Cybersec Analyst Interview question

Question: Anyone ever seen anything like this? Know potentially what to expect?

Background:

I have an in-person interview coming up for a Cybersec Analyst position out of state at a major company in a specific industry sector, in a geographical area heavy with industry presence. Already passed the phone interview, which was extremely low on technical questions. When I asked him if he had any further questions based on my resume or the job requirements, he said he either asked them or I answered them without him having to ask (I suppose that could be good?). He further stated he will be moving me forward to an in-person interview and HR will coordinate the flight, etc.

The manager said their in-person interview is as follows:

Technical Lab: Windows workstation, basic troubleshooting and fact finding. This is pass/fail. If failed, interview terminates immediately.

Lunch: Get to know the team/they get to know me

Incident Response-based panel interview:. This is not pass/fail per se, but more of "how do you think and react?" scenario gaming.

-----

I asked him if the technical portion would be getting into stuff like PowerShell or anything super sysadmin-ish. He stated no, it would be just basic troubleshooting and it shouldn't be hard if I've done that level of work in the past.

Job requirements are fairly standard for such a position: AD knowledge, incident response, technical handling of security incidents, file permissions, knowledge of Linux and Windows OS, etc.

He stated there are two other candidates.

Not that specific, but security was definitely part of the process.

My advise: study any specific systems or technologies in the job posting... but otherwise, just relax and be yourself... If you're qualified, just be confident that you are. (But don't be a cocky jerk)

I used this technique on my first interview in >20 years... and I have an offer letter pending.

I just wasn't stressed, and looked at the whole 3- interview process as a way to get to know each other, not as a test. As it turned out, I liked what I saw and so did they.

And, Good luck!

Well, as an example, let's say you said you know Python.
Now imagine your potential boss googled 'What should a python expert know?'
Be prepared to answer what google told him to ask.

No joke.

Quote:

---

Originally Posted by ChickNorris

Well, as an example, let's say you said you know Python.
Now imagine your potential boss googled 'What should a python expert know?'
Be prepared to answer what google told him to ask.

No joke.

---

Funny, python came up in my in-person interview... I told the truth- I've never written Code in Python, but I've had to step thru troubleshooting when it was failing... and if I need to, I'll learn it.... that's what I do, tackle the issues in front of me- relentlessly.

And I can recall specific instances where I've done that.

@ the meet & greet remember you're interviewing them as well.
Ask them a question that encourage them to talk about themselves & then another few to expand on the subject.

& I've always respected the honest answer of 'I dont know... but I know how to find out'.

My main thing is just wondering if anyone has ever seen that sort of tech interview process before, and if so, what I should expect. I could understand for a pen testing role or something, but this is just a cyber analyst role. Nothing ninja about it.

You're right. You know all this periphery.

Still, I think if they're flying you out, you're good.

Besides, its an analyst role, not an over analyst. ;-)

The one question I got "wrong" in my last series of interviews was for cloud security engineering. The question was "If you're having a DDOS attack against your web server, what do you do?" I discussed the various ways to prevent the attack at the network layer, etc. The "correct" answer they were looking for was "Go wide, bring up more and more and more servers all behind a load balancer."

Now, I get what he was asking for. There are problems with that as the only answer, as you would still most likely have a single back end that would be crushed in that situation. But the job was for AWS, and they can charge more for each server you bring online...

You get the technical aspect correct then the next part is just feeling you out as an individual.
They want to know how you would fit in to the team.
Nothing more, nothing less.

Quote:

---

Now, I get what he was asking for. There are problems with that as the only answer, as you would still most likely have a single back end that would be crushed in that situation. But the job was for AWS, and they can charge more for each server you bring online...

---

Noted for future reference.

That's not terribly encouraging.

Quote:

---

Originally Posted by BPTactical

You get the technical aspect correct then the next part is just feeling you out as an individual.
They want to know how you would fit in to the team.
Nothing more, nothing less.

---

I fully understand all that.

My question, again, is: "Anyone ever seen anything like this? Know potentially what to expect?"

