Cybersecurity analyst interviews in 2026 test technical depth, incident response judgment, compliance knowledge, and increasingly AI security awareness. The typical loop includes a phone screen, technical assessment, scenario-based round, and behavioral interview. New for 2026: 87% of apps are vulnerable to prompt injection, and interviewers now ask about AI-powered threats, LLM vulnerabilities, and the OWASP LLM Top 10.
Technical fundamentals
- 'Explain the CIA triad and give a real-world example for each.' — Confidentiality (encryption at rest), Integrity (hash verification of downloads), Availability (DDoS protection). The foundation of every security discussion.
- 'What is the difference between IDS and IPS?' — IDS detects and alerts (passive). IPS detects and blocks (active, inline). IDS is like a security camera; IPS is like a security guard.
- 'Walk me through the NIST Incident Response lifecycle.' — Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity. Emphasize that lessons learned feed back into preparation.
- 'Explain the difference between symmetric and asymmetric encryption. When do you use each?' — Symmetric (AES): fast, one key, for data at rest. Asymmetric (RSA): slow, key pair, for key exchange and signatures. TLS uses both: asymmetric for handshake, symmetric for data transfer.
- 'What is DNS exfiltration and how do you detect it?' — Encoding data in DNS queries to bypass firewalls. Detect via anomalous query length, high volume of TXT record queries, or DNS traffic to unusual resolvers.
Scenario-based questions
- 'You detect an outbound data spike at 2 AM from a finance server. Walk me through your response.' — Isolate the server (contain), check what data left (scope), review access logs (attribution), preserve forensic evidence, notify incident commander, check for lateral movement.
- 'A user reports clicking a phishing link. What do you do?' — Reset credentials immediately, quarantine the endpoint, check email logs for other recipients, scan for malware, review any actions taken post-click, report to security team for IOC extraction.
- 'You see a brute-force attack followed by a successful login. Next steps?' — Lock the account, verify with the user if the login was legitimate, check for lateral movement, review what was accessed post-login, add the source IP to watchlist, check other accounts from same IP.
- 'Ransomware is detected on 3 finance endpoints. Walk me through containment.' — Disconnect affected machines from network, identify the ransomware variant, check backup integrity, determine scope of encryption, engage IR team, DO NOT pay ransom without executive and legal approval.
- 'Suspicious PowerShell execution on a non-developer workstation. Is it malicious?' — Check the command content (encoded commands are red flags), verify if the user normally runs PowerShell, check parent process (Word/Outlook launching PowerShell is suspicious), review AMSI logs, check for persistence mechanisms.
AI security questions (new for 2026)
- 'Compare prompt injection to SQL injection. How are they similar and different?' — Both exploit the mixing of data and instructions. SQL injection has mature defenses (parameterized queries). Prompt injection has no equivalent silver bullet because LLMs are instruction-following by design. 87% of AI apps are vulnerable.
- 'What is the OWASP LLM Top 10?' — Prompt Injection, Insecure Output Handling, Training Data Poisoning, Model Denial of Service, Supply Chain Vulnerabilities, Sensitive Information Disclosure, Insecure Plugin Design, Excessive Agency, Overreliance, and Model Theft.
- 'How would you red-team an AI chatbot?' — Test for jailbreaks, prompt injection, data extraction, role-playing attacks, multi-turn manipulation, and output that violates safety policies. Use both automated fuzzing and manual adversarial testing.
- 'What is the MITRE ATLAS framework?' — ATT&CK-style framework specifically for adversarial threats to AI/ML systems. Covers reconnaissance, initial access, model evasion, data poisoning, and exfiltration specific to ML pipelines.
- 'How do you secure a RAG system?' — Sanitize retrieved documents before injection, implement access controls on the knowledge base, validate that outputs don't leak source document content, monitor for adversarial queries designed to extract training data.
Compliance and frameworks
- 'Name the 5 functions of the NIST Cybersecurity Framework.' — Identify, Protect, Detect, Respond, Recover. This is asked in nearly every government and enterprise interview.
- 'SOC 2 Type I vs Type II — what is the difference?' — Type I assesses controls at a point in time. Type II assesses over a period (usually 6-12 months). Type II is more valuable because it proves sustained compliance.
- 'Walk me through ISO 27001 risk management.' — Asset identification, threat assessment, vulnerability assessment, risk calculation (impact x likelihood), risk treatment (accept, mitigate, transfer, avoid), Statement of Applicability.
- 'GDPR breach notification — what are the requirements?' — Notify supervisory authority within 72 hours of awareness. Notify affected individuals without undue delay if high risk. Document all breaches regardless of notification obligation.
- 'How would you prepare for a HIPAA audit?' — Risk analysis documentation, access controls review, encryption verification, BAA review, training records, incident response plan testing, PHI inventory.
Security tools questions
- 'Write a Splunk SPL query to investigate failed login attempts.' — index=auth sourcetype=syslog action=failure | stats count by src_ip, user | sort -count | head 20. Discuss correlation with successful logins from the same IPs.
- 'Wireshark: capture filters vs display filters?' — Capture filters (BPF syntax) reduce what is captured: 'host 10.0.0.1 and port 443'. Display filters are applied post-capture: 'http.request.method == POST'. Capture filters cannot be changed after capture starts.
- 'Explain the Metasploit workflow from reconnaissance to exploitation.' — Workspace setup, db_nmap for scanning, search for matching exploits, configure payload (reverse shell vs bind shell), set RHOSTS/LHOST, exploit, post-exploitation (hashdump, pivot).
- 'How do you use Nessus for credentialed vs uncredentialed scanning?' — Credentialed scans log into targets for deeper assessment (patch levels, configurations). Uncredentialed scans only see what is externally visible. Credentialed finds 45% more vulnerabilities on average.
- 'Describe using Burp Suite to test for OWASP Top 10.' — Proxy setup, spider/crawl, active scan for SQLi/XSS/CSRF, manual testing with Repeater for edge cases, Intruder for fuzzing authentication.
Behavioral questions
- 'How would you explain a critical vulnerability to a non-technical executive?' — Frame in business terms: what is the risk (data breach, revenue loss, regulatory fine), what is the probability, what is the cost to fix vs the cost of not fixing. Use analogies.
- 'Describe a time you handled pressure during a security incident.' — Use STAR format. Emphasize calm decision-making, prioritization, communication with stakeholders, and post-incident reflection.
- 'Tell me about a time you made a mistake in a security context.' — Show accountability, quick remediation, and process improvement. Never say 'I have never made a mistake.'
- 'How do you balance security requirements with business needs?' — Show you understand that security exists to enable the business, not block it. Risk-based approach: accept some risk where the business value justifies it.
- 'How do you stay current with the threat landscape?' — Mention specific sources: CISA alerts, Krebs on Security, threat intelligence feeds, MITRE ATT&CK updates, and security conferences (DEF CON, Black Hat).