Interview guide · Technology roles
Cybersecurity interview questions
In short
Good cybersecurity interview questions test how a candidate triages alerts, investigates a phishing report or suspicious login, responds to an incident without destroying evidence, explains risk to non-technical leaders, and applies controls like least privilege, MFA and patching. Below are 33 questions for SOC analysts, security analysts and information security engineers, with what strong answers include and a scorecard.
Security roles vary widely, but most hires fall into a few buckets: SOC analysts who triage alerts and escalate incidents, security analysts or engineers who manage tools such as EDR, SIEM and identity controls, and governance and risk specialists who handle policies, audits and vendor reviews. Whatever the bucket, you want someone who stays calm when an alert fires, follows evidence rather than hunches, understands how attacks actually unfold, and can explain risk to a manager without drama or jargon. Integrity matters more here than in most technical roles, because the person will see sensitive data and hold powerful access.
Use these questions for SOC analysts (tier 1 to 3), cybersecurity and information security analysts, and security engineers. Pick six to eight across the groups for a 60-minute interview, adjust technical depth to the level, and ask the same core questions of every candidate. Scenario questions work best when you add detail as the candidate asks for it, the way a real investigation unfolds. Score against the scorecard right after the interview, before discussing with other interviewers.
What to look for in a cybersecurity analyst
- Investigative methodGood analysts form a hypothesis, gather evidence from logs and tools, and widen or close the investigation based on what they find. Guessing leads to missed intrusions or wasted escalations.
- Understanding of attacker behaviorKnowing how phishing, credential theft, lateral movement and ransomware unfold, often framed with MITRE ATT&CK, helps analysts spot the next step rather than just the alert in front of them.
- Calm incident handlingPanicked responders wipe machines, tip off attackers or skip communication. Calm, ordered response protects evidence and the business.
- Risk communicationSecurity teams depend on other people to fix things. Explaining risk in business terms with practical options gets action; fear and jargon don't.
- Integrity and discretionSecurity staff see confidential data and hold privileged access. Judgment about what to access, share and report is a core requirement.
- Continuous learningAttack techniques change constantly. Labs, capture-the-flag events, certifications and reading threat reports keep analysts useful.
Opening questions
Walk me through your security experience and the tools you've used day to day.
- Why ask it
- Maps real experience to the role.
- A strong answer
- Names specific tools (SIEM, EDR, email security, vulnerability scanners, identity platforms), the volume of alerts or assets, and what they personally did with them.
- Red flags
- Lists tools without describing their own use.
What area of security interests you most, and why?
- Why ask it
- Motivation and fit with the role's focus.
- A strong answer
- A specific interest, such as detection engineering, incident response, cloud security or governance, with examples of self-directed learning.
- Red flags
- Only interested in offensive hacking for a defensive SOC role.
How do you keep up with new threats and vulnerabilities?
- Why ask it
- Learning habits.
- A strong answer
- Specific sources such as vendor and government advisories (for example CISA alerts and the Known Exploited Vulnerabilities catalog), threat intelligence reports, communities, labs or CTFs, and something recent they learned.
- Red flags
- Can't name a recent threat or source.
Which certifications have you earned or are you working toward, and what did you get out of them?
- Why ask it
- Baseline knowledge and effort.
- A strong answer
- Honest about certifications (Security+, CySA+, GSEC, CISSP, cloud security) and what they applied in practice.
- Red flags
- Certifications with no ability to explain the concepts.
Security fundamentals
Explain the CIA triad with a real example of each.
- Why ask it
- Foundation of security thinking.
- A strong answer
- Confidentiality (encrypting customer data, access controls), integrity (hashing, change controls, preventing tampering with payroll data), availability (backups, DDoS protection, redundancy), with trade-offs between them.
- Red flags
- Recites the words without examples.
What's the difference between a vulnerability, a threat and a risk?
- Why ask it
- Core terminology for risk conversations.
- A strong answer
- Vulnerability is a weakness, threat is something that could exploit it, risk is the likelihood and impact of that happening. Gives an example such as an unpatched VPN appliance exposed to the internet.
- Red flags
- Uses the terms interchangeably.
How do symmetric and asymmetric encryption differ, and where is each used?
- Why ask it
- Technical baseline.
- A strong answer
- Symmetric uses one shared key and is fast (data at rest, bulk encryption); asymmetric uses key pairs for key exchange and signatures. TLS uses both: asymmetric to agree keys, symmetric for the session.
- Red flags
- Confuses encryption with hashing.
What is MFA, and which forms are stronger than others?
- Why ask it
- MFA is a top control and a common attack target.