I've never had a technical interview which involved *doing* something. Most technical interviews are rank and file memorization BS that don't really prove anything.

I like the cut of this manager's jib, as his method is sensible and keeps them from wasting time on people lacking demonstrable skills. I just have no idea what to really expect and was wondering if anyone had gone through something similar.

I bet it really is basic troubleshooting. You would be shocked how many people I work with cannot do basic step by step troubleshooting. They immediately jump to the conclusions.

Never had an interview like this, wish my team would do something like this.

Good luck on your interview.

How was the interview?

Have you ever had sex with a Russian robot?

-John

Quote:

---

Originally Posted by iego

Have you ever had sex with a Russian robot?

-John

---

Yes, but I was coerced.

Quote:

---

Originally Posted by whitewalrus

How was the interview?

---

Next week.

Only practicums I've encountered in job interviews were when interviewing with the technical team leads, and I've been asked to whiteboard pseudo-code solutions, or briefly diagram data structure layouts. I had one hiring manager quiz me on my OpenGL fundamentals, while another asked me highly technical C/C++ and compiler switch knowledge, and outlining my experience with cross compilers and system-adaptive makefiles. Only other was when I was starting out and the hiring manager quizzed me on my specific unix/linux knowledge, network layout and configuration and general troubleshooting steps.

I guess there was also that one time when I had to log in to a testing service and take an hour-long automated programming test for a possible position at FedEx.

I have absolutely no advice to offer you. But I can offer you my best wishes for success. If this is what you want I sincerely hope it happens for you. Good luck!

Quote:

---

Originally Posted by CavSct1983

My question, again, is: "Anyone ever seen anything like this? Know potentially what to expect?"

---

Sorry I missed this earlier, but yes - have run that exact gauntlet before (and from both sides of the table).

For the skills testing, most of the time it is indeed just a bunch of wtf-level rudimentary questions, but when you start getting beyond that there's a world of possibilities from super simple to crazy advanced...Anything from being given snippets of malware code and being asked to describe what it's doing, to performing configuration, discovery, IR/break-fix, or even remote system compromise/capture-the-flag tasks on the fly.

One thing I started doing about 15 years ago was building fully-functional test environments for skills verification with my hires (initial use case was for hiring NOC/SOC analysts) which where basically clones of multi-tiered infrastructure environments in a virtual stack - I'd usually break something simple (relative to skill level of candidate/requirements), then sit the candidate down on a terminal, give the basic scenario, and ask them to fix/investigate within a given amount of time. They would have the room to themselves (to reduce pressure), but I'd be in another office shadowing their desktop session. Sometimes these went very well, other times it was all I could do to keep a straight face while thanking them for coming in...

As for the IR, just treat it like any other TT excercise, and should be fairly easy if you've done any work in that area...

Also, recommend being honest about skill level. It's entirely possible that there will be questions/scenarios which are intentionally far beyond your current skills, presented both as a "litmus" test to see where you sit on the skills continuum, but also as a "canary" test to see if you're likely to go totally off the deep end trying to fix something but in reality just making it worse or even completely trashing the system/environment by accident...

Good luck, and feel free to pm me if you want any help prepping or gaming out your approach ahead of time...

Quote:

---

Originally Posted by DireWolf

Sorry I missed this earlier, but yes - have run that exact gauntlet before (and from both sides of the table).

For the skills testing, most of the time it is indeed just a bunch of wtf-level rudimentary questions, but when you start getting beyond that there's a world of possibilities from super simple to crazy advanced...Anything from being given snippets of malware code and being asked to describe what it's doing, to performing configuration, discovery, IR/break-fix, or even remote system compromise/capture-the-flag tasks on the fly.

One thing I started doing about 15 years ago was building fully-functional test environments for skills verification with my hires (initial use case was for hiring NOC/SOC analysts) which where basically clones of multi-tiered infrastructure environments in a virtual stack - I'd usually break something simple (relative to skill level of candidate/requirements), then sit the candidate down on a terminal, give the basic scenario, and ask them to fix/investigate within a given amount of time. They would have the room to themselves (to reduce pressure), but I'd be in another office shadowing their desktop session. Sometimes these went very well, other times it was all I could do to keep a straight face while thanking them for coming in...

