Most Security Engineer resumes never reach human eyes. Workday filters out candidates who don't mention "SIEM" in the first third of the document. Greenhouse flags resumes without compliance frameworks. Lever scans for penetration testing tools by exact name—"pen testing" doesn't count. Your experience might be solid, but if the ATS can't parse it, you're invisible.

What ATS systems do with a Security Engineer resume

Applicant Tracking Systems parse Security Engineer resumes in three passes. First, they extract contact info and section headers—nonstandard headings like "Technical Toolkit" instead of "Skills" confuse the parser. Second, they keyword-match against the job description: if the posting mentions "incident response" twelve times and your resume says "security event management," you lose points. Third, they rank certifications and tools. Workday heavily weights CISSP and OSCP. Greenhouse scans for specific SIEM platforms (Splunk, QRadar, Sentinel). Lever prioritizes cloud security terms—AWS GuardDuty, Azure Defender, GCP Security Command Center. Generic phrases like "strong security background" score zero. The system wants "implemented zero-trust architecture across 12 AWS accounts," not "responsible for security improvements."

ATS-optimized Security Engineer resume — entry-level

Jordan Kim
jordan.kim@email.com | (555) 123-4567 | Seattle, WA | linkedin.com/in/jordankim | github.com/jkim-sec

Summary
Entry-level Security Engineer with hands-on experience in vulnerability assessment, SIEM configuration, and cloud security (AWS). Completed penetration testing capstone project identifying 23 critical vulnerabilities across web applications. Hold Security+ and AWS Certified Security – Specialty certifications. Proficient in Python scripting for security automation, Nessus, Wireshark, and OWASP Top 10 mitigation.

Experience

Security Intern
TechGuard Solutions, Seattle, WA
June 2025 – December 2025

  • Conducted vulnerability scans using Nessus and OpenVAS on 40+ cloud instances, identifying and documenting 67 medium-to-high severity findings for remediation
  • Configured SIEM rules in Splunk to detect brute-force login attempts, reducing false positives by 34% through tuning correlation searches
  • Assisted incident response team during 3 security events, performing log analysis in CloudTrail and GuardDuty to trace unauthorized API calls
  • Developed Python scripts to automate daily security reporting, saving 6 hours per week of manual data aggregation

IT Support Technician
University of Washington IT Department, Seattle, WA
September 2023 – May 2025

  • Enforced endpoint security policies across 200+ student lab computers, ensuring antivirus updates and patch compliance met university standards
  • Responded to 15+ phishing incident reports monthly, isolating affected accounts and coordinating password resets with IAM team
  • Deployed multi-factor authentication (MFA) for faculty VPN access, improving authentication security posture

Education

Bachelor of Science in Cybersecurity
University of Washington, Seattle, WA
Graduated May 2025

Certifications
CompTIA Security+ | AWS Certified Security – Specialty

Skills
Vulnerability Assessment (Nessus, OpenVAS) | SIEM (Splunk, ELK Stack) | Penetration Testing (Metasploit, Burp Suite) | Cloud Security (AWS GuardDuty, IAM, Security Groups) | Scripting (Python, Bash) | Incident Response | IDS/IPS (Snort, Suricata) | Network Security | OWASP Top 10 | Compliance (NIST CSF) | Linux/Windows Security

ATS-optimized Security Engineer resume — mid-career

Alex Patel
alex.patel@email.com | (555) 234-8901 | Austin, TX | linkedin.com/in/alexpatel-sec

Summary
Security Engineer with 5 years of experience securing cloud infrastructure, leading incident response, and implementing zero-trust architecture for SaaS platforms. Reduced mean time to detect (MTTD) security incidents by 42% through SIEM optimization and threat hunting automation. Hold CISSP and OSCP certifications. Expert in AWS/Azure security, penetration testing, and SOC 2 compliance.

