CTFs on Your Cybersecurity CV: How to Make Them Count
CTFs on a cybersecurity CV: where to place them, how to describe your role, publish write-ups and turn a ranking into real proof during your interviews.
You spend your evenings on training platforms, your team enters competitions, and yet that line on your CV doesn't bring in the calls you hoped for. The problem is rarely the CTF itself: it's how it's presented. Here is how to turn CTF practice into proof that a recruiter can read, a practitioner will believe and that holds up in an interview.
Why a CTF matters (and why it isn't enough)
A CTF shows something no list of tools can: you searched, failed, tried again and ended up solving a concrete problem. For a junior or career changer, it is often the best evidence of hands-on practice available.
But the people reading your CV also know the limits of the format. On the employer side, we covered what a CTF ranking says and what it doesn't: the team factor, the gap with the actual job, the absence of a deliverable. Your job is to answer those doubts before anyone raises them.
Keep one simple idea in mind: a ranking catches the eye, a method convinces.
Where to put CTFs on your CV
The right place depends on your professional security experience.
| Your situation | Where to place the CTF | Suggested length |
|---|---|---|
| Student, junior, career changer | "Projects and practice" section, above experience | Three to five lines, with a link |
| One to three years in security | "Projects and practice" section, below experience | Two to three targeted lines |
| Experienced profile | One line, or a mention in your summary if it's a real differentiator | One line |
| Non-technical target role (GRC, governance) | One line near the end, as a sign of curiosity | One line |
If you are starting out, don't bury your practice at the bottom of the page. If you already have several years of engagements, those carry your application and the CTF supports them. Our guide to the cybersecurity CV covers the full structure.
Describing a CTF: from vague line to evidence
Most CTF lines just say "took part in CTFs" or show a ranking with no context. What convinces is an answer to four questions: what, in which category, in what role, and what you took from it.
Before / after
| Before | After |
|---|---|
| Regular CTF participation | Regular CTF practice in web and Active Directory categories, write-ups published on my blog |
| Member of a CTF team | Member of a student team, in charge of forensics and log analysis challenges |
| Good ranking on a training platform | Solved Windows and Active Directory focused machines on a training platform, with public methodology notes |
| CTF enthusiast | Solved web challenges (injection, access control, deserialization), with a proposed fix in each write-up |
The right-hand column names the category, your personal role and a verifiable trace. If you mention a ranking, give the context (competition name, format, number of teams if that information is public) and never round it in your favour: it's easy to check.
Match the categories to the role
A recruiter reads your CTF through the lens of the role they're filling. Highlight what serves that role.
- Pentest or red team: web, exploitation, Active Directory, privilege escalation. See also our path to becoming a pentester.
- SOC or incident response: forensics, log analysis, detection, network investigation. Our guide to becoming a SOC analyst explains how to add a defensive home lab.
- Application security: web, code review and, above all, the ability to propose a fix.
- Cloud security: cloud challenges exist but are less common. Complement them with personal projects on a test account.
If you only play offensive challenges and are aiming for a defensive role, say so plainly and show what you are doing to close the gap.
Write-ups, your strongest argument
A write-up is an account of how you solved a challenge. It is what turns a CTF from a mention into evidence, because it shows what the ranking hides: your reasoning and your ability to explain.
From a technical recruiter's point of view, a good write-up includes:
- The challenge context, in two lines.
- Your approach, including the dead ends and why you dropped them.
- The technique used, explained simply, never a command pasted without understanding it.
- The real-world link: how this weakness is fixed, or how it would be detected.
- What you learned.
Three or four polished write-ups beat fifty raw notes. Put the link on your CV and on LinkedIn.
One important rule: respect the organisers' rules. Many competitions forbid publishing solutions during the event, and some training platforms restrict write-ups on machines that are still active. Publishing at the wrong time sends the opposite signal to the one you want.
Talking about CTFs in an interview
Every line on your CV can become a question. For a CTF, prepare for these four.
- "Tell me about a challenge you solved on your own." Pick one in advance, related to the role, and walk through it step by step.
- "Where did you get stuck?" An honest answer, with how you got unstuck, reassures far more than a flawless story.
- "What was your role in the team?" Be precise about your contribution and openly credit what your teammates solved.
- "How would you do this on a real engagement?" This is the decisive question. Talk about written authorisation, scope, production impact and reporting. It shows you know the difference between a game and a job.
Our guide to succeeding in a technical cybersecurity interview rounds out this preparation.
Mistakes that hurt your application
- Overselling a team result as a personal win. The question about your role will come.
- Showing a rank without context. Without the competition name and format, a ranking means nothing.
- Listing dozens of competitions. Pick the ones most relevant to the role.
- Only talking about speed. On real engagements, rigour and deliverable quality often matter more.
- Mentioning offensive techniques outside a legal frame. Everything you describe must have happened in an environment built for it.
- Hiding your CTFs because your ranking isn't great. Well-documented regular practice is worth more than a flattering rank.
What if you don't do CTFs?
It's not a handicap. Many excellent professionals dislike competition or simply lack the time. Other evidence plays the same role: a documented home lab, open source contributions, published detection rules, research presented at a meetup. What matters is showing practice, not following a format.
Checklist before sending your CV
- The CTF is in the right place for my level of experience.
- Each line states the category, my role and a verifiable trace.
- The highlighted categories match the target role.
- Any ranking I cite is accurate and comes with its context.
- At least one polished write-up is reachable via a link.
- I have prepared one challenge to walk through in detail.
- I can explain how I would apply the technique on a real engagement.
In short
A CTF is a real asset on a cybersecurity CV, as long as you present it as evidence rather than a trophy. State the category, your role and what you learned, and back it up with write-ups that show your method. In the interview, make the link between the challenge and the job yourself.
At Cyber Recrut, practice counts as much as background: our shortlisted candidates prove their skills on hands-on labs close to the role, which is exactly where your CTF experience pays off. Join the network for free and see how we work.