&CK vocabulary
Detection and SOC teams organize work around it, and using it correctly on the page signals you have read real reports.
Clearance eligibility
In defense-heavy markets a line stating citizenship and eligibility, or an active clearance, moves a resume into a separate and shorter pile.

Soft skills

Writing a clear incident note
A Tier 2 analyst reads your ticket, not your mind; a playbook or timeline bullet shows you can hand off cleanly.
Calm under a queue
SOC work is volume with an SLA, and a bullet with alerts per shift and the SLA met is the proof.
Teaching others
Running CTF practice or onboarding first-years shows the mentoring that security teams rely on for junior analysts.
Integrity
Security employers check backgrounds and references; roles handling a phishing program or account resets show you have been trusted with access.

Mistakes that cost cybersecurity student interviews

  1. Listing tools you have only watched videos about

    A skills line with Burp, Metasploit, Nessus, Splunk and Sentinel invites a question about each. Keep the tools you have used in a lab, a CTF or a job, and let a bullet or a write-up prove each one.

  2. Leaving the home lab off

    A lab is the one piece of security experience every student can build without permission. Give it an entry with the components, what you test in it and a link to the write-ups. An undocumented lab is a hobby; a documented one is a portfolio.

  3. Calling yourself a penetration tester

    Playing CTFs is not penetration testing, and senior interviewers will test the claim. Describe the CTF work accurately, with placings and the categories you cover, and leave offensive titles for after you have done the work professionally.

  4. Hiding the certification exam date

    If you have not passed Security+ yet, write the scheduled date under certifications. Many postings require it at hire rather than at application, and a date tells the recruiter you will qualify.

  5. Writing the SOC internship as a list of tools

    The reader wants volume, decisions and outcomes: alerts per shift, how many you escalated, what you wrote that got deployed, the incident you helped document. Tools go in the skills line.

  6. Forgetting eligibility lines

    If a market or an employer needs clearance, state citizenship and eligibility, or the clearance you hold and its status, in the summary. Leaving it out can drop an otherwise strong student from the pool.

Questions about the cybersecurity student resume

Which certification should a cybersecurity student get first?

CompTIA Security+ for most students, usually in the second year. It is named in more entry postings than any other and meets baseline requirements for federal and contractor work. Network+ before or after it helps if your program is light on networking. Vendor-neutral certifications first; a specific SIEM or cloud certification after an internship tells you which one matters.

How do I get a SOC internship with no experience?

Security+ or an exam date, a documented home lab with write-ups, a campus IT or help desk job that touched accounts or scans, and CTF participation with placings. Apply to managed security providers and the internal security teams of large local employers, which hire Tier 1 interns in volume. Many first SOC roles come through a help desk job at the same company.

Should I list capture-the-flag competitions on a resume?

Yes, as an entry under experience or projects with the team size, the events, your categories and your placing out of the field. Say what you contributed if you were not the captain. Interviewers ask about a specific challenge you solved, so be ready to walk through one.

Do cybersecurity students need a GitHub?

It helps more than in most majors. Use it for lab write-ups, detection rules, scripts and CTF solutions (after an event allows publication). A dozen readable write-ups give an interviewer an hour of questions, which is what you want.

How should I write my home lab on a resume?

As its own entry with a start date and no end: the hypervisor, the hosts, the firewall and the SIEM, what you use it to test, and the write-ups it has produced. Keep the hardware out unless it is unusual. Two bullets are enough; the link does the rest.

Does clearance eligibility belong on a student resume?

In defense-heavy regions, yes, in the summary: US citizen, eligible for a security clearance, or the clearance you hold with its level and status. Never state a clearance you do not have, and do not list the exact adjudication details.

Related resume examples

All examples

Every application goes out fitting the job.

Paste a posting, get a resume written for it in two minutes.

Tailor your resume — free

Free to start. No card. Same price on web, iOS and Android.