Cybersecurity Analyst Interview Questions

1.1The CIA triad - confidentiality, integrity, and availability as the foundation of security

1.2Threat landscape - who attacks organisations, why, and what they are trying to achieve

1.3Security frameworks - NIST CSF, ISO 27001, CIS Controls, and how they guide security programmes

1.4The cybersecurity analyst role - SOC work, vulnerability management, and where it fits in security operations

2.1Network security fundamentals - firewalls, IDS/IPS, segmentation, and defence-in-depth

2.2Packet analysis - reading network traffic, identifying anomalies, and using capture tools

2.3DNS, HTTP, and application layer traffic - what normal looks like and how attackers abuse each protocol

2.4Network attack techniques - port scanning, man-in-the-middle, and lateral movement across a network

3.1SIEM fundamentals - log collection, correlation rules, and how alerts are generated and managed

3.2Log analysis - reading Windows event logs, Linux syslogs, and application logs for security signals

3.3Alert triage - the analyst workflow from alert to investigation to close or escalate

3.4Threat hunting - proactively searching for evidence of compromise rather than waiting for alerts

4.1Incident response lifecycle - preparation, detection, containment, eradication, recovery, and lessons learned

4.2First responder actions - preserving evidence, containing spread, and initiating the IR process

4.3Digital forensics basics - disk imaging, memory forensics, timeline reconstruction, and chain of custody

4.4Post-incident activities - root cause analysis, stakeholder communication, and improving defences

5.1Vulnerability scanning - tools, scope, frequency, and getting accurate results

5.2CVSS scoring - how vulnerabilities are rated and how to prioritise remediation in the real world

5.3Patch management - the vulnerability-to-patch lifecycle and managing the gap between disclosure and fix

5.4Penetration testing - the difference between a pentest and a vulnerability scan, and how to work with testers

6.1Identity management - Active Directory, LDAP, SSO, and how identity underpins security

6.2Privileged access management - protecting admin accounts, just-in-time access, and credential vaulting

6.3Multi-factor authentication - methods, bypass techniques, and making MFA actually increase security

6.4Zero trust access - verifying every request, device posture, and modern identity-based security

7.1Cyber threat intelligence - strategic, tactical, and operational intelligence and how analysts use it

7.2MITRE ATT&CK - the framework, its tactics and techniques, and using it for detection and response

7.3Malware analysis basics - static analysis, dynamic analysis, and understanding what a sample does

7.4Indicators of compromise - hashes, IPs, domains, and building detection rules from threat intelligence

8.1Cloud security fundamentals - the shared responsibility model and what the customer must secure

8.2Endpoint detection and response - EDR tools, telemetry, and hunting for threats on endpoints

8.3Container and serverless security - the attack surface, vulnerabilities, and how to monitor them

8.4Cloud attack techniques - credential theft, misconfiguration exploitation, and lateral movement in cloud

9.1Regulatory frameworks - GDPR, PCI-DSS, HIPAA, and what they require of security teams

9.2Risk management - identifying, assessing, and treating security risks in a business context

9.3Security policies and standards - what analysts must know and how they guide daily decisions

9.4Communicating security risk to business stakeholders - speaking the language of risk rather than technical jargon

10.1Technical questions - network security, incident response, SIEM, and vulnerability management

10.2Scenario questions - walk me through how you would respond to a phishing incident or a ransomware alert

10.3Certification and knowledge questions - demonstrating current knowledge of the security landscape

10.4Salary negotiation for security roles, evaluating a SOC environment, and questions that reveal the real security maturity of an organisation