Experience

Security Engineer
DataFlow Inc., Austin, TX
March 2023 – Present

  • Architected zero-trust network segmentation for multi-tenant SaaS platform serving 80,000 users, reducing lateral movement risk by implementing micro-segmentation and identity-based access controls
  • Led penetration testing initiatives across 6 web applications quarterly, identifying and remediating average of 14 high-severity vulnerabilities per cycle before production release
  • Managed SIEM (Splunk Enterprise Security) ingesting 2TB daily logs, creating 35+ custom correlation rules to detect ransomware, privilege escalation, and data exfiltration patterns
  • Responded to 28 security incidents in 2025, performing forensic analysis, root cause identification, and post-incident reporting for executive stakeholders
  • Implemented AWS Security Hub and GuardDuty across 45 accounts, automating threat detection and compliance monitoring aligned with CIS benchmarks
  • Reduced false-positive alert volume by 61% through machine learning-based anomaly detection tuning in Splunk UBA

Junior Security Engineer
SecureNet Systems, Dallas, TX
June 2020 – February 2023

  • Conducted vulnerability assessments using Qualys and Rapid7 InsightVM on 300+ endpoints and 50+ cloud instances monthly
  • Developed incident response playbooks for phishing, malware, and insider threats, decreasing average response time from 4 hours to 90 minutes
  • Configured and maintained IDS/IPS (Snort, Palo Alto Networks) protecting corporate network perimeter and internal segments
  • Achieved SOC 2 Type II compliance by implementing 47 security controls, documenting policies, and coordinating auditor evidence requests

Education

Bachelor of Science in Computer Science
University of Texas at Austin, Austin, TX
Graduated May 2020

Certifications
CISSP | OSCP | AWS Certified Security – Specialty | CEH

Skills
Cloud Security (AWS, Azure) | Zero-Trust Architecture | SIEM (Splunk, Sentinel, QRadar) | Penetration Testing (Metasploit, Cobalt Strike, Burp Suite) | Incident Response | Threat Hunting | Vulnerability Management (Qualys, Rapid7, Nessus) | IAM & PAM | IDS/IPS | Security Automation (Python, Terraform) | Compliance (SOC 2, ISO 27001, NIST 800-53) | Forensics (EnCase, FTK)

ATS-optimized Security Engineer resume — senior

Morgan Chen
morgan.chen@email.com | (555) 345-6789 | San Francisco, CA | linkedin.com/in/morganchen-security

Summary
Senior Security Engineer with 10+ years of experience building enterprise security programs, leading red team operations, and driving cloud security strategy for Fortune 500 companies. Designed security architecture protecting $2B+ annual revenue SaaS platform. Reduced security incidents by 73% year-over-year through proactive threat modeling and defense-in-depth controls. Hold CISSP, OSCP, GIAC GPEN, and AWS Security Specialty certifications. Expert in zero-trust, DevSecOps, and compliance automation.

Experience

Senior Security Engineer
CloudScale Technologies, San Francisco, CA
January 2021 – Present

  • Architected enterprise security framework for multi-cloud infrastructure (AWS, Azure, GCP) supporting 2.5M daily active users, implementing zero-trust principles, microsegmentation, and policy-as-code enforcement
  • Led red team operations conducting 12 full-scope penetration tests annually, simulating APT tactics to identify gaps in detection and response capabilities; remediated 94% of critical findings within SLA
  • Designed and deployed cloud-native SIEM solution (Azure Sentinel) processing 8TB logs daily, integrating threat intelligence feeds and automating incident triage through SOAR playbooks—reduced MTTD from 6 hours to 23 minutes
  • Established DevSecOps pipeline integrating SAST (SonarQube), DAST (OWASP ZAP), and container scanning (Trivy, Aqua Security) into CI/CD, blocking 340+ high-severity vulnerabilities pre-production in 2025
  • Spearheaded SOC 2 Type II, ISO 27001, and FedRAMP Moderate authorizations, achieving all certifications within 18-month timeline through automated compliance monitoring and evidence collection
  • Managed incident response for 3 major security events including ransomware attempt and credential compromise, coordinating cross-functional teams and external forensics partners; zero data loss achieved
  • Mentored team of 6 security engineers, conducting threat modeling workshops and establishing security champions program across 14 engineering teams

Security Engineer
SecureBank Financial, New York, NY
May 2016 – December 2020

  • Implemented identity and access management (IAM) overhaul using Okta and AWS IAM, enforcing least-privilege access for 4,200 employees and reducing privilege escalation risk by 68%
  • Conducted quarterly penetration tests on banking applications handling $12B transactions annually, identifying and patching vulnerabilities in authentication, session management, and API security
  • Deployed Splunk Enterprise Security SIEM replacing legacy system, creating 120+ correlation searches detecting insider threats, account compromise, and fraud patterns
  • Led PCI DSS v3.2 compliance initiative across payment processing infrastructure, achieving certification within regulatory deadline through gap analysis and remediation coordination

