Cybersecurity analyst requirements, with the quote you would need

Security postings are full of product names. Evidence is a queue you watched, a control you operated, or an incident you documented. A homelab is a homelab. Say so.

Examples on this page are fictional composites, not customers and not testimonials.

Often required

The function
SOC, GRC, identity, or appsec. Use your function.
A tool you used in that function
A SIEM, a scanner, or a ticket system, by the name on your resume.
A task
Triage, access reviews, phishing reports, or a policy mapping.
A handoff
Who you escalated to, if written.
A credential only if listed
Security+ or others. Do not add “in progress” unless it is true and you add it yourself.

Often preferred, and easy to fake

An incident write-up
A control you improved
Scripting you used on the job

What a citation looks like

Alert triage

“Triaged endpoint alerts in the afternoon queue and escalated malware detentions to the IR lead.”

Queue and escalation are clear. The product name is absent, so no product is inserted.

Cloud security posture

“No sentence.”

Endpoint alerts are not a cloud CSPM program.

The gap people paper over

Zero trust, SOC2 ownership, and pen-test leadership are senior claims. Do not inherit them from a company blog.

Questions

Does IT help desk transfer?

Quote password resets and access tickets for what they were. Detection engineering is likely a gap.

Can I list tryhackme or a lab?

Yes, as a lab. Do not place it under an employer’s incident history.

Check your resume against a real posting