US English


7 Information Technology Programmer/Analyst - Security Incident Response Resume Templates with Example

By Ria · Last Updated On October 15, 2026
Resume example — page 1

This guide shows you how to build an Information Technology Programmer/Analyst - Security Incident Response resume that presents relevant evidence clearly. You will learn how to organize incident response work, skills, and education so reviewers can find key details quickly.

Strong resumes for this role explain how you assess alerts, connect evidence, record findings, and support response steps. Use concise bullets to show the tools and methods you applied, such as Microsoft Sentinel, KQL, Windows event logs, Splunk, Wireshark, and Python, when they match your experience.

The example is presented in 7 resume layouts. Compare the PNG image previews to see how each design arranges the same information, then open an example in the editor to view or customize it.

What Makes a Great Information Technology Programmer/Analyst - Security Incident Response Resume in 2026

A strong resume uses clear sections and brief bullets to show alert triage, evidence review, incident records, and response support. Keep the layout easy to scan and use standard headings that applicant tracking systems can read.

Add role-related terms where they fit your real experience, such as SIEM, Microsoft Sentinel, Splunk, KQL, evidence preservation, incident documentation, containment planning, and remediation coordination. Support each skill with a project or work example when possible.

Note: Resume examples are for educational purposes only. Use only information that accurately reflects your experience and qualifications. References to real organizations do not imply affiliation or endorsement.

#1 Simple One Column Format Resume Example

Simple One Column Format presents the resume body in one vertical column, giving reviewers a direct path through each section.

 
Resume example — page 1   Resume example — page 2

Why This Format Works

  • A single reading path lets reviewers follow education, experience, and project work in sequence.
  • Full-width experience entries give accomplishment bullets room to retain their context.
  • Keeping skills and credentials in the same sequence makes section changes easy to track.

Best For

  • Linear section order
  • Detailed experience descriptions
  • Project work with context
  • Text-first ATS review
  • Multiple resume sections

Resume Keywords

  • security incident response
  • Investigated simulated phishing and account-compromise alerts in Microsoft Sentinel, using KQL to connect sign-in activity, endpoint events, and reported messages into concise incident timelines.
  • Presented a response workflow covering alert triage, evidence preservation, containment recommendations, and lessons learned to faculty and classmates.
  • Collected and correlated authentication, endpoint, and message evidence to assess suspected threats, distinguish verified indicators from leads, and document incident findings for case review.
  • Mapped containment, threat eradication, and remediation coordination steps for a simulated compromised account, documenting status and handoffs in incident records to protect information assets.
  • threat eradication
  • Remediation coordination
  • incident records
  • operational procedures
  • confidentiality, integrity, and availability
  • Threat analysis
  • information assurance
  • bachelor's degree
  • Wrote Python utilities to normalize sample log fields and flag selected indicators, then manually validated results against the exercise evidence before documenting findings.
  • Built a small lab environment to examine Windows event logs and network captures during simulated malware and suspicious-login scenarios, using Wireshark and Splunk for evidence review.
See all keywords
 

#2 Simple Two Column Format Resume Example

Simple Two Column Format divides the resume body into two columns, offering a compact way to organize its sections.

 
Resume example — page 1   Resume example — page 2

Why This Format Works

  • Two body columns let reviewers distinguish supporting sections from the experience sequence.
  • Keeping project and work-history details in separate areas can reduce visual crowding.
  • Education and skills can remain easy to find without interrupting experience bullets.

Best For

  • Parallel section grouping
  • Separate supporting details
  • Readers comparing content areas
  • Compact skills and education
  • Resumes with varied evidence

#3 Plain One Column with Shaded Labels Resume Example

Plain One Column with Shaded Labels keeps the resume body in one column, so readers can follow its sections from top to bottom.

 
Resume example — page 1   Resume example — page 2

Why This Format Works

  • A single vertical sequence gives reviewers a consistent route through education and work history.
  • Full-width project descriptions can keep methods and findings together for review.
  • Skills and credentials can be read as distinct sections within the same flow.

