Cybersec Analyst Interview question

[CS1983]

Question: Anyone ever seen anything like this? Know potentially what to expect?

Background:

I have an in-person interview coming up for a Cybersec Analyst position out of state at a major company in a specific industry sector, in a geographical area heavy with industry presence. Already passed the phone interview, which was extremely low on technical questions. When I asked him if he had any further questions based on my resume or the job requirements, he said he either asked them or I answered them without him having to ask (I suppose that could be good?). He further stated he will be moving me forward to an in-person interview and HR will coordinate the flight, etc.

The manager said their in-person interview is as follows:

Technical Lab: Windows workstation, basic troubleshooting and fact finding. This is pass/fail. If failed, interview terminates immediately.

Lunch: Get to know the team/they get to know me

Incident Response-based panel interview:. This is not pass/fail per se, but more of "how do you think and react?" scenario gaming.

-----

I asked him if the technical portion would be getting into stuff like PowerShell or anything super sysadmin-ish. He stated no, it would be just basic troubleshooting and it shouldn't be hard if I've done that level of work in the past.

Job requirements are fairly standard for such a position: AD knowledge, incident response, technical handling of security incidents, file permissions, knowledge of Linux and Windows OS, etc.

He stated there are two other candidates.

[68Charger]

Not that specific, but security was definitely part of the process.

My advise: study any specific systems or technologies in the job posting... but otherwise, just relax and be yourself... If you're qualified, just be confident that you are. (But don't be a cocky jerk)

I used this technique on my first interview in >20 years... and I have an offer letter pending.

I just wasn't stressed, and looked at the whole 3- interview process as a way to get to know each other, not as a test. As it turned out, I liked what I saw and so did they.

And, Good luck!

[ChickNorris]

Well, as an example, let's say you said you know Python.
Now imagine your potential boss googled 'What should a python expert know?'
Be prepared to answer what google told him to ask.

No joke.

[68Charger]

Well, as an example, let's say you said you know Python.
Now imagine your potential boss googled 'What should a python expert know?'
Be prepared to answer what google told him to ask.

No joke.

Funny, python came up in my in-person interview... I told the truth- I've never written Code in Python, but I've had to step thru troubleshooting when it was failing... and if I need to, I'll learn it.... that's what I do, tackle the issues in front of me- relentlessly.

And I can recall specific instances where I've done that.

[ChickNorris]

@ the meet & greet remember you're interviewing them as well.
Ask them a question that encourage them to talk about themselves & then another few to expand on the subject.

& I've always respected the honest answer of 'I dont know... but I know how to find out'.

[CS1983]

My main thing is just wondering if anyone has ever seen that sort of tech interview process before, and if so, what I should expect. I could understand for a pen testing role or something, but this is just a cyber analyst role. Nothing ninja about it.

[ChickNorris]

You're right. You know all this periphery.

Still, I think if they're flying you out, you're good.

Besides, its an analyst role, not an over analyst. ;-)

[ChadAmberg]

The one question I got "wrong" in my last series of interviews was for cloud security engineering. The question was "If you're having a DDOS attack against your web server, what do you do?" I discussed the various ways to prevent the attack at the network layer, etc. The "correct" answer they were looking for was "Go wide, bring up more and more and more servers all behind a load balancer."

Now, I get what he was asking for. There are problems with that as the only answer, as you would still most likely have a single back end that would be crushed in that situation. But the job was for AWS, and they can charge more for each server you bring online...

[BPTactical]

You get the technical aspect correct then the next part is just feeling you out as an individual.
They want to know how you would fit in to the team.
Nothing more, nothing less.

[Justin]

Now, I get what he was asking for. There are problems with that as the only answer, as you would still most likely have a single back end that would be crushed in that situation. But the job was for AWS, and they can charge more for each server you bring online...

Noted for future reference.

That's not terribly encouraging.