Security might be the most frustrating field to break into right now. Everyone says there is a talent shortage, yet every posting wants three years of experience, a stack of certifications, and hands-on incident response, all for an entry-level salary. You are studying nights for Security+, running a home lab on a wheezing old desktop, and wondering if any of it will get past the filters.
Here is the honest answer: certs and experience matter to different gatekeepers, and understanding which one you are facing at each stage tells you exactly what to put on the page.
Two gatekeepers, two different questions
Your resume faces a machine first and a human second, and they screen differently.
The filter (ATS plus recruiter search) asks: does this resume contain the right strings? Security hiring leans unusually hard on exact acronyms. Recruiters search "Security+," "CySA+," "SIEM," "Splunk," "incident response," "SOC." If those strings are not in your resume text, you may never be seen, no matter how good your lab is. This is mechanical string matching, the same way an ATS reads your skills section in any field, just with higher stakes because security vocabulary is so acronym-heavy.
The human (SOC lead or hiring manager) asks: can this person actually investigate something? They have seen a hundred resumes with the same cert list. What separates candidates is evidence of real hands-on thinking: an alert triaged, a lab built, a phishing case worked end to end.
The temptation is to pad for the first gatekeeper. The problem is the second one will test everything, and security interviewers are professionally suspicious. So you need a resume that satisfies the filter using only claims that survive the human.
The honest hierarchy of security claims
Sort everything you might put on your resume into these four tiers, and present each at its true level. This hierarchy is the backbone of a defensible security resume.
Tier 1: Certifications you have earned
The strongest filter fuel, and binary: you passed or you did not. List the exact name and year ("CompTIA Security+, 2027"). If you are scheduled but not passed, say exactly that: "Security+ exam scheduled March 2028." That still shows the string to a recruiter's search while staying true. Never list a cert you failed or merely started studying for as if you hold it. Certs are verified in minutes.
Tier 2: Paid work that touched security
Even if your title was help desk or sysadmin, real security tasks count fully: password resets and account lockouts you investigated, phishing emails you triaged, endpoint alerts you escalated, patches you deployed. Write them as what they were:
- Investigated roughly 10 to 15 suspicious email reports per week, checking headers and URLs and escalating confirmed phishing to the security team.
- Managed endpoint protection alerts for about 300 workstations, isolating 4 machines with confirmed malware over one year.
If your background is IT support, this is your bridge; see how an IT support resume beats the ATS for the broader framing.
Tier 3: Labs you built, labeled as labs
Home labs are legitimate and respected, on one condition: you never dress them up as employment. Give them their own section ("Security Lab Projects") and write bullets as concrete as job bullets:
- Built a home SOC lab: Wazuh SIEM on Proxmox, Windows and Linux VMs as targets, Sysmon logging; wrote 12 detection rules for credential dumping and persistence techniques.
- Completed 40+ rooms on TryHackMe, including the SOC Level 1 path; documented investigations in a public write-up repository.
Notice what makes these strong: numbers, tool names, and specific techniques. "Familiar with SIEM concepts" is filler. "Wrote 12 Wazuh detection rules" is evidence.
Tier 4: Things you have read about
This tier does not go on the resume. If you know what Cobalt Strike is but have never touched a detection for it, it is interview conversation at most. Listing it invites the exact scenario question that ends the interview.
So which wins, certs or experience?
The truthful answer: certs get you retrieved, experience gets you hired, and the filter comes first.
If you have zero certs and a great lab, the human who would love your lab may never see it, because the recruiter's search for "Security+" skipped you. If you have three certs and nothing hands-on, you will surface constantly and then lose in interviews to candidates who can narrate a real investigation.
So the efficient honest strategy for a breaking-in candidate is:
- Earn one foundational cert (Security+ is the most-searched string at entry level). This is filter fuel you actually own.
- Build one lab you can talk about for twenty minutes. Depth beats breadth. One SIEM you configured, tuned, and wrote detections for outperforms five half-finished tools.
- Mine your existing work for true security tasks and write them in security vocabulary where it genuinely fits.
Career changers coming from outside IT entirely can layer this on top of the transferable-skills approach in writing a career change resume without direct experience.
Keywords without padding
Pull the posting for a role you want and list its security terms: SIEM, EDR, incident response, threat hunting, vulnerability management, NIST, MITRE ATT&CK. Then apply one rule from ATS keywords without lying: a keyword goes on your resume only if you can attach a true story or artifact to it.
- You ran Nessus scans in your lab? "Vulnerability scanning (Nessus, lab environment)" is honest and matches the string.
- You mapped your lab detections to MITRE ATT&CK? Say exactly that.
- You have never touched threat hunting? Leave it off, and put it on your study list instead.
This turns the posting into two outputs: keywords you truly hold (add them) and gaps (close them). Both make you stronger. Only one of them belongs on the page today.
Phrasing that keeps lab work honest
The single most common padding move in security resumes is promoting a lab to a job. Some honest swaps:
- Not "Security Analyst, self-employed." Instead: a "Security Lab Projects" section with dated entries.
- Not "monitored enterprise networks." Instead: "monitored a 6-VM home lab network."
- Not "incident response experience." Instead: "performed incident response exercises in a lab, including memory capture and timeline reconstruction on a compromised VM."
The strange thing is that the honest version reads better to a SOC lead. It shows initiative, precision, and the exact trait the job requires: reporting what actually happened, not what sounds impressive. An analyst who inflates a resume is an analyst who might inflate an incident report, and every security manager knows it.
Check what the filter sees before you apply
You now have the hierarchy: earned certs first, real work second, labeled labs third, and nothing you cannot defend. The last step is verifying the machine can read it all.
Run your resume through the free Beat the Bots scan at careerbounce.io against a real SOC analyst posting. You will see exactly which security keywords the parser extracts from your file, which acronyms made it through, and which terms from the posting are missing. It runs on your device and nothing is uploaded, which you can appreciate more than most applicants.
Then treat the results honestly, the way you would treat scan results at work: fix true findings (terms you hold but forgot to write), and put the rest on your study list. Nobody can promise you an interview in this market. But a resume where the filters find real certs and the humans find real investigations is the strongest position an honest candidate can hold.