I get to look at a lot of resumes as part of my job. Each of these represents a thinking, feeling human being, but after awhile it is very hard not to get picky about what makes it easier for people who don't have a lot of time to spend reading your document to digest it and get the information they need.
This blog post is not about the CV. That is a different document. Though there might be commonalities like publications and work experience, they should be represented differently.
It is also specific to United States tech culture, and particularly the intersection of infosec and software development. What is perfectly acceptable in Germany or Vietnam (or CS academia, or claims adjusting, or ...) doesn't come across the same way here, and vice versa.
Looking at your resume, I'm trying to see a small number of things:
- How well you communicate
- Your experience in (languages|technologies|methodologies) as listed in the job description
- Where you got that experience (startup? bootcamp? big tech companies?) so that I have a better idea about your familiarity with various styles of infrastructure and process and what will be different for you with our infrastructure and process
- The sizes and types of teams you worked on previously
- Whether you have technical leadership experience if you applied to a more senior role
You might consider having a peer in your field with more experience take a
look at your resume before sending it in to see if they are able to grok your
experience and aren't put off by formatting.
Specific peeves
Progress bars or star ratings
I don't know what "90% Javascript" means. Putting that stat right next to "50% threat modelling" makes me wonder if you feel you are better overall at Javascript than threat modelling and what such a comparison even means, or how to compare these two things at all.
It's better to just list Javascript and threat modelling as skills since then the reader can judge for themselves. If you've contributed to a bunch of core Javascript libraries or something, list a
few of the most popular ones.
The following doesn't say anything useful about what John can do to people who don't know him. (John is also trolling me.)
Meme Making Skills 5/5 AY LMAOOs
— John Jackson - ๆกใฎไพ (@johnjhacking) March 23, 2021
๐ฝ๐ฝ๐ฝ๐ฝ๐ฝ
Jokes & Witty Commentary 2/5 LULZ
๐งจ๐งจ
Hacking Ability 4/5 Shells
๐ ๐ ๐ ๐
Farming 3/5 Bwuhks
๐ ๐ ๐
Machine-Like Work Ethic 5/5 robot
๐ค ๐ค ๐ค ๐ค ๐ค
For approximately the same reason one should not plot disparate data on the same chart unless it can be graphed on the same axes at the same scale, putting progress bars or star ratings next to each other is confusing to the reader.
Overly personal details
Some flavour is good. If you are able, get a second opinion from someone outside your social group(s) before including something not super directly related to your field.
Including one or two minor and quasi-professional things at the very end of the document, especially something somewhat common in your field (CTF participation, ham radio licence, etc), is great. It makes it easier to remember who you are when my team and I have been looking at resumes for an hour and yours is somewhere in the middle of the stack. If you choose to include something from this category include it under items like publications/talks, certifications, and so on in terms
of position from top of the document. Do not include factoids like your taste in TV or music unless you were a session musician on
the album in question or something.
Do not include your spouse's occupation, or your parents' occupations. This may be done sometimes elsewhere (and please do if you need to elsewhere) but it's not customary in this field, or country. Same goes for religion, children's ages, and street address. That kind of stuff is kind of uncomfortable to learn about someone one doesn't know without any other context, and not stuff that would come up in the workplace anyway unless you're close to your coworkers.
Design
This comes with caveat that I don't have experience in working in or hiring for folks in design/UX/UI/marketing/growth hacking/etc, but for software engineering and infosec please keep the funky tables, graphics, pie charts, and flourishes for other documents.
Source: https://commons.wikimedia.org/wiki/File:Server-side_websites_programming_languages.PNG
I just want to read this thing quickly and get a sense for the work you've done and what you know and whether you'd be a helpful pair of hands to have about for the projects my team needs to work on. Graphics are usually just something I have to puzzle through and interpret.
More than one or maybe two fonts is just going to make it hard to read continuously across the various areas of your resume. Fancy typography has got to be first and foremost readable for use in a resume.
As a very hyperbolic example, consider the following typography:
Logos and other pictures
Especially don't include logos if they don't quite render in the place you wanted in your PDF or would get mangled when your Word document comes through the recruiting system.
It is not customary in the tech industry in the United States to include a picture of yourself. Adding a headshot is customary in a lot of places, but I want to be able to consider
your written accomplishments without bias
toward or against the way you look.
Certifications
Some infosec people really don't like them. Some do. Some jobs you can't get without a CISSP. If you have enough work experience to show you can do the things I am looking for, it pretty much doesn't matter if you have certs or not for just plain old tech jobs (government jobs and so forth are not the same). If you have bug bounty contributions, open source contributions, or CVEs that's a lot more interesting compared to whether you are good at taking tests.
If you're not applying for an entry-level role, don't include entry-level certificates like CEH if you don't also have something like OSCP to counterbalance them.
However, if you are applying for an entry-level role, literally anything you can say on your resume to show you're at least interested in the work, even if you don't have experience, will help me understand you're interested in the work. CEH and similar are great in this case.
Extremely long resumes
I've seen folks with 20+ years' experience doing a wide variety of things fit all that in two pages or less just fine. Most resumes are one to two pages. You can do it. I believe in you.