Best For

  • Top-to-bottom review
  • Longer project descriptions
  • Clearly separated resume sections
  • Text-heavy content
  • Traditional reading order
 

#4 One Column Format with Photo Right Resume Example

One Column Format with Photo Right combines a single-column resume body with a photo, pairing a direct section sequence with a visual profile element.

 
Resume example — page 1   Resume example — page 2

Why This Format Works

  • A single body column keeps experience entries in a familiar top-to-bottom order.
  • Project bullets have room to show methods and findings in context.
  • Education, certifications, and skills remain part of one readable sequence.

Best For

  • Photo-inclusive resumes
  • Single-column reading order
  • Detailed project entries
  • Section-by-section review
  • Compact section organization
 

#5 Clean Two Column Sidebar Format Resume Example

Clean Two Column Sidebar Format uses two resume-body columns, which can make separate content groups easier to review.

 
Resume example — page 1   Resume example — page 2

Why This Format Works

  • The paired body areas can separate experience details from supporting resume sections.
  • Separate content areas offer room for education and skills alongside experience.
  • Shorter section blocks can make credentials and education easier to locate.

Best For

  • Two-column reading preference
  • Compact supporting sections
  • Longer experience descriptions
  • Quick credential lookup
  • Multiple content categories
 
 

#6 Two Column Format Resume Example

Two Column Format places resume content in two columns, giving reviewers distinct areas to scan across the page.

 
Resume example — page 1   Resume example — page 2

Why This Format Works

  • Two content columns give experience and supporting sections separate visual areas.
  • Reviewers can scan section groups without reading every detail in one long sequence.
  • Compact skills and education entries can sit alongside longer experience descriptions.

Best For

  • Parallel section review
  • Grouped supporting details
  • Dense technical sections
  • Combined project and work history
  • Readers comparing section groups
 

#7 Photo Header Two Column Format Resume Example

Photo Header Two Column Format combines a photo with two resume-body columns, pairing a visible profile element with grouped content.

 
Resume example — page 1   Resume example — page 2

Why This Format Works

  • Two body columns let reviewers compare section groups while keeping experience details together.
  • Separate content areas help skills and education stand apart from longer work entries.
  • Related experience bullets remain easier to follow when grouped within the same area.

Best For

  • Photo-inclusive applications
  • Two-column resume layouts
  • Parallel section review
  • Compact supporting details
  • Long work-history entries
 
 
 

Why Build Your Information Technology Programmer/Analyst - Security Incident Response Resume with ResumeInMinutes

ResumeInMinutes helps you organize your experience, education, skills, and certifications into a resume that is clear and easy to review. You can compare image previews and open an example in the editor to view or customize it.

  • Multiple resume layouts
  • Clear, ATS-readable sections
  • Role-related keyword guidance
  • Skills and experience organization
  • PNG image previews
  • Resume customization in the editor

Use the format that makes your incident response evidence easiest to follow. Keep your bullets accurate, name the tools you have used, and explain your part in triage, documentation, and response procedures.

 

See Also

 

Frequently Asked Questions

How can I make an Information Technology Programmer/Analyst - Security Incident Response resume ATS-friendly?

Use standard section headings, simple formatting, and terms that match your actual background. For this role, relevant terms may include security alert triage, SIEM, evidence preservation, incident documentation, KQL, and response runbooks.

What is shown in the resume examples?

The page shows one role-specific resume example in different layouts. Compare the PNG previews, then open an example in the editor to view or customize it.

What should this resume include?

Include a focused summary, education, relevant experience or projects, technical skills, and certifications. Use bullets to explain how you reviewed alerts, handled evidence, documented findings, or supported response steps.

Which resume layout works well for a security incident response role?

A simple, clearly organized layout is a good choice. Use easy-to-read headings and keep important skills, tools, and incident response examples in sections where reviewers can find them quickly.

How can I show incident response experience from a lab or project?

Describe the exercise, the evidence you reviewed, the tools you used, and the steps you took. Be clear when a scenario was simulated or supervised, and distinguish verified findings from possible leads.

Should I include a photo on my resume?

Include a photo only if it is customary or expected in your country, region, or field. For U.S. applications, a resume without a photo is generally the safer choice.

