RMFInsider

A cybersecurity resume with no experience is built from four things you do have: certifications placed where the recruiter sees them in the first five seconds, a projects section written like a job so it reads as experience, your prior work translated into the security tasks it actually contained, and a clean, single-column format that survives the applicant tracking system. Get those four right and “no experience” becomes “no security job title yet,” which is a different problem and a much smaller one. The template is at the bottom; the rest of this post explains what goes in each section and why.

I review evidence for a living as a DoD ISSO, and a resume is evidence. The ones that get read are specific, dated, and honest about scope. The ones that get filtered are vague, padded, and full of skills the candidate cannot demonstrate. Write the first kind.

The order of sections, and why it matters

For a candidate with no security job history, the section order is not the default one. Put the sections in the order that front-loads your strongest evidence:

• Header with name, location, contact, LinkedIn, and a portfolio link. Add citizenship and clearance eligibility only when applying to federal or DoD roles.
• A two-to-three-line summary that names the certification, the target role, and one transferable strength.
• Certifications, before skills and before experience. This is the section a recruiter scans for the DoD 8140 baseline or the “Security+ required” line, and it should not be buried at the bottom.
• Technical skills, grouped, honest, and short.
• Security projects, formatted exactly like jobs, with dates and outcomes.
• Professional experience, translated.
• Education last, unless you graduated in the past year with a relevant degree, in which case move it above experience.

The wry truth about ordering: a recruiter spends about as long on your resume as it takes an eMASS page to load, and that is not a compliment to either. Whatever is in the top third is the resume. Make it the certification and the projects.

Translate your prior work into security language

Every job contains security work; the bullet just never called it that. Your task is to find it and name it accurately, without inflating it. The test for each translated bullet is simple: could you defend it in an interview, in detail, for two minutes? If yes, it goes in. If you would be sweating, cut it.

If you came from IT or help desk

• “Reset passwords and unlocked accounts” becomes “Managed account lifecycle and access requests for roughly 400 users, including verification of offboarding and removal of stale accounts.”
• “Removed viruses from computers” becomes “Performed malware triage and remediation on endpoints, documenting indicators and escalating confirmed incidents to the security team.”
• “Installed updates” becomes “Deployed operating system and application patches across roughly 250 endpoints and tracked exceptions for systems that could not be updated.”
• “Answered tickets” becomes “Resolved 40 to 60 tickets per week, including phishing reports, suspicious login alerts, and access requests, with written documentation for each.”

If you came from somewhere else entirely

Retail, hospitality, logistics, teaching, the military, healthcare, administration: all of them contain process, compliance, documentation, and handling of sensitive information. Translate those.

• Handling cash, cards, or customer records becomes “Handled sensitive customer and payment data under PCI or HIPAA requirements, with zero compliance findings in six audits or inspections.”
• Running a shift or a team becomes “Supervised 12 staff, including onboarding, access provisioning to point-of-sale systems, and enforcement of data handling procedures.”
• Writing procedures, checklists, or training becomes “Authored and maintained standard operating procedures for inventory receiving, reducing errors by a measurable margin and used for training 20 new hires.”
• Military service becomes a translation project of its own: OPSEC, COMSEC handling, accountability of controlled items, and clearance held are all directly relevant, and the clearance goes in the header.

Notice that every translated bullet includes a number. Numbers signal that the work was real and the scope was known. If you do not have an exact number, use a defensible approximate (“roughly 300 users”) rather than leaving it out.

The projects section is your experience section

This is the section that carries the resume when you have no security job history, so it deserves the same formatting as a job: a title, a date, a location (a repository link), and two or three outcome bullets. Do not label it “Hobbies” or “Personal Interests.” Label it “Security Projects” and treat it as work, because it was.

What to include, per project:

• A descriptive title that names the tool or the domain: “Home SOC Lab with Wazuh SIEM,” “Vulnerability Assessment and Remediation of Windows Server VM,” “NIST 800-53 Control Mapping for Small Business Network.”
• A date range, even if it was two weekends. Dates make it real.
• A bullet with the what and the how: built, scanned, hardened, mapped, using which tools.
• A bullet with the outcome and the judgment: how many detections, from what compliance percentage to what, which findings you accepted as risk and why.
• A link to the writeup. The Wazuh home lab walkthrough produces a project that fits this format exactly, and the writeup is the part interviewers actually open.

Two or three complete projects beat six thin ones. If a project does not have a written deliverable behind the link, finish the writeup before it goes on the resume.

Where certifications go, and how to list them

Certifications go in their own section near the top, listed with the full name, the exam code where it exists, and the month and year earned. “CompTIA Security+ (SY0-701), March 2026” is correct. “Sec+” alone is not, because the ATS may be searching for the full string. A certification in progress can be listed as “expected” plus the month and year if you have a scheduled exam date; do not list a certification you merely intend to study for someday.

