Cybersecurity Analyst interview questions and answers

"A user reports a suspicious email. What do you do?"

Thank the user, because reporting is exactly the behaviour you want to encourage. Examine the email safely: the sender address and domain, the headers, links and attachments, without clicking or opening anything outside a safe environment. Check whether others received the same message.

If it is malicious, block the sender and any malicious addresses or domains, remove the message from other mailboxes, and check whether anyone clicked a link or entered credentials. Reset affected passwords, look for suspicious sign-ins, and send staff a short warning if the campaign is widespread.

"You see many failed logons followed by a successful one for the same account. How do you investigate?"

Treat it as a possible compromise until proven otherwise. Check the source addresses and locations of the attempts and of the success, the timing pattern, and whether other accounts were targeted, which would suggest password spraying. Then look at what the account did after logging in: new mailbox rules, file access, privilege changes or connections to other systems.

If it looks malicious, contain the account by disabling it or forcing a password reset and revoking its sessions, then continue the investigation under the incident response procedure.

"How do you decide which alerts to investigate first?"

Prioritise by impact and confidence. Alerts involving critical systems, privileged accounts or signs of active compromise come first. Consider how reliable the detection rule is and whether other evidence supports the alert. Explain that you would tune noisy rules over time, because a flood of false positives is how real attacks get missed.

"A vulnerability scan returns hundreds of findings. How do you prioritise?"

Start with severity, but do not stop there. Consider whether the vulnerable system is exposed to the internet, whether an exploit is public or known to be used in attacks, how critical the system is, and whether other controls reduce the risk. A critical flaw on an internet-facing server outranks the same flaw on an isolated test machine. Agree deadlines with system owners and track each fix to completion.

"What would you do in the first hour of a ransomware incident?"

Contain the spread: isolate affected machines from the network without switching them off, since powering down can destroy volatile evidence. Establish the scope, meaning which systems and accounts are affected, and whether the backups are safe. Escalate immediately through the incident response plan. Preserve evidence, and never pay or negotiate on your own authority. Plan recovery from clean backups once the attacker's access has been removed.

"How would you explain a security risk to a manager who is not technical?"

Translate the technical issue into business impact: what could happen, how likely it is, and what it would cost the organisation in money, service or reputation. Offer clear options with their cost and effect, and give a recommendation. Avoid jargon and scare tactics; managers act on clear, balanced information.

"Have you ever faced an ethical dilemma in IT or security?"

Choose an honest example, such as being asked to access information without authorisation or discovering a colleague's misuse of access. Explain that you followed policy, escalated to the right person and protected confidentiality. Panels want confidence that you will not misuse the powerful access analysts are given.