As for the IR, just treat it like any other TT excercise, and should be fairly easy if you've done any work in that area...

Also, recommend being honest about skill level. It's entirely possible that there will be questions/scenarios which are intentionally far beyond your current skills, presented both as a "litmus" test to see where you sit on the skills continuum, but also as a "canary" test to see if you're likely to go totally off the deep end trying to fix something but in reality just making it worse or even completely trashing the system/environment by accident...

Good luck, and feel free to pm me if you want any help prepping or gaming out your approach ahead of time...

---

Excellent intel, sir. Thank you.

PM inbound.

Now in an enviable (?) predicament: I have two companies out there that want an in-person interview.

2nd company seems to be trying to piggyback on 1st company flying me out. They would have me meet with the manager, Director of IT Infrastructure and VP of IT all in one go. This may be them trying to condense the process so they don't have to fly me out again, or it could indicate that I'm a strong candidate to potentially waste a Director and VP's time. I suppose it depends on unknown factors.

Problem is twofold:

1) I have no idea when the actual interview process for company 1 will be over that day, so:

2) I have no idea if it would allow me to get over to company 2, complete the interview with enough time to get to the airport, and come home
a) If I cancel or otherwise change my return flight (If I even can, the company might have to do that), it could look untoward to Company 1 -- particularly if they get charged for a change
b) I feel like Company 2 needs some skin in the game if they really want to interview me in person

Solution to problem 2: Since my Company 1 interview is later in the morning (before lunch, but not by much), I could see if Company 2 could schedule the interview in the earlier part of the morning. That presents a risk, though, that I'd possibly be late to Company 1 interview depending on factors out of my control (traffic, interview runs over, etc.). Counterpoint: Companies 1 and 2 are only ~9 miles apart. But I dunno what traffic might be like that time of the morning. Certainly not Denver levels, but always a potential for risk.

Weird predicament and problem set given the time constraints.

Quote:

---

Originally Posted by CavSct1983

Now in an enviable (?) predicament: I have two companies out there that want an in-person interview.
2nd company seems to be trying to piggyback on 1st company flying me out. They would have me meet with the manager, Director of IT Infrastructure and VP of IT all in one go. This may be them trying to condense the process so they don't have to fly me out again, or it could indicate that I'm a strong candidate to potentially waste a Director and VP's time. I suppose it depends on unknown factors.

---

You can change your ticket. Out-of-pocket expenses related to the changes can be paid by you without being charged back to Co. 1.

Co. 1 will be able to see the changes to your ticket based on the PNR if they go look them up after the fact, though.

Explain to Co. 2 they can meet your return schedule or reimbruse you the costs to change your return ticket (including putting you up overnight if necessary). If they can't or won't, that's probitive to your understanding of how much they really want to interview with you. There's always videoconferencing or a return interview trip if they're actually serious and things don't work out to piggyback your interview on your current trip.

Completed interview. Surprisingly they had the behavioral portion first, which seemed backwards since the technical interview was pass/fail. Seems like they wouldn't want to waste their time if someone wasn't up to technical snuff.

Anyway, behavioral was easy. I wasn't nervous at all. Was 3 managers: cyber, physical/SOC, and infrastructure.

Lunch was nice.

Tech interview was interesting. Won't go into too much detail on that as it obviously would be different depending on where one was applying, etc.

I will say it encompassed all 7 layers of the OSI model and layer 8 is always the hardest to troubleshoot (ha!). It was much more in the realm of Desktop Support troubleshooting, which I haven't done in a while.

I don't know yet if I passed or failed the tech portion, and thus if I passed the interview. But what I will say is, despite its stressful nature, I liked that method MUCH more than the typical BS tech interview questions. Being able to see and click and think through something was much more realistic and indicative of skill sets than being asked random factoids.

