Which security role you are interviewing for
| Specialty | Loop centres on |
|---|---|
| Application security | Code review, threat modelling, the OWASP categories |
| Detection and response | Log analysis, incident handling, detection engineering |
| Cloud security | IAM, network boundaries, misconfiguration at scale |
| Product security | Secure design review, working with engineering teams |
| Offensive / pentest | Exploitation methodology, reporting, scoping |
Application security
- Explain SQL injection and the actual fix. Parameterised queries - and why input sanitisation alone is the wrong answer.
- XSS types, and why output encoding is context-dependent.
- What is CSRF, and why do SameSite cookies change the picture?
- SSRF - why it is dangerous in a cloud environment specifically, and what the metadata endpoint has to do with it.
- How do you store passwords? Expect follow-ups on the algorithm, salting and work factors.
- Authentication versus authorisation, with a broken-access-control example.
The threat modelling exercise
"Here is a system. What could go wrong?" Structure beats a list of attacks:
- Draw the trust boundaries. Where does data cross from less trusted to more trusted? That is where most findings live.
- Enumerate by category rather than brainstorming - spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.
- Consider the insider and the supply chain, not just the external attacker.
- Rank by realistic impact and likelihood. This is the part that gets scored.
- Propose proportionate mitigations, and say which risks you would accept. Being willing to accept a risk explicitly is a senior signal.
Cloud and infrastructure
- How would you find over-permissioned IAM roles across hundreds of accounts?
- A storage bucket is public. Walk through response, root cause and prevention.
- How do you manage secrets, and how would you handle a leaked credential in git history?
- What does defence in depth look like for a service exposed to the internet?
- How do you do security review at a pace engineering will tolerate? A judgement question, and the honest answer involves automation and risk-based triage rather than reviewing everything.
Detection and response
- What makes a good detection rule? Expect: high signal, low false positive rate, and an owner.
- Walk through responding to a suspected compromised host - containment before investigation.
- What logs do you need, and what is usually missing when you need it most?
- How do you reduce alert fatigue?
- Explain the difference between an indicator and a behaviour, and why behaviours age better.
Where CoPilot Interview fits
Disclosure: we build an interview assistant, so treat this as a disclosed pitch. CoPilot Interview is a native Windows and macOS app that puts suggested answers on your own screen in about two seconds, across coding, system design and behavioral rounds, with a permanent free tier that needs no credit card.
There is a role page at security interview help, and the infrastructure overlap is in DevOps interview questions.
Frequently asked questions
What questions are asked in a security engineer interview?
It depends on the specialty. Application security loops centre on vulnerability classes and threat modelling, detection and response loops on log analysis and incident handling, and cloud security loops on IAM, boundaries and misconfiguration. Ask the recruiter which it is, because preparation differs substantially.
How do you answer a threat modelling question?
Draw the trust boundaries first, since most findings sit where data crosses from less trusted to more trusted. Enumerate by category rather than brainstorming attacks, include insider and supply chain risks, rank by realistic impact and likelihood, and say which risks you would accept.
What is the right answer to 'how do you prevent SQL injection'?
Parameterised queries or prepared statements. Input sanitisation alone is the weak answer interviewers are listening for, since it fails on edge cases and is easy to apply inconsistently. Mentioning least-privilege database accounts as defence in depth strengthens it.
How technical are security engineer interviews?
Substantially. Most loops include code review or hands-on analysis, and cloud roles expect working knowledge of IAM and network controls. The judgement questions - what to fix first, what risk to accept - are what separate senior candidates.
Walk into the round with a second pair of eyes
CoPilot Interview is a native Windows and macOS app that puts suggested answers on your own screen in about two seconds, across coding, system design and behavioral rounds. The free tier is permanent: 15 minutes a day, no credit card.
Try it free