The two weakest words on your CV

I have read several hundred CVs from people trying to move into security. The gap between the strongest and the weakest is rarely a gap in experience. It is a gap in how the same experience has been written down.

Consider two lines describing an identical job.

Responsible for user account administration.

Ran the joiner-mover-leaver process for 400 users; reduced orphaned accounts from 60 to zero over six months.

Same person. Same four years. The first says what you were given. The second says what changed because you were there, and gives me two numbers I can ask you about — which means it is falsifiable, which is precisely why it carries weight. Nobody invents a figure they cannot defend for twenty minutes.

‘Assisted with’ is the worst offender because it is doing something specific: it is hedging. It protects you from the accusation that you claimed more than you did. But every reader understands the hedge, and what they take from it is that you were adjacent to the work rather than responsible for any of it.

The fix is not to inflate. It is to find the smallest thing you genuinely owned and describe that instead. You triaged the phishing reports? Say so, say how many a month, and say whether you wrote down the steps afterwards. That is security work. Name it as security work.

The same applies to the phrase career changers reach for most: ‘good knowledge of’. Good knowledge of SIEM tools. It is unfalsifiable and every reader knows it. ‘Built and tuned detections in Security Onion in a home lab, six write-ups on GitHub’ can be checked in thirty seconds, and that is what makes it worth something.

Reach for verbs that imply ownership — owned, ran, built, reduced, introduced. And if you genuinely cannot find a single thing you owned in four years, that is worth knowing too, because it is the thing to fix before you rewrite anything.