Cybersecurity CV example: certifications, CTF results and clearance

First decide which security role the CV is for

Security covers jobs that read very different evidence, and one CV rarely serves all of them. Choose the role, then pick the lines that match what its official profile describes.

What employers check before the interview

The BLS handbook says many employers prefer candidates with an information security certification, and that many analysts come from an IT department, often as network or systems administrators. Prospects says penetration testers are often expected to hold one or more professional testing qualifications and may need security clearance checks. The National Careers Service lists passing enhanced background checks as a requirement for IT security roles. So the certification block, the earlier IT role and any vetting status are read early.

Certifications and what each issuer requires

Every fact in this table comes from the issuer's own page, read on 13 October 2026.

Write the status the issuer gives you

ISC2 says a candidate who passes the CISSP exam without the experience becomes an Associate of ISC2 and then has six years to earn the five years required. Until ISC2 certifies you, write "Associate of ISC2 (passed the CISSP exam, 2026)", not "CISSP". The same care applies to OffSec: if your OSCP+ lapsed, you still hold the OSCP, so write that.

Security+ versions in late 2026

CompTIA says Security+ V8 is expected to launch on or around 17 November 2026, and the English V7 exam retires on 11 June 2027. A V7 certificate does not lose value when V8 arrives; write the version or exam code you passed so a reader can see which objectives you were tested on.

CTF and lab results as evidence

Prospects describes capture the flag (CTF) events as competitions where teams or individuals hack and defend systems to capture a file or code, and names them, with platforms such as Hack The Box, as a way to practise and build contacts. On a CV they work best as a short line that a reader can judge for difficulty.

A CTF line with a denominator

• Name the event and year, and whether it was solo or a team of how many.
• Give the placing out of the number of teams: "14th of 312" says more than "top 5%".
• Name the categories you solved yourself: web, forensics, reversing, cryptography.
• Link a write-up only if the event allowed publishing solutions.
• Keep platform ranks and lab counts in one line under Projects, not as job experience.

A home lab is evidence too, if it is specific: "Built a three-VM Active Directory lab to practise Kerberoasting detection; wrote 4 Sigma rules from it" is checkable in an interview; "passionate about hacking" is not.

Clearance language: say only what is true

United States

Under 32 CFR 117.10, a cleared contractor must first decide that access to classified information is essential to a classified contract, and requests for eligibility may not be used to build a cache of cleared employees. A contractor may start the investigation before the first day only when it has made a written job offer and the candidate has accepted it in writing. Non-US citizens may receive limited access only in rare cases, and that access never covers Top Secret.

United Kingdom

GOV.UK's vetting guidance says you need a sponsor, usually your HR officer or company security controller, that the clearance is owned by the sponsoring authority rather than by you, and that clearance is not guaranteed. The levels run from the Baseline Personnel Security Standard (pre-employment checks) through the Counter Terrorist Check and Security Check (SC) to Developed Vetting (DV) and Enhanced DV.

Example: SOC analyst CV section

Example only. Elif Kaya, her employers and the CTF are invented; the numbers show the form of a line.

SOC Analyst (Tier 2), a managed security provider, 05/2023 to present

• Triaged about 40 SIEM alerts a shift in Splunk for 9 client networks; escalated by written runbook.
• Tuned 22 correlation rules; false positives on the five noisiest rules fell by about half over one quarter.
• Led response on 6 confirmed incidents in 2025 (3 account takeovers after phishing, 2 malware infections, 1 publicly exposed storage bucket); each closed with a written timeline.
• Wrote 11 detection rules for credential-dumping and lateral-movement behaviour, tested in a lab before release.

Network Administrator, a regional hospital group, 09/2020 to 04/2023

• Ran firewalls and VPN for 14 sites; moved remote access to multi-factor authentication for 1,100 staff.
• Patched and documented 260 switches and access points against a quarterly schedule.

Certifications and CTF

• CompTIA Security+ (SY0-701), 04/2024, valid until 04/2027.
• ISC2 Certified in Cybersecurity (CC), 10/2022.
• Associate of ISC2: passed the CISSP exam 06/2026; experience requirement in progress.
• University CTF 2025 (team of 4): 14th of 312 teams; solved 2 web and 1 forensics challenge.

Proof: sources and reading date

Every claim above comes from these pages, read on 13 October 2026; links are under Sources.

Who should not use this layout

• People moving into security with no IT job yet: lead with labs, CTFs and an entry certificate, and keep the CV to one page.
• Engineers whose security work is a slice of a platform job: the DevOps page shows scanning and patching inside a delivery role.
• Application security work that is mostly code review in your own team: the backend developer page covers OWASP-named fixes.

Applying abroad and next steps

Clearance rules are national, and the US rules above limit non-citizens. For the UK, the page for international applicants covers sponsorship and the visa side; for Germany, the developer CV page covers the IT specialist route. Neither is repeated here.

CitedCV writes the CV from facts you give it and checks the names and numbers in each line against them, so a certification appears only as you entered it. A new account gets 6 free credits for a first draft.

Questions people ask

Sources

1. O*NET OnLine, 15-1212.00 Information Security Analystswww.onetonline.org/link/summary/15-1212.00
2. U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Information Security Analystswww.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm
3. National Careers Service, IT security co-ordinatornationalcareers.service.gov.uk/job-profiles/it-security-co-ordinator
4. Prospects, Penetration testerwww.prospects.ac.uk/job-profiles/penetration-tester
5. CompTIA, Security+ V7www.comptia.org/en-us/certifications/security/v7/
6. CompTIA, Security+www.comptia.org/en-us/certifications/security/
7. CompTIA, CySA+www.comptia.org/en-us/certifications/cybersecurity-analyst/
8. CompTIA, PenTest+www.comptia.org/en-us/certifications/pentest/
9. CompTIA, Certification renewal policywww.comptia.org/en-us/resources/test-policies/continuing-education-policies/certification-renewal-policy/
10. CompTIA, Security+ V7 renewal: 50 CEUswww.comptia.org/en-us/resources/ce/renew-options/renewing-security-multiple/
11. ISC2, CISSP experience requirementswww.isc2.org/certifications/cissp/cissp-experience-requirements
12. ISC2, Certified in Cybersecurity (CC)www.isc2.org/certifications/cc
13. ISC2, SSCPwww.isc2.org/certifications/sscp
14. ISC2, Member policies (CPE requirements)www.isc2.org/policies-procedures/member-policies
15. ISC2, Annual maintenance feeswww.isc2.org/policies-procedures/amfs-overview
16. OffSec, PEN-200 and OSCPwww.offsec.com/courses/pen-200/
17. 32 CFR 117.10, Determination of eligibility for access to classified information (eCFR)www.ecfr.gov/current/title-32/section-117.10
18. GOV.UK, National security vetting: clearance levelswww.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels
19. GOV.UK, United Kingdom Security Vetting: applicantwww.gov.uk/guidance/united-kingdom-security-vetting-applicant