Fifteen common SOC analyst interview questions
- What does a SOC analyst do day to day?
- How do you triage an alert?
- What is a SIEM, and how have you used one?
- True positive, false positive, false negative — examples?
- Walk me through investigating a reported phishing email.
- An account logged in from two countries an hour apart. What do you check?
- What are indicators of compromise?
- Explain the stages of incident response.
- What is MITRE ATT&CK, and how is it used?
- Common ports and the services on them?
- What does lateral movement look like in logs?
- How do you detect brute-force attempts?
- What is the difference between IDS and IPS?
- How do you write an escalation for tier 2?
- How do you stay current on threats?
Alert triage
A good triage process: read the alert and the rule that fired, gather context (user, host, asset criticality, recent activity), check related events before and after, compare against known benign patterns, decide true or false positive, and either close with notes or escalate with evidence. Consistency matters as much as speed; tuning noisy rules after repeated false positives is part of the job.
Common investigations
| Scenario | What to check |
|---|---|
| Phishing report | Headers and sender, links and attachments in a sandbox, who else received it, who clicked, credential resets |
| Impossible travel login | VPN or proxy use, device and user agent, MFA result, subsequent activity |
| Brute force | Failed logins by source and account, any success after failures, lockouts |
| Unusual outbound traffic | Destination reputation, volume, process responsible, timing |
| Malware alert | Process tree, file hash reputation, persistence, network connections, isolate host |
Incident response
- Preparation: playbooks, tools and access in place before incidents.
- Identification: confirm an incident and its scope.
- Containment: isolate hosts, disable accounts, block indicators.
- Eradication: remove the cause — malware, persistence, vulnerabilities.
- Recovery: restore systems and monitor for recurrence.
- Lessons learned: document and improve detections and processes.
Fundamentals and frameworks
Know common ports — 22 SSH, 25 SMTP, 53 DNS, 80 and 443 HTTP and HTTPS, 3389 RDP, 445 SMB — and what normal traffic looks like. Indicators of compromise include malicious IPs, domains, file hashes and unusual registry or process activity. MITRE ATT&CK catalogues adversary tactics and techniques, used to map detections and spot coverage gaps. An IDS detects and alerts; an IPS sits inline and can block. Windows event logs for log-ons, process creation and privilege use come up often. See computer networks interview questions.
Escalations and communication
Write escalations that let the next analyst act immediately: summary, affected users and hosts, timeline, evidence, what you've done, and recommended next steps. Clear, factual notes are a core skill; interviewers sometimes ask you to write one.
Breaking into a SOC role
Entry-level SOC hiring values demonstrable hands-on practice. Home labs with a free SIEM, log sources from a few virtual machines and simulated attacks give you real examples to discuss. Capture-the-flag and blue-team challenge platforms build investigation skills. Foundational security certifications help pass screens. In the interview, walking through one investigation you did in a lab — the alert, your queries, your conclusion — is far more convincing than listing tools.
Expect questions about shift work and handling repetitive alerts calmly, too; SOC teams value consistency and clear notes at the end of every shift.
Practising
Answer these out loud, in two minutes or less each, and expect a follow-up on every claim. A free AI interview assistant such as CoPilot Interview can run security operations questions as a mock interview built from your résumé and score each answer. Rehearse the phishing investigation end to end — it's the most common scenario question. See also security engineer interview questions.
Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.
Frequently asked questions
What questions are asked in a SOC analyst interview?
Alert triage, SIEM use, true and false positives, phishing investigation, suspicious logins, indicators of compromise, incident response stages, MITRE ATT&CK, common ports, IDS versus IPS and writing escalations.
What are the stages of incident response?
Preparation, identification, containment, eradication, recovery and lessons learned.
How do you investigate a phishing email?
Examine headers and sender, analyse links and attachments safely, find other recipients and anyone who clicked, reset affected credentials, block indicators and document the findings.
What is MITRE ATT&CK?
A knowledge base of adversary tactics and techniques observed in real attacks, used to design detections, map coverage and structure investigations.
Practise on real interview questions
Run 145 real interview questions across 10 tracks, answer out loud and see a structured answer to compare with yours. Free, no signup.
Try a practice question