Role preparation
Information Security Engineer interview questions and answers.
Threat modelling, secure design, and incident response.
Questions
Technical questions to practise out loud
- 01
How do you run a threat modeling session?
Define scope and assets, diagram data flows and trust boundaries, identify attacker goals and abuse cases, rank threats by likelihood and impact, choose preventive and detective controls, and assign verification and owners.
Read the full breakdown - 02
How do you use the OWASP Top 10?
Use the OWASP Top 10 as an awareness and review checklist, not a complete threat model. Map relevant categories to architecture and tests, then add business-logic, platform and domain-specific threats it does not cover.
Read the full breakdown - 03
What makes an effective incident response plan?
An effective plan defines severity, roles and authority, secure communication, evidence preservation, containment and eradication playbooks, legal and customer escalation, recovery criteria, exercises, and lessons with accountable actions.
Read the full breakdown - 04
How do you assess security risk?
Identify assets, threats, vulnerabilities and existing controls; estimate likelihood and business impact, record uncertainty, rank residual risk, choose mitigate, transfer, avoid or accept, and assign an owner and review date.
Read the full breakdown - 05
What do you look for in a secure code review?
Trace untrusted data through authentication, authorization, validation, storage and output; review injection, access control, secrets, cryptography, unsafe deserialization, SSRF, races, logging and dependency changes against the threat model.
Read the full breakdown - 06
How do you design identity and access management?
Centralize identity, require strong authentication, use short-lived credentials and least-privilege role or attribute policies, separate duties, automate joiner-mover-leaver lifecycle, protect privileged access, audit and recertify.
Read the full breakdown - 07
What security events should be logged?
Log authentication and authorization decisions, privilege and policy changes, secret access, sensitive data operations, administrative actions, validation failures and security-control events with time, identity, target and outcome.
Read the full breakdown - 08
How do you manage vulnerabilities?
Inventory assets, continuously discover vulnerabilities, validate exposure and exploitability, prioritize by business context, set remediation SLAs, patch or mitigate safely, verify closure, manage exceptions, and measure recurrence.
Read the full breakdown - 09
How do you build security into delivery?
Build security into delivery with threat modelling, secure defaults and libraries, developer guidance, code and dependency scanning, secret detection, focused tests, review of high-risk changes, signed artifacts and production feedback.
Read the full breakdown - 10
How do you communicate during a security incident?
Use one incident lead and verified secure channels, separate factual status from hypotheses, tailor updates for responders, leaders, legal and customers, avoid sensitive details, record decisions, and communicate on a promised cadence.
Read the full breakdown