Information Security Engineer interview question
What makes an effective incident response plan?
An effective plan defines severity, roles and authority, secure communication, evidence preservation, containment and eradication playbooks, legal and customer escalation, recovery criteria, exercises, and lessons with accountable actions.
Direct answer
What a strong answer covers
How it works
An effective plan is one people can execute at 3 a.m. under pressure. It defines severity levels with examples so the first responder can classify without debate, names roles with the authority to isolate systems or engage outside counsel, and specifies communication channels that stay usable if email or chat are compromised. It includes playbooks for the likely scenarios such as credential compromise, ransomware, and data exposure, with containment and eradication steps and instructions to preserve evidence before rebuilding. It states when legal, regulators, and customers must be informed and by whom, what recovery means, and how the plan is exercised through tabletop drills with lessons tracked to completion.
Example
During a suspected token leak, the on-call classified it as sev-2 from the plan’s examples, the incident lead invoked the credential-compromise playbook, and the security engineer rotated the affected keys after snapshotting the logs and the compromised host. Legal was engaged within the hour because the playbook’s decision tree flagged possible customer data access. A tabletop exercise two months earlier had found that the out-of-band channel had no current member list, which had been fixed.
Common mistakes
- Writing a plan nobody has rehearsed.
- Wiping a compromised system before preserving evidence.
- Leaving notification decisions to be improvised under legal deadlines.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.