ATS Score 100%

How we calculate this score

  • Keywords: 60% of the total. AI extracts keywords from your job description. If you do not provide one, a standard job description for the title matching your resume is used. This is not a match to a specific vacancy.
  • Text-based resume: 20%. The text resume assessed here receives 100 for this part.
  • Resume quality: 20%. We start at 100 and subtract points for issues found by our resume checks, down to a minimum of zero.
  • Keyword coverage = 100 × (confirmed matches + 0.8 × possible matches) ÷ total keywords, rounded and capped at 100. Possible matches still need checking. Saved generation audits use their saved keyword percentage.
  • Final score = 60% of keyword coverage + 20% of the text score + 20% of the quality score, rounded to a whole number. Without keywords, no overall ATS score is available.

What this score means

Our scores are estimates, not employer ratings. They may contain errors and do not guarantee accurate parsing, a ranking, an interview, or a job. Check your document against the employer’s requirements. You are responsible for relying on this score.

Terms and Conditions

Score weights: Keywords 60% · Text based resume 20% · Resume quality 20%

Keywords: 19 matched + 0 possible of 19 (100%) · Resume quality: 100%

Resume quality 100% · Weight 20% · Issues (0)

Details
  • ✓Name present: Zayd Willis
  • ✓Email format: zayd.willis@example.com
  • ✓Phone format: (517) 555-0146
  • ✓Experience 1: Job title: Student Security Analyst, Incident Response Practicum
  • ✓Experience 1: Company name: University Security Operations Lab
  • ✓Experience 1: Work location: East Lansing, MI
  • ✓Experience 1: Employment dates: Jan 2026 - Sep 2026
  • ✓Experience 1: Description or achievements: Present
  • ✓Experience 2: Job title: Cybersecurity Incident Response Capstone
  • ✓Experience 2: Company name: University Project
  • ✓Experience 2: Work location: East Lansing, MI
  • ✓Experience 2: Employment dates: Aug 2025 - Dec 2025
  • ✓Experience 2: Description or achievements: Present
  • ✓Experience 3: Job title: Security Monitoring Course Project
  • ✓Experience 3: Company name: Academic Research
  • ✓Experience 3: Work location: East Lansing, MI
  • ✓Experience 3: Employment dates: Jan 2025 - May 2025
  • ✓Experience 3: Description or achievements: Present
  • ✓No placeholder fields
  • ✓No repeated achievement bullets
  • ✓No empty bullets

No issues found by the current checks.

