Home › Interview questions › Technology & IT › Cybersecurity AnalystCYBERSECURITY ANALYST INTERVIEW PREP
Cybersecurity Analyst Interview Questions (SOC) with Answer Tips
Security analyst interviews focus on how you think during an incident: triage, evidence, escalation and communication. Expect scenario questions alongside fundamentals.
Walk me through how you would investigate a suspicious login alert. What is the difference between IDS and IPS? Explain the phases of incident response. How would you respond to a phishing email reported by an employee? What is the MITRE ATT&CK framework and how do you use it? Describe a SIEM query or detection rule you have written. What is the difference between a vulnerability, a threat and a risk? Tell me about a time you had to escalate something under pressure.
1. Walk me through how you would investigate a suspicious login alert.
Why they ask: The most common SOC scenario — it shows your triage method.
How to answer:
Validate the alert: user, source IP, geo, device, time, MFA result. Correlate: other logins, impossible travel, new devices, mailbox rules, privilege changes. Decide: false positive, benign true positive, or incident — and document why. If malicious: contain (disable session, reset credentials), scope, escalate per playbook.
2. What is the difference between IDS and IPS?
Why they ask: Fundamental control knowledge.
How to answer:
IDS detects and alerts (out of band); IPS sits inline and can block. Trade-off: IPS risk of blocking legitimate traffic, so tuning matters. Mention signature vs anomaly-based detection.
3. Explain the phases of incident response.
Why they ask: Checks you follow a structured process (NIST or SANS).
How to answer:
Preparation, detection & analysis, containment, eradication, recovery, lessons learned. Give one concrete action you would take in each phase. Stress evidence preservation before eradication.
4. How would you respond to a phishing email reported by an employee?
Why they ask: Very common real-world task; shows thoroughness.
How to answer:
Analyse headers, sender, links and attachments in a sandbox. Search for the same message across all mailboxes and pull it. Check who clicked or entered credentials; reset and revoke sessions. Block indicators (domains, hashes) and thank the reporter to reinforce the behavior.
5. What is the MITRE ATT&CK framework and how do you use it?
Why they ask: Shows you can map detections to attacker behavior.
How to answer:
A knowledge base of adversary tactics and techniques. Use it to map alerts to techniques, find detection gaps and guide threat hunting. Give an example technique you have detected, e.g. credential dumping or PowerShell abuse.
6. Describe a SIEM query or detection rule you have written.
Why they ask: Hands-on skill check with Splunk, Sentinel, QRadar or similar.
How to answer:
State the threat you were detecting and the data source. Explain the logic and how you reduced false positives. Share the outcome: true positives found or noise removed.
7. What is the difference between a vulnerability, a threat and a risk?
Why they ask: Tests clear communication of core concepts.
How to answer:
Vulnerability: a weakness. Threat: something that can exploit it. Risk: likelihood × impact. Use a short example, such as an unpatched VPN appliance exposed to the internet.
8. Tell me about a time you had to escalate something under pressure.
Why they ask: Judgment and communication during incidents.
How to answer:
Context and why it was urgent. What evidence you gathered before escalating. How you communicated (who, channel, what you said). Outcome and what you would repeat or change.
More interview guides Any job title works in CareerCue — these are just a starting point. See all fields →
Mind going blank in the real interview? CareerCue works for any job in any field. It listens to the question and shows a short cue based on your resume and the role, so you can answer in your own words. Free to try, no credit card.
Try CareerCue free →
CareerCue