Security Analyst
Vertex Systems, Boston, MA
June 2014 – April 2016

  • Performed vulnerability assessments and patch management for 800+ servers and endpoints using Nessus and SCCM
  • Responded to security incidents including malware infections, phishing campaigns, and policy violations; average resolution time 2.5 hours
  • Configured IDS/IPS (Snort) and network monitoring tools to detect anomalous traffic patterns and command-and-control communications

Education

Master of Science in Cybersecurity
Carnegie Mellon University, Pittsburgh, PA
Graduated May 2014

Bachelor of Science in Information Technology
Boston University, Boston, MA
Graduated May 2012

Certifications
CISSP | OSCP | GIAC GPEN | AWS Certified Security – Specialty | CCSP | CEH

Skills
Cloud Security Architecture (AWS, Azure, GCP) | Zero-Trust Implementation | Red Team Operations | Penetration Testing (Metasploit, Cobalt Strike, Burp Suite, BloodHound) | SIEM (Splunk, Sentinel, Chronicle) | SOAR & Security Automation | Threat Modeling | DevSecOps | IAM & PAM (Okta, CyberArk) | Incident Response & Forensics | Compliance (SOC 2, ISO 27001, FedRAMP, PCI DSS, NIST 800-53) | Container Security (Kubernetes, Docker) | Security Architecture | Threat Intelligence | Risk Management

Keywords to mirror from Security Engineer job descriptions

  • SIEM platforms — Use exact names: Splunk, QRadar, Azure Sentinel, Chronicle, LogRhythm. Don't abbreviate or generalize.
  • Penetration testing tools — Metasploit, Burp Suite, Cobalt Strike, Kali Linux, OWASP ZAP. List the tools you've actually used.
  • Cloud security services — AWS GuardDuty, Security Hub, IAM, KMS; Azure Defender, Sentinel, Key Vault; GCP Security Command Center.
  • Compliance frameworks — SOC 2 Type II, ISO 27001, NIST 800-53, PCI DSS, FedRAMP, HIPAA. Match the exact phrasing from the posting.
  • Certifications — CISSP, OSCP, CEH, GIAC (GPEN, GCIH), Security+, AWS/Azure security certs. ATS weights these heavily.
  • Incident response — Pair with metrics: "responded to X incidents," "reduced MTTD by Y%," "performed forensic analysis."
  • Vulnerability assessment — Name the scanners: Nessus, Qualys, Rapid7, OpenVAS, Tenable.io.
  • Zero-trust architecture — Include implementation details: microsegmentation, identity-based access, least privilege.
  • IDS/IPS — Snort, Suricata, Palo Alto Networks, Cisco Firepower. Specify deployment context (network perimeter, cloud).
  • Scripting for automation — Python, Bash, PowerShell. Mention what you automated (reporting, threat detection, compliance checks).

Action verbs for Security Engineer

  • Achieved — "Achieved SOC 2 Type II certification within 14-month timeline" shows completion of high-stakes compliance projects.
  • Implemented — Perfect for infrastructure work: "Implemented zero-trust network segmentation across AWS environment."
  • Conducted — Use for assessments and testing: "Conducted penetration tests identifying 23 critical vulnerabilities."
  • Reduced — Pair with metrics: "Reduced false-positive alerts by 61% through SIEM tuning."
  • Developed — For scripts, playbooks, policies: "Developed incident response playbooks reducing MTTR by 40%."
  • Managed — Appropriate for SIEM, incident response, or team leadership: "Managed SIEM ingesting 2TB daily logs."

ATS pitfalls specific to Security Engineer

Tables and text boxes break parsers. Many Security Engineers put certifications or skills in tables for visual appeal. Workday and Greenhouse can't parse tables reliably—your CISSP ends up as garbled text. Use simple headings and bullet points instead.

Acronym overload without expansion. Writing "IAM, PAM, SIEM, SOAR, EDR" assumes the ATS knows what you mean. Spell out on first use: "Identity and Access Management (IAM)" or "Security Information and Event Management (SIEM)." Some systems don't match the acronym to the full phrase.

Generic "security tools" instead of product names. ATS scans for "Splunk," "Palo Alto Networks," "CrowdStrike Falcon"—not "industry-leading SIEM platform" or "advanced endpoint protection." If the job description mentions a specific tool and you've used it, name it exactly. You can read more about tailoring your [experience