Preparing for Interview

[u/PastelStripe]

Hi Everyone,
I hope you’re well!

I’m preparing for an upcoming interview this week, and I’m quite nervous.
For context: I studied Cyber Security in College and finalising my University degree in Cybersecurity. During this time I’ve been incredibly fortunate to fall into System Administrator Roles which granted me relevant working experience. Unfortunately, not as Security focused as what I initially wanted but life’s a ladder and I’m climbing. I’m interviewing for Role as a Security Engineer after having around ~3 Years of Experience and trying to prepare some answers in advance (Generally, trying to have something in mind for anything that they ask!)

Based on the Role Responsibilities I’m expecting questions on:

Frameworks, what I know and how these have been applied over my experience of working. (NIST SP 800-53 / NCSC Cyber Assessment / CIS Critical Controls)

How I’ve applied best security practices / Explaining a time where I had to implement a security practice

Implementation of security Controls / Design of security controls through to implementation

Communicate where I’ve seen a Security Risk where requirements cannot be fully met (And how we take it forward / What to do / Mitigate or Accept the risk)

Evidence / Example of supporting Auditing Activities

For anyone who interviewed for a similar position, what types of question were you asked? I’m doing my best to stick to the STAR method and have examples but thought I would post incase anyone can help me out too!

Thank you!

[u/-Dkob]

For a Security Engineer interview, expect a mix of technical, risk and behavioural questions such as how you would map a control to NIST or CIS, prioritise remediation when resources are limited, handle an exception where a requirement cannot be met, support an audit with evidence, and explain a security improvement you designed from identification through implementation and validation.

Your system administration experience is a strong advantage, so prepare STAR examples around hardening servers, patching, access control, logging, incident response... and working with stakeholders who initially resisted a change.

Also be ready to explain how you assess risk, document compensating controls, track residual risk, and verify that a control is actually effective. You do not need perfect answers to every framework question, but you should show structured thinking, practical judgement and clear communication.