- A strong answer
- Something you know, have or are; phishing-resistant methods (FIDO2 security keys, passkeys) are stronger than push notifications or SMS codes. Mentions MFA fatigue attacks and number matching.
- Red flags
- Treats all MFA as equal.
Explain least privilege and how you'd apply it to a team of administrators.
- Why ask it
- Practical control design.
- A strong answer
- Separate admin accounts, role-based access, just-in-time elevation, removal of standing domain admin rights, regular access reviews and logging.
- Red flags
- Gives everyone admin for convenience.
What happens in a typical ransomware attack, from initial access to encryption?
- Why ask it
- Understanding of attacker behavior.
- A strong answer
- Initial access (phishing, exposed RDP or VPN, vulnerable edge device), credential theft, privilege escalation, lateral movement, data theft for extortion, disabling backups and security tools, then encryption. Names detection and prevention points at each stage.
- Red flags
- Thinks ransomware starts and ends with one malicious file.
How does MITRE ATT&CK help you in your work?
- Why ask it
- Shared framework for detection and response.
- A strong answer
- Maps techniques to detections, spots coverage gaps, structures investigations and reports, and helps prioritize based on techniques seen in relevant threat groups.
- Red flags
- Has heard of it but never used it.
SOC and incident response questions
An employee reports a suspicious email. Walk me through how you handle it.
- Why ask it
- Most common SOC task.
- A strong answer
- Analyzes headers, sender, links and attachments in a safe environment, checks whether others received it, searches for clicks or credential entry, removes it from mailboxes, blocks indicators, resets credentials if needed, and thanks the reporter.
- Red flags
- Just tells the user to delete it.
You see a successful login for a user from a new country, followed by a new inbox forwarding rule. What do you do?
- Why ask it
- Classic account compromise pattern.
- A strong answer
- Treats it as likely business email compromise: confirms with the user via a separate channel, revokes sessions, resets password and MFA, removes the rule, reviews mailbox and sign-in logs for other actions and other affected accounts, and checks for fraudulent emails sent.
- Red flags
- Assumes travel and closes the alert.
How do you triage a queue of 200 alerts at the start of a shift?
- Why ask it
- Prioritization and tool sense.
- A strong answer
- Sorts by severity and asset criticality, groups related alerts, checks for known false-positive patterns, handles high-confidence and critical-asset alerts first, and flags noisy rules for tuning.
- Red flags
- Works strictly oldest first.
EDR flags PowerShell running an encoded command on a finance laptop. What next?
- Why ask it
- Endpoint investigation.
- A strong answer
- Decodes the command, checks parent process and user, network connections and files written, looks for persistence, isolates the host if malicious, and scopes for the same behavior elsewhere.
- Red flags
- Closes it because PowerShell is legitimate.
What are the phases of incident response?
- Why ask it
- Process knowledge.
- A strong answer
- Preparation, detection and analysis, containment, eradication, recovery, and lessons learned (as in the NIST incident handling guide), with an example of each from their experience.
- Red flags
- Jumps straight from detection to rebuild.
Why shouldn't you immediately wipe a compromised machine?
- Why ask it
- Evidence preservation.
- A strong answer
- You lose evidence of how the attacker got in, what they did and what else they touched; you may tip them off. Isolate, collect memory and disk images or EDR data as policy requires, then rebuild.
- Red flags
- Thinks wiping is always the safest first step.
What makes a good incident ticket or escalation note?
- Why ask it
- Handoffs between tiers.
- A strong answer
- Timeline, affected users and assets, indicators, actions taken, evidence links, current status and recommended next steps, written so the next analyst doesn't repeat work.
- Red flags
- One-line notes.
Security engineering and risk questions
How would you prioritize 3,000 open vulnerabilities from a scan?
- Why ask it
- Risk-based vulnerability management.
- A strong answer
- Focuses on exploitability (known exploited, public exploit code), exposure (internet-facing), asset criticality and compensating controls, rather than raw CVSS score alone. Fixes root causes like base images and patch processes.
- Red flags
- Sorts by CVSS and starts at the top.
How do you write or tune a detection rule?
- Why ask it
- Detection engineering skill.
- A strong answer
- Starts from a technique or threat, identifies log sources, writes the query, tests against known-good and known-bad data, measures false positives, documents a response playbook and reviews it over time.
- Red flags
- Turns on every vendor rule and leaves them.
What security controls matter most for cloud environments?
- Why ask it
- Cloud security basics.
- A strong answer
- Identity and access management, MFA, no public storage by default, logging such as audit trails enabled and centralized, network controls, secrets management, configuration monitoring and infrastructure as code reviews.
- Red flags
- Assumes the cloud provider handles all security.
How would you assess a new SaaS vendor that will hold employee data?
