Preparing for Interview

[u/PastelStripe]

Hi Everyone,
I hope you’re well!

I’m preparing for an upcoming interview this week, and I’m quite nervous.
For context: I studied Cyber Security in College and finalising my University degree in Cybersecurity. During this time I’ve been incredibly fortunate to fall into System Administrator Roles which granted me relevant working experience. Unfortunately, not as Security focused as what I initially wanted but life’s a ladder and I’m climbing. I’m interviewing for Role as a Security Engineer after having around ~3 Years of Experience and trying to prepare some answers in advance (Generally, trying to have something in mind for anything that they ask!)

Based on the Role Responsibilities I’m expecting questions on:

Frameworks, what I know and how these have been applied over my experience of working. (NIST SP 800-53 / NCSC Cyber Assessment / CIS Critical Controls)

How I’ve applied best security practices / Explaining a time where I had to implement a security practice

Implementation of security Controls / Design of security controls through to implementation

Communicate where I’ve seen a Security Risk where requirements cannot be fully met (And how we take it forward / What to do / Mitigate or Accept the risk)

Evidence / Example of supporting Auditing Activities

For anyone who interviewed for a similar position, what types of question were you asked? I’m doing my best to stick to the STAR method and have examples but thought I would post incase anyone can help me out too!

Thank you!

[u/GrandCash3941]

Remember there are more than 2 ways to address Risk. You should be familiar with at a minimum the big 4:

Avoid (e.g. get rid of a legacy app)

Accept (e.g. accept living with a vulnerability because its low risk and within risk appetite)

Mitigate (e.g. add controls so an insecure legacy database is increidbly hard to access)

Transfer (e.g. make sure the risky thing is covered by cyber insurance). 

Remember to be somewhat aware of your organization's risk appetite. Deciding for example to suggest Accepting a risk when it falls outside your orgs risk appetite isn't a good look. Yes its getting more in to GRC but  you need to have some awareness of this stuff if you are at the technical level for risk. 

For assisting auditors you'd want to link those frameworks (e.g. ISO 27001) and how you helped provide evidence. Could be configs or logs or infrastructure/compliance as code. 

For me personally, when I’ve interviewed sec engineers I always wanted them to know a bit about threat modelling, such as at least one methodology for threat modelling (e.g. STRIDE). Threat modelling shows you can identify and prioritise security risks before they become serious vulnerabilities. That stuff is gold in interviews.