Cybersec Analyst Interview question

[BPTactical]

You get the technical aspect correct then the next part is just feeling you out as an individual.
They want to know how you would fit in to the team.
Nothing more, nothing less.

[CS1983]

You get the technical aspect correct then the next part is just feeling you out as an individual.
They want to know how you would fit in to the team.
Nothing more, nothing less.

I fully understand all that.

My question, again, is: "Anyone ever seen anything like this? Know potentially what to expect?"

I've never had a technical interview which involved *doing* something. Most technical interviews are rank and file memorization BS that don't really prove anything.

I like the cut of this manager's jib, as his method is sensible and keeps them from wasting time on people lacking demonstrable skills. I just have no idea what to really expect and was wondering if anyone had gone through something similar.

[DireWolf]

My question, again, is: "Anyone ever seen anything like this? Know potentially what to expect?"

Sorry I missed this earlier, but yes - have run that exact gauntlet before (and from both sides of the table).

For the skills testing, most of the time it is indeed just a bunch of wtf-level rudimentary questions, but when you start getting beyond that there's a world of possibilities from super simple to crazy advanced...Anything from being given snippets of malware code and being asked to describe what it's doing, to performing configuration, discovery, IR/break-fix, or even remote system compromise/capture-the-flag tasks on the fly.

One thing I started doing about 15 years ago was building fully-functional test environments for skills verification with my hires (initial use case was for hiring NOC/SOC analysts) which where basically clones of multi-tiered infrastructure environments in a virtual stack - I'd usually break something simple (relative to skill level of candidate/requirements), then sit the candidate down on a terminal, give the basic scenario, and ask them to fix/investigate within a given amount of time. They would have the room to themselves (to reduce pressure), but I'd be in another office shadowing their desktop session. Sometimes these went very well, other times it was all I could do to keep a straight face while thanking them for coming in...

As for the IR, just treat it like any other TT excercise, and should be fairly easy if you've done any work in that area...

Also, recommend being honest about skill level. It's entirely possible that there will be questions/scenarios which are intentionally far beyond your current skills, presented both as a "litmus" test to see where you sit on the skills continuum, but also as a "canary" test to see if you're likely to go totally off the deep end trying to fix something but in reality just making it worse or even completely trashing the system/environment by accident...

Good luck, and feel free to pm me if you want any help prepping or gaming out your approach ahead of time...

[CS1983]

Sorry I missed this earlier, but yes - have run that exact gauntlet before (and from both sides of the table).

For the skills testing, most of the time it is indeed just a bunch of wtf-level rudimentary questions, but when you start getting beyond that there's a world of possibilities from super simple to crazy advanced...Anything from being given snippets of malware code and being asked to describe what it's doing, to performing configuration, discovery, IR/break-fix, or even remote system compromise/capture-the-flag tasks on the fly.

One thing I started doing about 15 years ago was building fully-functional test environments for skills verification with my hires (initial use case was for hiring NOC/SOC analysts) which where basically clones of multi-tiered infrastructure environments in a virtual stack - I'd usually break something simple (relative to skill level of candidate/requirements), then sit the candidate down on a terminal, give the basic scenario, and ask them to fix/investigate within a given amount of time. They would have the room to themselves (to reduce pressure), but I'd be in another office shadowing their desktop session. Sometimes these went very well, other times it was all I could do to keep a straight face while thanking them for coming in...

As for the IR, just treat it like any other TT excercise, and should be fairly easy if you've done any work in that area...

Also, recommend being honest about skill level. It's entirely possible that there will be questions/scenarios which are intentionally far beyond your current skills, presented both as a "litmus" test to see where you sit on the skills continuum, but also as a "canary" test to see if you're likely to go totally off the deep end trying to fix something but in reality just making it worse or even completely trashing the system/environment by accident...

Good luck, and feel free to pm me if you want any help prepping or gaming out your approach ahead of time...

Excellent intel, sir. Thank you.

PM inbound.