Module 20 Lesson 1 of 6 🕑 ~55 min

> cat module-20-1-hiring-process-cv.md

How Hiring Works & Writing Your CV

Before you write a single line of a CV, it helps to understand who's actually going to read it and what they're checking for. This lesson maps the hiring pipeline, then builds a CV structured around what each of those people needs to see.

1 How Technology Hiring Works

A technology recruitment process may run: application → ATS/recruiter screening → recruiter interview → hiring manager interview → technical interview → practical exercise/assessment → behavioural/team interview → final interview → offer → background/reference checks. Not every organisation uses every stage — a small company might complete the whole process in two interviews, while large multinationals may run four, five, or more stages.

Different people in that pipeline are checking for completely different things:

  • Recruiter — location, work authorisation, availability, salary expectations, communication ability, general experience, and whether your CV looks relevant. Recruiters aren't usually testing deep technical knowledge; they're deciding whether you're worth sending to the hiring manager.
  • Hiring manager (Support Manager, IT Manager, SOC Manager, Infrastructure Manager, Engineering Manager, IAM Manager, and similar) — can you do the job, can you learn, can you troubleshoot, can you communicate, will you fit the team.
  • Technical interviewer (senior engineers, technical leads, architects, security engineers) — your understanding of networking, Windows, Linux, Active Directory, cloud, authentication, APIs, security, troubleshooting, logs, and scripting. They rarely expect a junior candidate to know everything; they're often assessing how you think when you don't know the answer.

2 CV Structure & the Professional Summary

Your CV's job isn't to tell your entire life story — it's to convince a recruiter or hiring manager you're worth interviewing. For most early-career candidates, 1–2 pages is normally sufficient (experienced consultants and contractors with extensive project histories may need more). A strong structure: name, location, contact details, LinkedIn, GitHub/portfolio, professional summary, technical skills, experience, projects/home lab, education, certifications.

Compare: "Hard-working individual looking for an opportunity to grow" against "Entry-level IT and cybersecurity professional with hands-on experience building Windows Server, Active Directory, Linux, networking and security lab environments. Familiar with Microsoft 365, Entra ID, PowerShell, REST APIs, SIEM platforms and troubleshooting authentication and network issues. Currently seeking an IT support, infrastructure, IAM or security operations role." What does the second one do that the first doesn't?

Reveal the answer

The second tells the reader your level, exactly what technology you know, and which roles you're targeting — in the first ten seconds a recruiter spends on your CV. The first sentence could belong to literally any candidate applying for any job; it communicates nothing. A professional summary should be specific enough that it would be wrong for someone else's CV.

3 The Technical Skills Section & Legacy Technology

Group technologies logically rather than listing them as one long line — e.g. Operating Systems (Windows 10/11, Windows Server 2019/2022/2025, Ubuntu, Debian, Kali Linux), Identity (Active Directory, Microsoft Entra ID, LDAP, Kerberos, NTLM, SAML, OAuth 2.0, OIDC, MFA), Networking (TCP/IP, DNS, DHCP, VLANs, VPN, NAT, routing, firewalls), Cloud (Azure, AWS, GCP fundamentals), Security (SIEM, EDR, incident response, log analysis, IAM), Automation (PowerShell, Bash, REST APIs, JSON), and Tools (Wireshark, Postman, Git, GitHub, ServiceNow, Jira, Splunk).

Never list technology you can't discuss in an interview — if you write "Kubernetes," an interviewer has every right to ask "explain what a Kubernetes pod is." And don't assume every company runs the newest stack; large organisations frequently operate hybrid environments spanning Microsoft Entra ID alongside Active Directory, OAuth/OIDC alongside LDAP, FIDO2/passkeys alongside password authentication, SAML alongside NTLM, Azure/AWS alongside on-premises servers, containers alongside traditional VMs, Zero Trust alongside perimeter security, Microsoft Sentinel alongside traditional SIEM, EDR/XDR alongside antivirus, REST alongside SOAP, PowerShell alongside batch scripts, and Windows 11 alongside older systems. Showing you understand both modern and traditional environments — which this entire course has deliberately built into every module — is a genuine differentiator.

4 Avoid Skill Inflation & Write Experience Properly

Don't write "Expert in AWS" or "Expert in cybersecurity" after completing a few labs. Use honest, realistic wording instead: hands-on experience, familiar with, working knowledge, lab experience, fundamental understanding. Employers generally appreciate honesty far more than they reward inflated language — and inflated language gets tested in the interview anyway.

Rank these three CV bullets by strength: "Reset passwords for users." / "Supported user authentication issues including password resets, account lockouts and Active Directory access problems." / "Troubleshot Windows authentication and Active Directory access issues including account lockouts, password resets, group membership and user permission problems."

Reveal the answer

The third is strongest, then the second, then the first. Each version describes essentially the same work, but the level of technical specificity signals a different level of understanding — "reset passwords" sounds purely mechanical, while "troubleshot... group membership and user permission problems" signals you understood the AD structure behind the symptom. The same upgrade applies elsewhere: "Helped with tickets" becomes "Managed technical incidents through ServiceNow while maintaining SLA targets and documenting troubleshooting steps and resolutions" (Module 18 territory); "Worked on computers" becomes "Diagnosed Windows workstation, networking, VPN, application and peripheral issues across corporate endpoints."