Skip to content
JobreachGet started

How to cold email for a cybersecurity job

Security posts list certifications, but the person hiring wants to know whether you can investigate an alert or find a weakness, and whether you can be trusted with what you find. Lead with one piece of hands-on work done with permission, and what you did about it.

Updated

What cybersecurity posts ask for

Security roles come in a few kinds, and the posts ask for different things in each:

  • SOC analyst: watching alerts in a SIEM (Splunk, Microsoft Sentinel, QRadar), telling real from false, and escalating incidents. Often in shifts.
  • Security analyst or engineer: hardening systems, managing access, and cloud security on AWS or Azure.
  • Penetration testing, often called VAPT in India: testing web apps and networks with tools such as Burp Suite and Nmap, and writing the report.
  • GRC: risk assessments and audits against standards such as ISO 27001 or SOC 2 and, in India, CERT-In’s directions and the DPDP Act.
  • In all of them, networking and operating system basics: TCP/IP, DNS, Linux and Windows, Active Directory.
  • Certifications, often named for the level: CompTIA Security+ or CEH for entry roles, OSCP for pen testing, ISO 27001 lead auditor for GRC.
  • Clear writing. Every security role ends in a report someone else acts on.

Your proof as a fresher

As a fresher, show hands-on work that was legal and written up:

  • Practice platforms such as TryHackMe or Hack The Box: the paths you finished, and a write-up of a machine whose write-ups are allowed (retired ones, on Hack The Box).
  • A home lab: a SIEM collecting logs from a few virtual machines, the detection rules you wrote, and an attack you ran against it.
  • A valid bug bounty report or a responsibly disclosed finding, mentioned only as far as the programme allows.
  • Capture the flag competitions: your team’s place and the challenges you solved.
  • An internship with a SOC or a VAPT team: what you handled, without the client’s details.

Never test a system you don’t have permission to test, and never name a company’s weakness in public. Showing that you respect those lines is part of the proof.

Your proof if you are switching in

Coming from IT support, networking, system administration, development or audit? Security is often the next step. Lead with the security work already in your job:

  • From IT support or system administration: the access you manage, patching, endpoint protection, the phishing reports you handled, a hardening checklist you applied.
  • From networking: firewall rules, VPNs, network segments, and the logs you read when something looked wrong.
  • From development: security bugs you fixed, code you reviewed for security, a dependency scanner you added to the pipeline.
  • From audit, compliance or risk in another field: controls and evidence are the same work, which suits GRC roles.

Add one hands-on project in the area the post names, on a lab or a practice platform, so the switch has something to show.

Your proof in two sentences

Sentence one: what you investigated, tested or protected, with which tools. Sentence two: what you found, and what changed because of it.

Fresher

I built a home lab with Wazuh collecting logs from three virtual machines, then ran common attacks against it from Kali Linux and wrote a detection rule for each. My write-up on GitHub shows how the brute-force rule flags an attack within a minute while ignoring a user who mistypes a password once.

Switching from IT support

In two years on my company’s IT helpdesk I became the person staff forward suspicious emails to, and I set up a routine to check each one and block the sender across our mail. Since then I have finished TryHackMe’s SOC Level 1 path and built a Splunk lab to practise sorting alerts.

Both are made-up examples. The numbers in yours must be your own, and ones you can explain in an interview.

An example email

Anita, a security lead at a fintech company, posts for a SOC analyst, 0 to 2 years, with SIEM experience and shift work, and asks for resumes by email. Vikram has two years in IT support. This is the whole email.

To
anita@paysure.example
Subject
SOC Analyst (L1): Vikram Singh, 2 years in IT support, Splunk lab

Hi Anita,

I saw your post for the SOC Analyst role at Paysure. I have worked for two years on the IT support team of a logistics company, where I became the person staff forward suspicious emails to, and security is the work I want to do full time.

I check each reported email, block the sender and look-alike addresses across our mail, and keep a log the team reviews every month. To build on that, I set up a Splunk lab that collects logs from Windows and Linux machines, simulated a password-spraying attack, and wrote the search that flags it; the write-up is on my GitHub.

I’m comfortable with shift work, and a payments company is where sorting alerts well matters most. My resume is attached, and I’d be glad to talk you through the lab on a short call.

Vikram Singh
+91 98xxx xxxxx
github.com/vikramsingh-example

A made-up example: Vikram, Anita and Paysure are fictional. Every claim in the email comes from Vikram’s own resume.

What makes it work:

  • It answers the post’s line about shifts, so Anita doesn’t have to ask.
  • Real security work from an IT support job, handling phishing reports, comes first; then a lab that matches the SIEM work.
  • The lab is told as an attack, a detection and a write-up: the SOC job in small.
  • Nothing of his employer’s is shared. The lab is his own.

The subject line

The role title and level as the post writes them (L1, L2), your name, your stage, and one proof: a certification the post asks for, or your lab.

  • SOC Analyst (L1): Vikram Singh, 2 years in IT support, Splunk lab
  • Cybersecurity Intern: Sana Mirza, B.Tech 2027, Security+
  • GRC Analyst: Deepak Menon, 3 years in internal audit, ISO 27001

Avoid subjects like “Job application” or “Resume”. The person who posted may have several openings, and the role first tells them which one.

Mistakes to avoid

  • Saying you “hacked” a real website, even to show skill. To the reader it is a reason not to hire you.
  • Every tool in Kali Linux, listed. Name the two or three the work needs and show one in use.
  • Certifications as the whole email. Pair the one you have with one piece of hands-on work.
  • A write-up that gives away a live machine’s answers or a company’s flaw. Share only what the platform or the programme allows.
  • Writing to a pen testing role with only SOC work, or the other way round, without saying how your work carries over.
  • An email address that sounds like a hacker’s handle. Use one with your name.

And the ones that hurt in every role: a guessed address, a generic resume, and an email longer than a phone screen. More in how to email a recruiter about a LinkedIn hiring post.

Where cybersecurity posts appear

  • LinkedIn posts by security leads and CISOs at banks, fintech and SaaS companies, and at security service providers.
  • Other titles for the same work: security analyst, SOC analyst (L1, L2), VAPT engineer, penetration tester, GRC analyst, information security analyst.
  • Managed security service providers and consultancies, which hire SOC analysts in batches for their shifts.
  • Company job boards on Greenhouse, Lever and Ashby, under security or IT.

A LinkedIn post search to start from (search Posts, Date posted Past 24 hours):

Cybersecurity posts for freshers

(cybersecurity OR "security analyst" OR "SOC analyst") ("send your" OR "share your") fresher

3 of 5 ORs, ANDs and NOTs

For pen testing, swap a title for VAPT or "penetration tester". Interns can search ("cybersecurity intern" OR "SOC intern" OR "VAPT intern") instead of the titles, without fresher. LinkedIn finds nothing at all once a search has more than five ORs, ANDs and NOTs: see how to find hiring posts on LinkedIn. If there is no reply in about a week, follow up once.

Guides for other roles

All of them, with what to lead with for each: cold email by role.