Information Security Engineer interview question
How do you assess security risk?
Identify assets, threats, vulnerabilities and existing controls; estimate likelihood and business impact, record uncertainty, rank residual risk, choose mitigate, transfer, avoid or accept, and assign an owner and review date.
Direct answer
What a strong answer covers
How it works
A risk assessment produces a ranked, owned list of what could hurt the organisation and what is being done about it. It starts from assets and their value, identifies the threats relevant to each and the vulnerabilities that would let those threats succeed, and takes existing controls into account. Likelihood and impact are estimated with stated evidence and uncertainty rather than false precision, giving a residual risk that can be ranked. For each risk above the appetite, the treatment is chosen: mitigate with a control, transfer through insurance or a vendor, avoid by not doing the activity, or accept with sign-off. Each entry has an owner and a review date so the register stays alive.
Example
Assessing a new customer data warehouse, the team rated exposure of the full dataset as high impact and, given broad internal read access and no query logging, moderate likelihood. Treatment: column-level masking for direct identifiers, role-based access reviewed quarterly, and query audit logs, which brought residual likelihood to low. The remaining risk from a privileged administrator was accepted by the data owner with a six-month review.
Common mistakes
- Rating every risk high so the list gives no guidance.
- Ignoring existing controls and double-counting exposure.
- Recording risks with no owner or review date so the register rots.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.