Writing a CV for the UK Cybersecurity Job Market

If you studied outside the UK, the CV you used back home probably won't work here. UK recruiters spend seconds on a first pass, and in cybersecurity many applications go through an applicant tracking system (ATS) before a human ever sees them. The good news: the UK format is simple, and once you know the rules, you can fix most CVs in an afternoon.

Table

The format rules that surprise international applicants

  • Two pages maximum. One page is fine for a graduate. Three is too long.
  • No photo, date of birth, marital status or nationality. UK employers are discouraged from using these, and including them can look out of touch. Your visa status is stated in your application or interview, not as a CV header.
  • A CV is not a résumé and not a long academic CV. Outside academia, "CV" in the UK means a tight, tailored two-page document.
  • Plain formatting. Single column, standard fonts, standard headings (Profile, Experience, Education, Skills). Tables, text boxes and graphics often break ATS parsing.

A structure that works for cybersecurity

  1. Profile (3–4 lines). Who you are, what you're targeting, and your strongest proof. For example: an MSc Cyber Security graduate with hands-on SOC lab experience, targeting a junior SOC analyst role.
  2. Skills. Group them: tools (Splunk, Wireshark, Nmap, Burp Suite), concepts (incident response, vulnerability management, MITRE ATT&CK), and languages (Python, Bash, SQL). Only list what you could discuss in an interview.
  3. Projects and labs. For graduates this often beats work experience. Describe what you built or investigated, the tools used, and the outcome. Home labs, CTF rankings (TryHackMe, Hack The Box) and dissertation work all count.
  4. Experience. Reverse chronological, with bullet points that start with a verb and show impact. Non-security jobs are fine: customer service and retail show reliability, communication and working under pressure.
  5. Education and certifications. Degree, university and classification, plus any certifications such as Security+.

Writing bullets that get shortlisted

Weak: "Responsible for monitoring security alerts." Stronger: "Triaged 40+ simulated SIEM alerts per session in a Splunk lab, escalating confirmed incidents with a written timeline." Numbers, tools and outcomes turn a duty into evidence. If you can't measure something exactly, be honest and approximate rather than inventing figures an interviewer can probe.

Getting past the ATS

  • Mirror the wording of the job advert where it's true for you: if it says "incident response" and you wrote "security event handling", use their term.
  • Save and upload as PDF unless the employer asks for Word.
  • Use a normal file name such as Firstname-Lastname-CV.pdf.
  • Avoid headers and footers for contact details, as some systems skip them.

What about your visa?

Don't leave employers guessing. A short, factual line in your application form or covering note, such as "I hold Graduate Route permission to work until [date]", answers the question they'll otherwise worry about. For how sponsorship works after that, see our guide on whether UK cybersecurity employers sponsor international graduates.

Before you send it

Read it aloud, ask a UK-based friend or your university careers service to review it (most offer free CV checks to current students and recent graduates), and tailor the profile and skills for every application. A tailored CV sent to ten roles beats a generic CV sent to a hundred.

Go up