Regardless of if I get the position or not, wherever I end up I plan to recommend and develop a similar technical interview process if possible; it was just that good. It was probably the most fun interview I've been on in a while.

Today is a skype call with company 2. Just wasn't able to make getting over to them work in conjunction with the tight flight schedule yesterday.

Quote:

---

Originally Posted by whitewalrus

I bet it really is basic troubleshooting. You would be shocked how many people I work with cannot do basic step by step troubleshooting. They immediately jump to the conclusions.

Never had an interview like this, wish my team would do something like this.

Good luck on your interview.

---

I think this is true with all trades
I got sent out to work with an apprentice on a job him and a journeyman (20+ years in the trade) had been working 2 days on. A lot of changed parts and phone calls. We fixed it in 15 mins with 0 parts needed. Someone was pulling on wires and must have pulled on off a relay and got it out back on the connection next to where it needed to be. The apprentice was in awe that it was that simple and fast. I told him it?s koting special I looked at the diagram and tested for power from one connection to the next and when I got to where it dropped, bingo no wire there but the wire I needed was on an under contact. Moral of the story start at step 1 and go though step by step. There is no level of experience that outweighs proper trouble shooting procedures. (Also is the first 5 of the same part don?t fix it, the next 5 won?t either)


Good look sounds like it went good

Won't hear from Company 1 til Friday at least, but I did the video conf interview with Company 2 yesterday (previously had a phone interview). The interview w/ Company 2 was with the team manager, VP of IT and Director of Infrastructure. Went really well. Well enough, in fact, that this morning I had an offer letter with no pay cut and a $10k moving budget. I'm 99.9% sure I'll accept. It's an offer beyond what I'd thought I'd get, by far. I was willing to move for 65k and no moving assistance. Instead, I'm effectively getting a raise due to cost of living decrease and the fact that we will pay off the van when we sell the house. I doubt that Company 1 would meet the same standards for Company 2's offers, based on Glassdoor salary numbers.

I asked the manager to have a call with me this afternoon to talk with me about his vision for the team, how I can shift and shape my own studying and personal home lab towards being a value add for the team, etc.

Unless something insane comes up in the meeting, I'll be moving out of state NLT end of July.

Based on all this, I'll be on 10+ acres and shooting at home within 2 months. Insane. Dream come true if everything continues to work out.

: )

I have accepted the offer of Company 2.

I'll be an Oklahoman come late July.

Many thanks especially to DireWolf for spending a few hours on the phone with me and offering to continue to provide guidance as I move into this role.

In less than 4 years, I have gone from my first IT job on a service desk to being a NOC team lead, and now a Cybersecurity Analyst. Been a wild ride. I'm excited. Going to be a complete fire hose of an experience -- just the way I like it.

Congratulations!

Quote:

---

Originally Posted by CavSct1983

I have accepted the offer of Company 2.

I'll be an Oklahoman come late July.

Many thanks especially to DireWolf for spending a few hours on the phone with me and offering to continue to provide guidance as I move into this role.

In less than 4 years, I have gone from my first IT job on a service desk to being a NOC team lead, and now a Cybersecurity Analyst. Been a wild ride. I'm excited. Going to be a complete fire hose of an experience -- just the way I like it.

---

Congratulations! Good luck on your move and new job. May have to pick your brain in the future if you wouldn?t mind. Here soon I will be trying to get into the Cybersecurity field.

Quote:

---

Originally Posted by whitewalrus

Congratulations! Good luck on your move and new job. May have to pick your brain in the future if you wouldn?t mind. Here soon I will be trying to get into the Cybersecurity field.

---

*coughs* Western Governors University *coughs*

Might save you some $.

Quote:

---

Originally Posted by OxArt

*coughs* Western Governors University *coughs*

Might save you some $.

---

I did WGU. Was a pretty good experience. Very cost effective solution for what was basically the same quality of education I got at a brick and mortar school.

Quote:

---

Originally Posted by OxArt

*coughs* Western Governors University *coughs*

Might save you some $.

---

About to start my last term of my MSCIA.

Congrats!
Once in a while, just once in a while the chips fall in your favor.