Build a realistic interview loop
Alert triage
Investigate a suspicious login, endpoint event, or network pattern by ranking hypotheses, requesting useful evidence, and separating severity from confidence.
Incident response
Contain a developing incident while preserving evidence, coordinating owners, limiting business impact, and documenting decisions.
Risk and behavioral
Explain a control recommendation, communicate risk to a non-security leader, and discuss a time you challenged an unsafe assumption.