Cybersecurity resume builder
A cybersecurity resume is judged on whether its certifications, frameworks, and tooling match the words one specific req uses, because security postings are unusually literal: they ask for Splunk, or MITRE ATT&CK, or SOC 2, by name. Folio drafts the resume, then compares it against the job description you paste and returns a 0 to 100 match score with a ranked list of the terms that posting leans on and your draft never says. It also grades the document 0 to 100 on 7 weighted ATS criteria, and the PDF and DOCX come down free on every plan, Free included.
Build the security resume, then find out what the posting asked for and you left out.
Nothing is held back at the download button: every layout, the ATS score, the keyword gap, and an unwatermarked PDF or DOCX. Free stops short in three other places. Custom domains are zero, so the site keeps our subdomain and our badge, and the drafting AI runs ten times a month.
What to put on a cybersecurity resume
Security resumes fail in a specific way. They read like an inventory: six certifications, nineteen tools, four frameworks, and not one line saying what you caught, contained, hardened, or proved.
Summary
A cybersecurity resume summary should say which side of the house you work on. Blue team, red team, GRC, cloud security, application security, identity. Then the environment you defend, the stack you defend it with, and one incident or audit whose outcome you would be happy to be asked about.
Certs
Security+, CySA+, CISSP, CISM, OSCP, CEH, GSEC, GIAC tracks, AZ-500, the AWS Security specialty, the Google Cybersecurity Certificate. Put them in a labelled block with the issuing body and the date so a parser lifts them cleanly. A cert in a paragraph is a cert a machine can miss.
Keywords
SIEM, EDR, SOAR, MITRE ATT&CK, NIST CSF, ISO 27001, CIS Controls, vulnerability management, threat hunting, incident response, IAM, least privilege, phishing triage. A generic list will not tell you which of these matter tonight. The posting will, and Folio reads it for you.
Evidence
Monitoring a SIEM is a job description. Cutting a detection rule set down until the false positives stopped burying the real alerts is an outcome. Folio structures every bullet as situation, action, result, so the alert you triaged ends on the thing that changed, not on the console you had open.
Projects
A lab, a CTF, a detection you wrote, a report from a scoped test on a target you were allowed to touch. Give it the scope, the method, the finding, and the fix you recommended. Host the write-up on your Folio site and link it, so the resume stays short and the proof stays one click away.
ATS
Folio grades the document 0 to 100 across 7 weighted criteria: structure at 30, headings at 18, selectable text at 16, contact details at 12, length at 10, contrast at 8, risky elements at 6. The ATS-friendly badge appears at 90 and above.
How the keyword gap works
Every other page on this search answers "cybersecurity resume keywords" with a list somebody wrote once, for nobody in particular. Folio answers it with the posting in front of you.
01
An old resume, notes from your last two roles, the text of a profile you copied out by hand. Folio reads it and drafts a structured security resume with roles, certifications, and skills already in the right blocks.
02
The whole thing, as posted. Folio ranks the req by salience, which is how a term the posting hammers on outranks one it mentions in passing, and holds that ranking against your draft.
03
You get a 0 to 100 match score, blending how much of the req you cover at 60 percent with topical similarity at 40 percent, plus up to 18 missing terms ordered by how much the posting cares. The analysis is deterministic and runs in the request, with nothing shipped to an outside service.
04
Folio points each missing term at the section that should absorb it: an outcome if you can prove it, the skills block if it is genuinely yours, the summary if a reader should see it in the first six seconds. Never claim a tool you have not run. Then check the ATS score and download the PDF or DOCX, free, as often as an edit demands.
Entry level and no experience
An entry level cybersecurity resume is the same document as a senior one with the sections reordered. Certifications and projects move above employment, and employment stays on the page because the help desk, the NOC, the sysadmin shift, and the military tour are where you learned the network you now want to defend. Pull the security work out of those jobs and name it: the accounts you deprovisioned, the patch cycle you ran, the phishing report you escalated, the MFA rollout nobody thanked you for.
Treat a certificate as a receipt and an artifact as evidence. The Google Cybersecurity Certificate, Security+, and the free training platforms all belong on the page, listed with the issuer and the year, but a certification line on its own says only that you sat the exam. Pair it with something you built afterwards. A home lab with a domain controller, a SIEM ingesting your own logs, and three detections you wrote and then tried to evade. A vulnerability report from a scoped engagement, written the way a real one is written, with severity, reproduction, and remediation. One artifact described properly beats a stack of badges.
Watch the boundary while you do it. Say what you were authorised to touch, keep client names and live findings off a public page, and never put anything on a resume you could not defend to a security team in an interview, because they will ask. If you want the long version of this, /blog/resume-with-no-experience walks the reordering step by step, and /portfolio-website-for-students is where the lab write-ups can live once the resume is done.
