Security Engineer
Interview Questions.
15 practice questions across 13 skills — each with what the interviewer is really listening for. Prepare with intent, not guesswork.
Free · No signup · Grouped by skill
How to use this page
Don't memorise answers. For each question, read what the interviewer is looking for, then practise answering out loud in your own words with a real example. The notes describe strong answers and common red flags — they are for your prep, not a script.
Network Security
1 questionHow would you design network security for a company moving to the cloud?
AdvancedWhat the interviewer is looking for: Strong answers apply segmentation, least privilege, zero-trust principles, and defence in depth rather than a single perimeter. Relying on a firewall alone is a red flag.
Penetration Testing
1 questionWalk me through how you would scope and run a penetration test on a web app.
AdvancedWhat the interviewer is looking for: Look for authorised scope, reconnaissance, testing against OWASP-style issues, and clear reporting with remediation, always within rules of engagement. Testing without authorization or scope is a serious red flag.
Vulnerability Assessment
1 questionHow do you prioritise remediation from a large set of vulnerability findings?
IntermediateWhat the interviewer is looking for: Strong candidates prioritise by exploitability, exposure, and asset criticality, not just CVSS. Patching purely top-to-bottom by score is a red flag.
Python
1 questionHow would you use Python to automate a security task?
IntermediateWhat the interviewer is looking for: Look for automating log parsing, enrichment, or checks to scale analysis, with safe handling of data. Doing everything manually is a limitation for a security engineer.
Linux
1 questionHow do you investigate a host on Linux you suspect is compromised?
AdvancedWhat the interviewer is looking for: Strong answers check processes, network connections, persistence (cron, services), logs, and file integrity methodically while preserving evidence. Rebooting or wiping first and destroying evidence is a red flag.
Splunk
1 questionHow do you use a SIEM like Splunk to detect and hunt threats?
AdvancedWhat the interviewer is looking for: Look for correlation across sources, tuning to cut noise, and proactive hunting on hypotheses. Only reacting to prebuilt alerts is a limitation.
NIST
1 questionHow do you apply a framework like NIST to structure a security program?
IntermediateWhat the interviewer is looking for: Strong candidates use it to assess and prioritise across identify/protect/detect/respond/recover, mapped to real risk. Treating frameworks as pure paperwork is a red flag.
IAM
1 questionHow do you design IAM to enforce least privilege in a cloud environment?
AdvancedWhat the interviewer is looking for: Look for role-based least privilege, avoiding long-lived keys, MFA, and regular access reviews. Broad admin roles and static credentials are serious red flags.
Encryption
1 questionHow do you handle secrets and encryption for sensitive data?
AdvancedWhat the interviewer is looking for: Strong answers use a secrets manager, encryption in transit and at rest, key rotation, and no hardcoded secrets. Plaintext secrets in code are a serious red flag.
Incident Response
1 questionWalk me through your response to a confirmed active incident.
AdvancedWhat the interviewer is looking for: Look for a structured process — contain, eradicate, recover — evidence preservation, communication, and a blameless post-mortem. Panic or destroying evidence are red flags.
MITRE ATT&CK
1 questionHow do you use MITRE ATT&CK to improve detection coverage?
AdvancedWhat the interviewer is looking for: Strong candidates map detections to techniques, find gaps, and prioritise realistic threats. Using it as a checklist with no analysis is a red flag.
Communication
1 questionHow do you get developers to build security in rather than seeing you as a blocker?
IntermediateWhat the interviewer is looking for: Look for shifting left, providing paved paths and tooling, and explaining risk in business terms. Being the pure 'department of no' is a red flag.
Technical Documentation
1 questionHow do you document security findings and controls so they are actionable and auditable?
BasicWhat the interviewer is looking for: Strong candidates write clear findings with severity, evidence, and remediation, and keep records for audits. Vague, undocumented findings are a red flag.
Behavioural & role-general
2 questionsHow do you keep up with a rapidly evolving threat landscape?
BasicWhat the interviewer is looking for: Strong answers cite threat intel, advisories, labs, CTFs, and community. Vague 'I stay updated' with no sources is a red flag in security.
How do you balance strong security with the business's need to move fast?
IntermediateWhat the interviewer is looking for: Look for risk-based, proportionate controls and enabling the business safely. Either blocking everything or waving through real risk are red flags.