Text Based Resume 100% · Weight 20%

Parsed text
Zayd Willis
(517) 555-0146
zayd.willis@example.com
zaydwillis
East Lansing, MI 48823
SUMMARY
Early-career information technology programmer/analyst with a 2026 bachelor's degree in cybersecurity and information assurance, focused on security incident response. Investigate simulated phishing, account compromise, malware, and suspicious login activity by connecting endpoint, network, and authentication evidence into clear incident timelines. Use supervised response exercises to assess severity, preserve evidence, document findings, and recommend containment and recovery steps. Build practical experience with SIEM searches, Python log utilities, case records, and response runbooks, then present findings and lessons learned to faculty and peers. Bring a grounded understanding of confidentiality, integrity, and availability to protecting information assets.
EDUCATION
Bachelor of Science in Cybersecurity and Information Assurance
2026
Lakeview State University
Coursework: Networking, systems analysis, programming, security operations
TECHNICAL SKILLS
SIEM Platforms: Microsoft Sentinel, Splunk, Elastic Security
Query Languages: KQL, SPL, SQL
Programming Languages: Python, PowerShell, Bash
Operating Systems: Windows 10, Windows 11, Ubuntu Linux
Network Analysis: Wireshark, tcpdump, Zeek
Endpoint Security: Microsoft Defender for Endpoint, Sysmon, osquery
Log Management: Windows Event Viewer, rsyslog, Fluent Bit
Cloud Platforms: Microsoft Azure, AWS, Google Cloud Platform
Identity Platforms: Microsoft Entra ID, Active Directory, Okta
Data Formats: JSON, XML, CSV
SKILLS
Security incident response
Security alert triage
SIEM analysis
Evidence preservation
Incident documentation
Threat analysis
Containment planning
Remediation coordination
Runbook development
KQL queries
Windows event logs
Network traffic analysis
Python scripting
Escalation procedures
Information assurance
EXPERIENCE
Student Security Analyst, Incident Response Practicum
Jan 2026 - Sep 2026
University Security Operations Lab
East Lansing, MI
Investigated simulated phishing and account-compromise alerts in Microsoft Sentinel, using KQL to connect sign-in activity, endpoint events, and reported messages into concise incident timelines.
Followed supervised response procedures to assess severity, preserve relevant evidence, and recommend containment and recovery actions; recorded decisions and unresolved questions in case notes.
Drafted and tested a short response runbook for credential misuse exercises, clarifying escalation points and evidence checks for student analysts.
Collected and correlated authentication, endpoint, and message evidence to assess suspected threats, distinguish verified indicators from leads, and document incident findings for case review.
Mapped containment, threat eradication, and remediation coordination steps for a simulated compromised account, documenting status and handoffs in incident records to protect information assets.
Cybersecurity Incident Response Capstone
Aug 2025 - Dec 2025
University Project
East Lansing, MI
Built a small lab environment to examine Windows event logs and network captures during simulated malware and suspicious-login scenarios, using Wireshark and Splunk for evidence review.
Wrote Python utilities to normalize sample log fields and flag selected indicators, then manually validated results against the exercise evidence before documenting findings.
Presented a response workflow covering alert triage, evidence preservation, containment recommendations, and lessons learned to faculty and classmates.
Created operational procedures for preserving lab evidence and recording incident timelines, aligning response steps with confidentiality, integrity, and availability objectives.
Security Monitoring Course Project
Jan 2025 - May 2025
Academic Research
East Lansing, MI
Analyzed a curated set of 1,200 simulated authentication and endpoint events to distinguish routine activity from suspicious patterns using spreadsheet review and introductory SIEM searches.
Produced an incident worksheet with timestamps, affected accounts, observed indicators, and escalation rationale, improving consistency across the project team's case reviews.
LEADERSHIP & AWARDS
Received Faculty Recognition for the Cybersecurity Capstone Presentation in 2025 after presenting the incident response workflow and findings.
Earned Dean's List recognition at Lakeview State University in 2024 and 2025.
Served as a peer facilitator for the University Cybersecurity Study Group from 2025 to 2026.
Volunteered during Campus Digital Safety Awareness Week in 2025.
CERTIFICATIONS
Google Cybersecurity Professional Certificate
2025
Microsoft Security, Compliance, and Identity Fundamentals (SC-900)
2025
PROFESSIONAL AFFILIATIONS
Student member, Association for Computing Machinery (ACM).
Student member, Information Systems Security Association (ISSA).

Matched keywords (19)

  • security incident response
  • Investigated simulated phishing and account-compromise alerts in Microsoft Sentinel, using KQL to connect sign-in activity, endpoint events, and reported messages into concise incident timelines.Original keyword in JD: Security alert analysis
  • Presented a response workflow covering alert triage, evidence preservation, containment recommendations, and lessons learned to faculty and classmates.Original keyword in JD: Incident triage
  • Collected and correlated authentication, endpoint, and message evidence to assess suspected threats, distinguish verified indicators from leads, and document incident findings for case review.Original keyword in JD: Evidence collection
  • Collected and correlated authentication, endpoint, and message evidence to assess suspected threats, distinguish verified indicators from leads, and document incident findings for case review.Original keyword in JD: Incident findings documentation
  • Mapped containment, threat eradication, and remediation coordination steps for a simulated compromised account, documenting status and handoffs in incident records to protect information assets.Original keyword in JD: Threat containment
  • threat eradication
  • Remediation coordination
  • incident records
  • operational procedures
  • confidentiality, integrity, and availability
  • Mapped containment, threat eradication, and remediation coordination steps for a simulated compromised account, documenting status and handoffs in incident records to protect information assets.Original keyword in JD: Information asset protection
  • Threat analysis
  • information assuranceOriginal keyword in JD: Computer Science OR Data Processing OR Computer Information Systems OR Data Communications OR Networking OR Systems Analysis OR Computer Programming OR Information Assurance OR IT Project Management OR Mathematics
  • bachelor's degreeOriginal keyword in JD: Associate Degree OR Bachelor's Degree
  • Wrote Python utilities to normalize sample log fields and flag selected indicators, then manually validated results against the exercise evidence before documenting findings.Original keyword in JD: Application programming
  • Built a small lab environment to examine Windows event logs and network captures during simulated malware and suspicious-login scenarios, using Wireshark and Splunk for evidence review.Original keyword in JD: Computer operations
  • Built a small lab environment to examine Windows event logs and network captures during simulated malware and suspicious-login scenarios, using Wireshark and Splunk for evidence review.Original keyword in JD: IT technician support
  • Student Security Analyst, Incident Response PracticumOriginal keyword in JD: Information Technology Student Assistant