- Why ask it
- Third-party risk.
- A strong answer
- Reviews data types and flows, security reports such as SOC 2 Type II, encryption, SSO and MFA support, data retention and deletion, breach notification terms, subprocessors and contract clauses.
- Red flags
- Only checks the vendor's marketing page.
How do you explain a security risk to a business leader who wants to skip a control?
- Why ask it
- Risk communication.
- A strong answer
- Uses business impact and likelihood, gives options with costs, documents risk acceptance by the right owner, and stays practical rather than alarmist.
- Red flags
- Says 'it's a security requirement' and nothing more.
Behavioral and situational questions
Tell me about a security incident you worked on from start to finish.
- Why ask it
- Real experience and ownership.
- A strong answer
- Clear timeline, their role, the decisions made, communication with stakeholders, and what changed afterwards.
- Red flags
- Can't describe their own contribution.
Describe a time you made a mistake in a security investigation.
- Why ask it
- Honesty and learning.
- A strong answer
- Specific mistake, such as closing a true positive or over-escalating, how it was caught and what they changed in their process.
- Red flags
- Claims no mistakes.
A senior executive asks you to give them access to an employee's mailbox without a ticket. What do you do?
- Why ask it
- Integrity under pressure.
- A strong answer
- Politely declines to bypass process, explains the approval path (HR, legal or the authorized owner), and documents the request.
- Red flags
- Grants access because of seniority.
During an investigation you come across personal information about a colleague unrelated to the case. What do you do?
- Why ask it
- Discretion.
- A strong answer
- Doesn't look further or share it, stays within the scope of the investigation, and follows policy for anything that must be reported.
- Red flags
- Shares it or browses out of curiosity.
Tell me about a time you got another team to fix a security issue they didn't prioritize.
- Why ask it
- Influence.
- A strong answer
- Understood their constraints, explained risk in their terms, offered help or a phased fix, and followed up.
- Red flags
- Escalated immediately or gave up.
Questions for senior security candidates
If you joined and found no incident response plan, what would you do in your first 90 days?
- Why ask it
- Program-building.
- A strong answer
- Identifies critical assets and contacts, drafts a plan with roles and escalation, sets up communication channels and retainers, runs a tabletop exercise, and improves based on gaps.
- Red flags
- Buys a tool and calls it done.
How do you measure whether a SOC is effective?
- Why ask it
- Metrics maturity.
- A strong answer
- Mean time to detect and respond, detection coverage against relevant techniques, true positive rate, escalation quality and analyst workload, rather than alert counts alone.
- Red flags
- Measures alerts closed per analyst.
How would you build a security awareness program people don't hate?
- Why ask it
- Human risk.
- A strong answer
- Short, role-based training, realistic phishing simulations used for learning rather than shaming, easy reporting, positive reinforcement and metrics such as report rates.
- Red flags
- Annual hour-long video and punishment for clicks.
Sample answers
That combination looks like business email compromise, so I'd treat it as an incident until proven otherwise. I'd contact the user on a known phone number, not by email, to confirm whether they're traveling. In parallel I'd revoke their active sessions, reset the password and MFA methods, and remove the forwarding rule. Then I'd look at what the attacker did: sign-in logs for other suspicious sessions, mailbox audit logs for emails read, sent or deleted, and whether they set up other rules or app consents. I'd search for the same IP or user agent against other accounts. If they sent emails, especially anything about payments or bank details, finance needs to know right away. Then I'd write it up with a timeline and indicators.
I'd thank them first, because reporting is the behavior we want. Then I'd look at the original message with headers: sender domain, reply-to, authentication results, and where links really go. I'd open attachments or links only in a sandbox. If it's malicious, I search the mail system for every copy, check whether anyone clicked or entered credentials using proxy and sign-in logs, and pull the messages from all mailboxes. I'd block the sender, domain and URLs, reset credentials for anyone who entered them, and check their accounts for suspicious activity. Finally I'd log the indicators and, if it's a new campaign, share a short heads-up with staff.
Not by CVSS alone. I'd first pull out anything on the known exploited vulnerabilities list or with public exploit code, then filter by exposure, starting with internet-facing systems like VPNs, web servers and remote access. Next I'd weight by asset criticality: domain controllers, finance systems, anything holding customer data. That usually brings 3,000 down to a few dozen that need action this week. For the rest, I'd look for patterns. Often hundreds of findings come from one outdated base image or a missed patch cycle, so fixing the process clears them in bulk. I'd report progress on the critical list separately so leadership sees real risk going down, not just a total count.