Where the money sits
Two products claim this search. One writes the resume and charges you to take it away. The other hands you a list of security terms that was never about your job.
| Capability | Folio | Zety | Enhancv | Kickresume | A keywords listicle |
|---|---|---|---|---|---|
| PDF and DOCX export | Free on every plan, no watermark | A paid plan is required to download | Downloading is a paid feature | Full export sits behind a paid plan | Nothing to export |
| Security keywords, chosen how | Ranked by salience from the req you paste | A generic list inside the editor | A generic list inside the editor | Phrase suggestions by job title | One static list, written for nobody |
| Match score against a specific posting | 0 to 100, deterministic, on every plan | A separate scanning product | Part of a paid tier | Not part of the builder | Not offered |
| Resume layouts open on the free plan | All of them. lib/resume has no plan gate | Build free, pay to keep the file | A subset is free | A subset is free | Not offered |
| Somewhere to publish the lab write-up | A portfolio and blog at portfolio.wrxstack.com/yourname | Not offered | Not offered | A single web page | Not offered |
| A domain name of your own | Pro only. Free gives you 0 custom domains | Not offered | Not offered | Not offered | Not applicable |
The competitor cells describe published tier behavior, and any vendor can change that whenever it likes, so read their pricing page before you commit. The Folio cells you can check yourself on a free account in about five minutes.
Numbers we can stand behind
You will not find a rejection-rate figure or a hiring statistic anywhere on this page. We have no source for one, so we are not going to print one. Here is what the software measures.
7
weighted ATS criteria
structure alone carries 30 of the 100
18
missing req terms surfaced, ranked
ordered by how hard the posting leans on each
90
score that earns the ATS-friendly badge
shown to you before you export
$0
to download the finished resume
PDF and DOCX, unwatermarked, on Free
The limits, before you sign up
Free is not a trial, and the export is not where the catch is hiding. It is also not unlimited, so here are the edges. Zero custom domains: the site publishes at portfolio.wrxstack.com/yourname, not at a name you own, and it carries a Made with Folio badge. AI drafting stops at 10 generations a month. Media storage stops at 512 MB. The portfolio design gallery is limited to the core themes. Pro clears those at Rs 599 or $9 a month, and Team is Rs 1,999 or $24.
None of it touches the resume. Every layout is open, the ATS score runs, the keyword gap runs, and the PDF and DOCX download clean however many times you revise. The gate is on the website polish, not on the file you need to attach to a SOC analyst application tonight. We would rather you read that here than find it at the download button at midnight.
FAQ
One column, no tables, no sidebars, no icons standing in for words, and no contact details trapped in a header image a parser will skip. Give certifications their own labelled section, group the tooling by function rather than running it into one comma soup, and let each role end on an outcome instead of a duty. Two pages are acceptable once you have real incidents to describe, and one page is better if you do not. Folio ships layouts where those constraints already hold, so the format is settled before you type.
The ones in the posting you are answering, spelled the way it spells them. If the req says SIEM, do not only say Splunk, and if it says Splunk, do not only say SIEM. Expect it to name a framework such as NIST CSF, ISO 27001, or MITRE ATT&CK, a control area such as vulnerability management, identity, or incident response, and a product line it already owns. Rather than copying a list from an article, paste the req into Folio and read back the terms it leans on that your draft never uses, ordered by how much weight they carry.
Only skills you could be interrogated on, grouped so both a human and a parser can scan them. Detection and response: SIEM, EDR, log analysis, triage, containment, forensics. Offensive work: Burp Suite, Nmap, Metasploit, scoped testing, reporting. Governance: risk assessment, policy, audit evidence, SOC 2, PCI DSS, HIPAA. Foundations: networking, operating systems, cloud IAM, scripting in Python or PowerShell. Drop the rated proficiency bars. Nobody has ever verified one.
Four lines and no adjective you cannot back. Line one places you: the role, the years, the side of the house. Line two names the environment you protect, including its size and its regulatory shape if that is part of the job. Line three names your strongest capability, the thing you would want to be handed on day one. Line four is the single outcome you want a stranger to remember, phrased as a result rather than a responsibility. Cut every instance of passionate and detail-oriented on the way out.
Reorder the page rather than padding it. Certifications and projects go above employment, and the non-security jobs stay, because a help desk queue, a NOC rotation, or a service tour taught you the network and the users you now want to protect. Name the security-shaped work you already did there: the offboarding you ran, the patches you pushed, the suspicious mail you escalated. Then let one well-documented lab or one properly written vulnerability report do the arguing, because it shows judgment that a title cannot claim yet.
Certifications belong in their own block with the issuing body and the year, whether it is the Google Cybersecurity Certificate, Security+, or an OSCP, so a parser lifts the credential without guessing. Projects belong in a projects block with the scope, the method, the finding, and the remediation you recommended, written like the deliverable it would have been at work. Keep live findings and client names off a public page. Publish the long version on your Folio portfolio and put the link in the entry, so the resume stays tight and a reviewer can still open the proof.
No, and it is better to say that here than to let you discover it. The ATS grade is computed from the layout, theme, and content model Folio itself renders, which is precisely why it can be deterministic and never leaves the request. Feeding it a document that some other tool produced is outside what the scorer accepts. The design goes the other way round: you write inside templates where the parsing rules cannot be broken, and the grade appears while you can still act on it.
Keep going