Security operations engineer with 8 years in SOC and detection engineering for e-commerce and SaaS environments. Automated 70% of tier-1 alert triage with SOAR playbooks, freeing analysts for real investigations. Brings SIEM engineering, detection content development and incident handling across cloud and endpoint.
Experience
Security Operations Engineer, Hollowbrook Marketplace (Salt Lake City, UT)
Mar 2022 – Present
Built 45 Tines playbooks that auto-triage 70% of tier-1 alerts, cutting median response time from 3 hours to 12 minutes
Migrated detections from a legacy SIEM to Splunk Enterprise Security, mapping 160 rules to MITRE ATT&CK
Deployed CrowdStrike Falcon to 4,200 endpoints and wrote custom IOAs for credential theft techniques
Led response for 9 high-severity incidents, including containment of a compromised contractor account within 25 minutes
SOC Analyst II, Wasatch Software (Lehi, UT)
Nov 2019 – Feb 2022
Investigated 40 alerts per shift across EDR, email and AWS telemetry
Wrote Sigma rules for suspicious OAuth grants, detecting 3 malicious app consents
NOC Technician, Granite State Hosting (Provo, UT)
Jun 2018 – Oct 2019
Monitored network and server health for 300 hosting customers on a 24/7 rotation
B.S. Information Systems, Utah State University (Aug 2014 – May 2018)
Skills
SIEM and SOAR: Splunk ES, Microsoft Sentinel, Tines, Cortex XSOAR
Endpoint and Cloud: CrowdStrike Falcon, AWS GuardDuty, Okta logs
Detection: Sigma, KQL, SPL, MITRE ATT&CK, YARA
Scripting: Python, PowerShell
How to write a Security Operations Engineer resume
A strong Security Operations Engineer resume shows the systems you built, the scale they run at, and the measurable effect on speed, reliability or cost. Put your most relevant recent role first and make every bullet show a result, not a duty.
Sections, in order
Summary
Experience
Projects
Skills
Education
Length: One page for most candidates; move to two only if every line is relevant.
Summary: Write two or three lines: your role, your strongest skills, and one result that proves them.
Skills to feature
Programming languages
System design
Cloud platforms (AWS, GCP, Azure)
CI/CD
Testing and code review
Databases and SQL
Observability
Security fundamentals
APIs and integrations
Technical documentation
Example bullet points
Rebuilt the checkout service in Go, cutting p95 latency from 900 ms to 180 ms for 2M monthly users
Introduced contract tests and staged rollouts, reducing production incidents by 45% in two quarters
Migrated 30 services to Kubernetes with Terraform, lowering cloud spend by $250k a year
Tips from recruiters
Group skills by category (for example "Languages: Go, TypeScript") so recruiters and ATS parsers find them quickly.
Link to a repository, demo or write-up for at least one project you can talk about in depth.
Name the stack inside each bullet; keyword matching happens at the bullet level, not only in the skills list.
Recommended templates
Classic (ATS-friendly): Jake's-style LaTeX classic: small caps and hairline rules
Tech (ATS-friendly): Developer style: mono headings and tags, sans body
Modern (ATS-friendly): Clean single column with accent headings and rules
Security Operations Engineer resume FAQ
What should a Security Operations Engineer resume include?
A Security Operations Engineer resume should show the systems you built, the scale they run at, and the measurable effect on speed, reliability or cost. Use these sections in this order: Summary, Experience, Projects, Skills and Education. Put your most relevant recent role first and make every bullet show a result, not a duty.
What is the best resume template for a Security Operations Engineer?
Classic, Tech and Modern work well for Security Operations Engineer roles. They are single-column with standard headings, so applicant tracking systems (ATS) parse them reliably.
How long should a Security Operations Engineer resume be?
One page for most candidates; move to two only if every line is relevant.
Which skills should a Security Operations Engineer put on a resume?
Prioritize the skills named in the job posting. Common ones for Security Operations Engineer roles are Programming languages, System design, Cloud platforms (AWS, GCP, Azure), CI/CD, Testing and code review and Databases and SQL.
How do I write strong Security Operations Engineer resume bullet points?
Start with an action verb, say what you did, and end with a measurable result such as latency, uptime and deploy frequency. For example: "Rebuilt the checkout service in Go, cutting p95 latency from 900 ms to 180 ms for 2M monthly users."