Building a Cyber Security CV With No Professional Experience

The usual complaint is that nobody hires without experience. The more common reality is a CV that lists courses and tools, which tells a reader what you were exposed to and nothing about what you can do.

Your lab work, your competition entries and your write-ups are experience. They just need to be presented as work rather than as study.

Structure, in this order

1. Name, location, email, and links to your repository and write-ups. The links are the most valuable line on the page.
2. Two lines of summary. What you do, what you are looking for. No adjectives.
3. Projects. First, because it is your strongest section.
4. Skills, grouped and honest.
5. Education and certifications.
6. Any work experience, including unrelated work.

Projects go above education because that is the section a technical reader actually reads.

Write projects as outcomes, not activities

Weak:

Built a home lab with Windows and Linux VMs and installed a SIEM.

Strong:

Built a detection lab: Windows and Linux hosts forwarding logs to Wazuh. Executed credential-dumping and lateral movement techniques against it, then wrote six Sigma rules that detect them. Two initially produced false positives on legitimate administrative activity; tuned both. Write-up: [link]

The second version proves you performed the attack, understood the telemetry it produced, wrote the detection, and discovered the failure mode yourself. That is a day of real security work described in four lines.

The same applies offensively. Not "practised on vulnerable web applications" but "found and documented an access control flaw allowing one account to read another's records; wrote it up in client report format".

The skills section, honestly

Group by area rather than listing thirty tools. Within each, be accurate about level — "used in lab work" is a perfectly respectable label and far better than being caught overstating.

Remove anything you could not discuss for five minutes. Interviewers pick the most impressive item on the list and ask about it, and a CV that cannot survive that question damages everything else on it.

Unrelated work experience belongs on the page

Retail, call centre, teaching, delivery — keep it, described for its transferable content. Handling an angry customer calmly is directly relevant to incident communication. A role where you were trusted with cash or keys says something about reliability. Any job where you held a shift and showed up is evidence of the thing employers are actually nervous about with juniors.

Certifications: list what you hold, state clearly what you are preparing for

Hold a certification, list it. Studying for one, put it under a separate "In progress" heading with the expected date. Completed the training but not the exam, say exactly that — "course completed, exam not yet taken".

Blurring these is the most common reason a security CV fails a background check, and it fails it for honesty rather than for qualifications.

Passing the filter without lying

Many applications are filtered on keywords before a human sees them. Read the advert and use its vocabulary where it is genuinely true of you — if it says SIEM and you have used Wazuh, write "SIEM (Wazuh)". That is accurate and matches both.

Keep the formatting plain: one column, no tables, no graphics, no skill bars. Parsers mangle them and reviewers dislike them.

One page, and a cover note that says something

One page at this stage. Two signals that you could not prioritise.

If a cover note is accepted, make it three short paragraphs: the role you want, one specific thing you built with what it taught you, and why this employer. Generic cover notes are ignored; a specific one about a real piece of work is read.

Frequently asked questions