An information security analyst resume should show what you investigated, which evidence you checked, and what you concluded or escalated. This security operations example connects identity and endpoint alerts to log queries, case records, and responder handoffs. It keeps investigation work separate from authority to contain an incident.
Darius Bell, his employers, his college, and this resume are fictional. He works on an internal security team in Omaha, Nebraska, after an earlier paid IT support role. Replace the sample details with your own systems, dates, responsibilities, and qualifications.
Darius Bell
Information Security Analyst
(402) 555-0163darius.bell@example.comOmaha, NE
Summary
Information security analyst investigating identity and Windows endpoint alerts on an internal security team since 2023, following IT support work. Uses Microsoft Sentinel, KQL, and Microsoft Defender for Endpoint to review activity, record findings, and escalate cases to incident responders. Documents unresolved questions and next actions for shift handoffs.
Experience
- Review Microsoft Sentinel alerts involving employee accounts and Windows endpoints, check related alerts and affected users or devices, and prioritize investigation using the team's severity criteria.
- Write KQL queries against Microsoft Entra ID sign-in logs in Sentinel to compare failed and successful attempts, source IP addresses, and authentication details. Record the time window and unresolved questions in the case. (note 1)
- Use Microsoft Defender for Endpoint device timelines to review process, file, and connection events around an alert. Send the incident responder a timeline with event references and suspected scope for further investigation. (note 2)
- Analyze employee-reported phishing messages using headers and the approved email investigation console. Record sender details, authentication results, and message IDs, then refer suspicious messages to the responder for removal decisions.
- Document evidence for cases assessed as expected activity under the team's review procedure, including the system owner's confirmation when relevant. Escalate cases that remain unexplained rather than closing them on an assumption.
- Update open case records before shift handoff with completed checks, pending questions, the assigned responder, and next actions. Record containment actions reported by responders separately from personal investigation work. (note 3)
- Investigated Windows sign-in and Microsoft 365 application problems, recorded troubleshooting steps in support tickets, and confirmed restored access with employees.
- Referred reports of unexpected account prompts and suspicious email to the security team with user descriptions and timestamps, without treating the reports as confirmed compromises.
Education
Skills
Microsoft Sentinel, KQL, Microsoft Defender for Endpoint, Microsoft Entra ID, Alert triage, Log analysis, Phishing analysis, Incident documentation
- Note 1:
The query has a defined source, purpose, and investigation window. The skills list names KQL, and this bullet shows what it was used for.
- Note 2:
The timeline gives the responder evidence to check as the investigation continues.
- Note 3:
Recording another person's containment action does not mean Darius performed it.
Define the security work behind the title
“Information security analyst” can describe different work. Darius's summary identifies identity and Windows endpoint investigations. His bullets show alert triage in Microsoft Sentinel, sign-in log queries, device timelines, and reported phishing. They do not establish penetration testing, malware reverse engineering, cloud security architecture, compliance ownership, or detection engineering.
Read the job posting for its actual responsibilities. A security operations center, often shortened to SOC, may separate initial triage from deeper investigation and response. Another team may combine those duties with infrastructure work. A senior opening may expect threat hunting, detection tuning, automation, or leadership. Darius's resume supports the investigation scope shown here, rather than every role with a security title.
His security work begins in May 2023. The earlier IT support entry supplies relevant troubleshooting and escalation experience, but it does not turn July 2021 into the start of a security analyst career. Keep your actual titles and dates when moving from support into security. The IT support example shows the different evidence behind that earlier kind of work.
Follow the alert into the evidence
An alert names something to investigate. It is not, by itself, proof of a compromise. Darius's identity bullet shows what he compares: failed and successful sign-ins, IP addresses, and authentication details. Recording the time window makes the scope of the query visible. Recording unanswered questions keeps the resume from implying that a query alone established the cause.
Experience
- Write KQL queries against Microsoft Entra ID sign-in logs in Sentinel to compare failed and successful attempts, source IP addresses, and authentication details. Record the time window and unresolved questions in the case.