Interview scorecard
| Competency | Weight | Strong (4–5) | Weak (1–2) |
|---|---|---|---|
| Investigation and incident response | 25% | Hypothesis-driven, uses logs and tools well, contains while preserving evidence, scopes widely. | Guesses, closes alerts too quickly, wipes before investigating. |
| Security fundamentals and attacker knowledge | 20% | Explains controls, cryptography basics and attack chains accurately, maps them to detections. | Buzzwords without understanding, confuses basic concepts. |
| Risk judgment and prioritization | 20% | Prioritizes by exploitability, exposure and asset value; offers practical options. | Treats everything as critical or sorts by a single score. |
| Communication and documentation | 15% | Clear tickets and reports, explains risk in business terms, calm with stakeholders. | Jargon, alarmism, or thin notes. |
| Integrity and discretion | 10% | Follows access process under pressure, stays in scope, handles sensitive data carefully. | Bypasses process for seniority or curiosity. |
| Learning and curiosity | 10% | Active labs, CTFs, current threat knowledge, applies new learning. | No recent learning. |
Score each competency from 1 to 5 straight after the interview, before discussing the candidate with anyone else, then multiply by the weight.
How to structure a cybersecurity interview
A three or four-step process fits most security roles:
- Recruiter screen (20 to 30 minutes). Confirm the focus (SOC, engineering, governance), shift pattern for 24/7 SOCs, on-call, clearance or background check requirements and salary. Check experience against the duties in your security specialist job description.
- Technical interview (60 minutes) with a senior analyst or engineer: fundamentals, two scenario investigations that unfold as the candidate asks questions, and one risk prioritization question.
- Practical exercise (45 to 90 minutes). Analyze a phishing email and its headers, investigate a set of logs for a compromised account, or triage a small alert queue. For tier 1 SOC volume hiring, an online skills assessment with log analysis and phishing questions screens applicants before interviews.
- Team and values interview (45 minutes) with the manager and someone from IT operations, covering behavioral and integrity questions.
For roles that own firewalls or network detection, include a question or two from our network engineer interview questions; for roles close to identity and server hardening, the system administrator interview questions help.
Mistakes interviewers make
Gatekeeping on certifications and degrees. Many strong analysts come from help desk, network or self-taught paths through labs and CTFs. Scenario questions find them; certificate filters miss them.
Asking only trivia. Port numbers and acronyms are easy to look up during a real investigation. How someone works an alert isn't.
Skipping integrity questions. Security staff will be asked to bend rules by senior people. Ask directly how they'd handle it, and see our integrity interview questions for more.
Hiding shift work. 24/7 SOCs run nights and weekends. Be upfront; surprise night shifts are a leading reason new analysts leave.
Testing only offense or only defense. Make sure the questions match the actual job. A penetration tester and a SOC analyst need different interviews.
Background checks and fair hiring for security roles
Security roles often require more extensive background checks, and some government or defense work requires a security clearance. In the US, background checks run through a consumer reporting agency must follow the Fair Credit Reporting Act, including written disclosure, the candidate's authorization and the pre-adverse and adverse action steps if you decide not to hire based on the report. Many states and cities also have fair chance or ban-the-box laws that limit when and how you ask about criminal history, and some restrict credit checks, though several make exceptions for certain roles. Rules vary by state and city, so check them for each location you hire in.
Keep interview questions job-related and consistent across candidates. Asking every candidate the same scenario and integrity questions, scored on the same rubric, makes decisions easier to defend and helps you compare candidates from very different backgrounds fairly.
Frequently asked questions
What are common cybersecurity interview questions?
Expect questions on the CIA triad, the difference between vulnerability, threat and risk, encryption basics, MFA, how a ransomware attack unfolds, handling a phishing report, investigating a suspicious login and prioritizing vulnerabilities.
What questions are asked in a SOC analyst interview?
SOC analyst interviews focus on alert triage, phishing analysis, investigating account compromise and suspicious processes, incident response phases, SIEM and EDR use, writing escalation notes and working shifts.
What should a cyber security analyst interview include?
Fundamentals, two or three investigation scenarios, a vulnerability prioritization question, a risk communication question, integrity questions and ideally a practical exercise such as log or phishing analysis.
How are information security interview questions different?
Information security roles often lean toward governance and risk: policies, audits, vendor risk, frameworks such as ISO 27001 or NIST, data classification and risk acceptance, alongside technical controls.
Do cybersecurity interviews include a practical test?
Often. Common formats are analyzing a phishing email, investigating sample logs, triaging an alert queue, or a short capture-the-flag style challenge, usually lasting 45 to 90 minutes.
Can I get a cybersecurity job without experience?
Entry-level SOC roles often hire from help desk, network or IT support backgrounds, and from candidates who show hands-on skill through labs, CTFs and certifications such as Security+.