The short answer: security engineer interviews test fundamentals (the CIA triad, cryptography basics, networking), application and cloud security, identity and access, detection and incident response, and how you reduce risk without blocking the business. Expect scenario questions (“You find an exposed access key in a public repository. What do you do?”) and, at many companies, coding or scripting. Security consultant interviews add client communication, risk assessments and frameworks. Answer with real incidents or improvements, your reasoning, and the outcome. Below are the common questions with short answers.
What the job involves
The U.S. Bureau of Labor Statistics says “information security analysts plan and carry out security measures to protect an organization’s computer networks and systems.” The median pay was $129,180 in May 2025, and employment is projected to grow 21% from 2025 to 2035, much faster than average.
Fundamentals
“What is the CIA triad?”
Confidentiality (only authorized people can see data), integrity (data isn’t altered without authorization) and availability (systems and data are there when needed). Most controls protect one or more of these.
“What’s the difference between symmetric and asymmetric encryption?”
Symmetric uses one shared key and is fast (for example AES); asymmetric uses a public and private key pair (for example RSA or elliptic curve) and solves key exchange and signatures. TLS uses both: asymmetric to agree on keys, symmetric for the data.
“What’s the difference between hashing and encryption?”
Encryption is reversible with a key; hashing is one-way. Store passwords with a slow, salted hash designed for passwords, such as bcrypt or Argon2.
“What is NIST CSF 2.0?”
NIST’s Cybersecurity Framework, updated to version 2.0 in February 2024. Its core is organized around six functions: Govern, Identify, Protect, Detect, Respond and Recover, with Govern newly added. It’s a common way to structure a security program and to talk about it with leadership.
Application security
“Explain SQL injection and how to prevent it.”
Untrusted input is executed as part of a database query. Prevent it with parameterized queries or prepared statements, input validation, least-privilege database accounts, and code review and testing.
“What’s the difference between stored and reflected XSS?”
Stored XSS saves a malicious script in the application (for example a comment) and serves it to other users; reflected XSS bounces it off a request, such as a crafted link. Prevent both with context-aware output encoding, input validation and a Content Security Policy.
“What is CSRF?”
An attacker tricks a logged-in user’s browser into sending an unwanted request. Defend with anti-CSRF tokens, SameSite cookies and checking the origin.
Identity, network and cloud
- “What is least privilege?” Give users and systems only the access they need, for as long as they need it, and review it regularly.
- “How does multi-factor authentication help, and what are its weaknesses?” It stops most password-only attacks, but phishing can still capture one-time codes; phishing-resistant methods such as passkeys or security keys are stronger.
- “How would you secure a cloud account?” Strong identity controls and MFA, no long-lived keys where avoidable, least-privilege roles, logging enabled everywhere, guardrails against public storage, encryption, and continuous configuration monitoring.
- “What’s zero trust?” Don’t trust based on network location; verify every request based on identity, device and context. See our security architect interview questions.
Detection and incident response
“Walk me through how you’d respond to an incident.”
Prepare, detect and analyze, contain, eradicate, recover, then hold a blameless review and fix the root cause. Communicate throughout with the right people, and preserve evidence.
“You find an access key committed to a public repository. What do you do?”
Sample answer: “Treat it as compromised. I’d revoke or rotate the key immediately, then check the cloud logs for any use of it since it was exposed. If there was suspicious activity, I’d open an incident and scope what was accessed. Then I’d remove it from the repository history, and prevent a repeat with secret scanning in the CI pipeline and pre-commit hooks. When this happened on my team, the key had been public for 40 minutes with no use; we rotated it in five and added secret scanning that week.”
“How do you reduce alert fatigue?”
Tune noisy rules, prioritize alerts by severity and asset value, automate enrichment and routine responses, and measure true-positive rates.
Vulnerability management and threat modeling
- “How do you prioritize vulnerabilities?” By exploitability, exposure and the asset’s importance, not only the severity score, with remediation timelines agreed with owners.
- “How do you threat model a new feature?” Map the data flows and trust boundaries, list threats (for example with STRIDE), rate them, and agree on mitigations with the engineers.
Security consultant interviews
Consultants are asked the same technical questions, plus client-facing ones:
- “How do you run a risk assessment for a client?” Understand the business and critical assets, review controls against a framework such as NIST CSF, identify gaps, rate risks, and present prioritized, realistic recommendations.
- “How do you deliver bad news to a client?” Lead with the business impact, back it with evidence, and bring a clear plan.
- “A client wants to accept a risk you think is serious.” Document the risk and your recommendation, make sure the right person accepts it in writing, and suggest compensating controls.
Behavioral questions
- Tell me about a time you pushed back on an engineering team. See handling conflict.
- Tell me about an incident you handled. See solving a complex problem.
- How do you keep up with threats? Name sources and what you’ve changed because of them.
See also our penetration tester and site reliability engineer interview guides.
Frequently asked questions
What questions are asked in a security engineer interview?
What are the NIST CSF 2.0 functions?
How do I answer an incident response question?
How is a security consultant interview different?
How much do security engineers earn?
Sources
- U.S. Bureau of Labor Statistics, Occupational Outlook Handbook, Information Security Analysts. Read on 1 October 2026.
- NIST, NIST Releases Version 2.0 of Landmark Cybersecurity Framework (February 2024). Read on 1 October 2026.