For DoD and federal applications, Security+ or the relevant DoD 8140 baseline certification is frequently a hard requirement, and recruiters filter on it before a human reads anything else. Make it visible in the summary, in the certifications section, and, if space permits, in the header line. Redundant is fine. Missing is fatal.

Surviving the applicant tracking system

An ATS is a parser, and parsers are stupid in predictable ways. The rules:

• Single column, no tables, no text boxes, no graphics. Multi-column templates from design sites look good to humans and turn into word salad in a parser.
• Standard section headings. “Experience,” “Education,” “Certifications,” “Skills,” “Projects.” Creative headings (“My Journey”) do not map to the parser’s fields.
• Mirror the posting’s language. If the posting says “vulnerability management” and you wrote “vuln scanning,” change yours. Same for “NIST 800-53,” “RMF,” “SIEM,” and the specific tool names. Do this per application; it takes five minutes.
• Standard file format. A .docx or a PDF generated from a word processor. Not a PDF exported from a design tool, not an image.
• No keyword stuffing. A block of white text or a skills list with forty tools you have never opened gets past the parser and then gets you dismissed by the human who sees it.

What to leave off

• An objective statement. The summary replaces it.
• A photo, your full street address, or your date of birth.
• Every job you have ever had. Ten years back is enough, and unrelated short stints can be summarized in one line.
• “References available upon request.” They know.
• Skills you cannot demonstrate. If “Python” is on the resume, expect to be asked to describe something you wrote in it.
• Certification acronyms without the full name, and expired certifications presented as current.

The template

Copy this structure and replace every bracketed item with your own details. Delete any line that does not apply to you rather than leaving it blank. Keep it to one page if you have under five years of total work history; two pages is acceptable beyond that.

[FULL NAME]
[City, State] | [Phone] | [Email] | linkedin.com/in/[handle] | github.com/[handle]
[US Citizen, eligible for security clearance] (include only if true and only for federal or DoD roles)

SUMMARY
Security+ certified [current role or background] transitioning to [target role]. Hands-on with [tool 1], [tool 2], and [framework] through a documented home lab and [number] portfolio projects. [One sentence of transferable strength, e.g., “Four years of customer-facing troubleshooting and documentation in a 400-user environment.”]

CERTIFICATIONS
CompTIA Security+ (SY0-701), [Month Year]
[Second certification, if held], [Month Year]
[Certification in progress], expected [Month Year]

TECHNICAL SKILLS
Security: [vulnerability scanning tool], [SIEM], Sysmon, STIG Viewer, [EDR or AV console]
Systems and networking: Windows Server, Active Directory, Linux ([distribution]), TCP/IP, [firewall or VPN]
Frameworks: NIST 800-53, NIST CSF, [RMF, CIS Controls, or ISO 27001 as applicable]
Tools: [ticketing system], [scripting language], Microsoft 365, [virtualization platform]

SECURITY PROJECTS
[Project title, e.g., Home SOC Lab with Wazuh SIEM] | [Month Year] | github.com/[handle]/[repo]
Built [what] using [tools] to [purpose]; wrote [number] custom detection rules for [behavior] and documented tuning and false-positive analysis.
[Project title, e.g., Vulnerability Assessment and Remediation] | [Month Year]
Scanned [target] with [scanner], remediated [number] findings including [notable one], and tracked results in a POA&M-style tracker with closure evidence.
[Project title, e.g., STIG Hardening of Windows 11 VM] | [Month Year]
Raised STIG compliance from [X] percent to [Y] percent using SCAP benchmark and manual remediation; documented [number] rules deliberately not applied with justification.

PROFESSIONAL EXPERIENCE
[Job Title], [Employer], [City, State] | [Month Year] to [Present or Month Year]
[Security-translated bullet: what you did, for how many users or systems, with what result]
[Security-translated bullet]
[Bullet showing documentation, process, or ownership]
[Previous Job Title], [Employer], [City, State] | [Month Year] to [Month Year]
[One or two bullets, translated]

EDUCATION
[Degree or program], [Institution], [Year] (or: [Coursework or bootcamp], [Provider], [Year])

Two notes on using it. First, the summary is rewritten for each target role; “transitioning to SOC analyst” and “transitioning to GRC analyst” should produce two different summaries and two slightly different skills sections. Second, if you are applying to federal or DoD positions, the ISSO resume guide covers the specific additions those postings expect, including how to reference RMF, eMASS, and clearance status accurately.

After the resume: the interview it produces

A resume built this way generates a predictable set of interview questions: walk me through this project, tell me about a time you handled a security issue at your old job, what does this tool do. Those are the questions you want, because you have the answers. Rehearse the three-minute version of each project and the two-minute version of each translated bullet before you send a single application. The ISSO interview questions and answers post shows what the DoD version of that conversation sounds like, and the 6-month plan for a cybersecurity job with no experience shows where the resume sits in the overall sequence.

If you want the resume template, the project writeup outlines, and the per-role summary variations in one editable package, along with the study and application schedule that goes with them, that is inside Zero to Hired, built for exactly the candidate this post is written for.