Missing keywords (0)

No missing keywords.

Possible matches (0)

No possible matches.

Disclaimer: All names, images, contact information, employment histories, achievements, security clearances, military credentials, and other qualifications shown in this content are fictional and used for illustrative purposes only. Any resemblance to actual persons, living or deceased, is purely coincidental.

Resume and cover-letter examples and recommendations in this article reflect general best practices and professional experience and are provided for guidance only. Results may vary based on role, industry, region, and hiring organization.

Content Accuracy and Verification: To the fullest extent permitted by applicable law, we do not represent or warrant that resume or cover-letter guidance, examples, recommendations, or related information are accurate, complete, current, error-free, or suitable for any particular purpose. You are responsible for independently reviewing and verifying the information before relying on it.

ATS and Cover-Letter Scores: ATS scores are estimates calculated using our own formula, informed by publicly available guidance on resume formatting and keyword matching. They are not scores issued or endorsed by an ATS provider or employer. Cover-letter scores are also our own assessments. Parsing, weighting, screening criteria, and results vary between systems, employers, job descriptions, and document formats. No score guarantees successful parsing, a particular ranking, an interview, or employment. Use scores as general guidance and independently check your documents against the employer’s requirements. To the fullest extent permitted by applicable law, we accept no liability for errors in scores or parsing, or losses arising from reliance on these assessments. Nothing in this notice excludes liability or limits consumer rights that cannot lawfully be excluded or limited.

Terms and Conditions
 
> JP 1 1
PDF Footer and Margins Setup
The margins are applied to the document, and the footer shows up in the preview and the PDF

Footer Font Settings

Are you applying for a specific job
so we can tailor your resume to it?
Are you applying for a specific job
so we can tailor your cover letter to it?
Type your details as text to generate a personalized resume Type your details as text to generate a personalized cover letter
Website link found! Ready to create resume from:
Drag the into the box to verify you're human.
Drop here

My Resumes

Displaying {number_of_files} files (out of {total_of_all_files} total)
Name File Type Last Modified: Description:

Rename File

Filename already exists!

Delete Files

Warning: This action is irreversible. Once you click submit, the files will be permanently deleted.

Heading text
Upload From Computer Upload
Select From Existing
LinkedIn
Drag & Drop files anywhere in this tab, or

Uploaded Files

Delete Name Last Updated Use This File
Select this to use the file for generating your resume and cover letter. Only one source—uploaded file, selected file, or LinkedIn text—can be used.

My Files

Resumes or cover letters you create will appear here. No files available yet.
Delete Name Last Updated Use This File
Select this to use the file for generating your resume and cover letter. Only one source—uploaded file, selected file, or LinkedIn text—can be used.

Add LinkedIn Profile PDF

You can download your LinkedIn profile as a PDF by opening linkedin.com in a web browser, clicking your profile photo, selecting the “More” or “Resources” button, and choosing “Save to PDF.” You can then attach the PDF using the Upload From Computer tab.

Paste Your LinkedIn Profile Text

If you have copied the LinkedIn profile text, paste it below. See how to copy your profile from LinkedIn

Select this to use the LinkedIn profile text for generating your resume and cover letter. Only one source—uploaded file, selected file, or LinkedIn text—can be used.

Try these controls

<
>