- Use Microsoft Defender for Endpoint device timelines to review process, file, and connection events around an alert. Send the incident responder a timeline with event references and suspected scope for further investigation.
The endpoint bullet adds process, file, and connection events around the alert. Darius passes a timeline and event references to a responder. That is a concrete deliverable even though he does not claim to have identified the attacker, found every affected device, or completed the response.
For your own bullet, identify the alert type, data source, checks, and output you can discuss. Distinguish writing a query from running a saved search, and investigating an alert from building the rule that generated it. Naming a platform does not establish every capability that platform offers.
Do not add a percentage of attacks prevented or a claim of “zero breaches” to make the work sound successful. If you have reliable measures, define what they count and the reporting period. Alert volume is not the same as confirmed incident volume, and a team's response time is not automatically your personal result. Without measured outcomes, your evidence can be a supported conclusion, documented uncertainty, or a useful escalation. The bullet-point guide explains how to write from those facts.
Show the decision and the response boundary
Darius's phishing work names the material he examined and the identifiers he recorded. He refers suspicious messages to a responder for removal decisions. The resume does not say that he removed messages from mailboxes, blocked a domain, disabled an account, or isolated a device.
Experience
- Analyze employee-reported phishing messages using headers and the approved email investigation console. Record sender details, authentication results, and message IDs, then refer suspicious messages to the responder for removal decisions.
- Document evidence for cases assessed as expected activity under the team's review procedure, including the system owner's confirmation when relevant. Escalate cases that remain unexplained rather than closing them on an assumption. (note 1)
- Update open case records before shift handoff with completed checks, pending questions, the assigned responder, and next actions. Record containment actions reported by responders separately from personal investigation work.
- Note 1:
The expected-activity assessment has supporting evidence and a review procedure. Unexplained activity remains an escalation.
A finding of expected activity also needs evidence. Darius describes the team's review procedure and system-owner confirmation where relevant. An unfamiliar IP address alone would not prove malicious activity, and a familiar address would not settle every investigation. His resume leaves room for questions rather than promising certainty from a single signal.
If you performed containment, describe the action and your authorization accurately. If you only recommended it, requested approval, or recorded what another responder did, use those verbs. “Handled incidents” is too broad when your work stopped at triage. Darius's handoff identifies completed checks, pending questions, the assigned responder, and next actions, so the contribution is clear without claiming ownership of the entire incident.
The same care applies to adjacent technical work. A reproducible application defect, as in software QA testing, and evidence of suspicious account activity call for different investigations. Do not describe application testing or device troubleshooting as security incident response just because the work is technical.
Match skills, credentials, and practice to your evidence
Every skill in the sample has support. Sentinel and alert triage appear in the first bullet. KQL and Microsoft Entra ID are tied to sign-in analysis. Defender for Endpoint has a device-timeline task. Log analysis, phishing analysis, and incident documentation each have concrete examples. The Entra ID skill demonstrates sign-in log investigation. It does not establish tenant administration or identity architecture.
Darius has an Information Systems degree and no professional certification. Using Sentinel does not make him Microsoft Certified: Security Operations Analyst Associate. If you hold that credential or another certification, use its actual name, issuer, and earned date, and verify its current status. Keep exam preparation separate from an awarded credential. The certifications guide explains how to label those differences.
Check required experience, credentials, shift availability, location, and any citizenship or clearance conditions in the actual posting. These vary by employer. A resume with initial investigation experience does not establish the deeper response or detection responsibilities a level-two (L2) or senior opening may require. Leave an unsupported requirement as a gap when deciding whether to apply.
If you are entering security, a clearly labeled lab can show a generated alert, the synthetic logs you examined, your query, and what you could or could not conclude. State that the environment was a lab and distinguish your work from a supplied walkthrough. Do not present practice systems as an employer's production environment. The personal-projects guide covers placement and labeling.
Keep confidential case details out of public samples. You can describe the kind of evidence and your contribution without publishing real account names, internal addresses, tokens, or employer screenshots. Darius's fictional resume names the investigation methods without exposing a real case.