A security CV should show risk reduced, time saved, and how you enable teams (not just “found vulnerabilities”).
See the general guide: IT CV template (Romania).
TL;DR
- Focus on outcomes: fewer incidents, faster remediation, better coverage, safer defaults.
- Mention scope and constraints (org size, systems, cloud, compliance).
- Show you can collaborate: security work is cross-team by default.
Quick checklist (before you send)
- Title: “AppSec Engineer” / “Security Engineer (Cloud)” / “SecOps” + scope (web, cloud, platform).
- 3–6 strong bullets: risk/impact → action/control → result (metric or signal).
- Call out secure SDLC, vuln management, IAM/secrets, logging/monitoring, incident response (as relevant).
- Avoid sensitive details (exact exploits, internal configs, keys, customer data).
Recommended structure (Security)
- Header (clean links)
- Summary (2–4 lines: your area + what you deliver + what you’re targeting)
- Experience (risk reduction + enablement + automation)
- Selected projects (recommended for juniors/switchers; focus on outcomes)
- Skills (AppSec, Cloud, SecOps, tooling)
- Certs (if any, short)
What a strong bullet looks like (Security)
Useful formula: Risk/problem + context (systems/teams) + control/automation + result (metric or signal).
Examples:
- “Reduced mean time to remediate high‑severity issues from ~14 days to ~5 days via SLAs, automated reporting, and clear ownership.”
- “Added secret scanning in CI and a rotation process, reducing credential‑leak incidents.”
- “Implemented least privilege for critical services, reducing excessive permissions and lateral movement risk.”
No numbers? Use signals:
- better coverage (SAST/DAST/dependency scanning), fewer noisy alerts, faster incident triage, more predictable patching, safer defaults adopted by teams.
Bullet library (Security)
Pick 6–10 that are actually true for you, then tailor them to the role.
AppSec / secure SDLC
- “Introduced security review checklist for PRs, reducing recurring issues.”
- “Built threat model templates for top product flows, improving early risk detection.”
- “Improved dependency scanning and patch SLAs, reducing exposure window.”
- “Standardized secure defaults (headers/CSP/input validation patterns), reducing a class of vulnerabilities.”
- “Created practical secure patterns/docs for teams, reducing back-and-forth and recurring questions.”
Detection & response
- “Reduced time-to-detect by improving alert signal quality and runbooks.”
- “Improved incident triage with better logging and correlation, cutting investigation time.”
- “Built incident playbooks (phishing/credential leak/abuse), reducing time-to-response.”
- “Reduced alert fatigue by tuning rules and adding dedupe/thresholding.”
Cloud / platform security
- “Implemented least-privilege access patterns, reducing risky permissions.”
- “Standardized secrets handling across environments, reducing leaks and rotation pain.”
- “Added IaC/policy checks to prevent risky configurations and reduce drift.”
- “Implemented audit logging + alerting for sensitive actions (IAM, tokens, exports).”
Vulnerability management
- “Introduced risk‑based triage, keeping focus on issues that actually matter.”
- “Automated owner mapping + due dates, improving remediation rate.”
Compliance / audit (when relevant)
- “Prepared audit evidence (control mapping, artifacts), reducing manual effort each cycle.”
- “Made controls repeatable via documented processes and automation.”
Enablement (security as an enabler)
- “Ran short, practical training on recurring issues, reducing repeat findings.”
- “Built self‑serve workflows (docs + templates) so teams ship safely without blockers.”
Common mistakes
- Only listing tools (Burp, Nessus, SIEM) without outcomes.
- No mention of how you coordinated with engineering/product.
- Writing in “security theater”: big claims, no proof.
- Over‑sharing sensitive details that don’t belong in a CV.
Useful keywords (use only what you actually did)
- secure SDLC, threat modeling, OWASP Top 10
- SAST/DAST, dependency scanning, SBOM (when relevant)
- IAM, least privilege, secrets management
- logging/monitoring, SIEM (if applicable), incident response
- IaC security, policy‑as‑code, cloud posture
- patch SLAs, vulnerability triage, risk‑based prioritization
Security CV template (copy/paste)
FAQ
Should I list CVEs or exploit details?
Usually no. Describe categories and outcomes, without details that could help attackers or expose internal systems.
I did AppSec work as part of another role. How do I write it?
Keep the bullets in your main role (backend/devops), but make the outcomes clear: “reduced risk”, “standardized”, “automated”, “improved patching/coverage”.
