Cyber Security Interview Preparation Guide

Cyber security employers report more applicants than ever and less trust in CVs, so the interview, and especially the technical part, now decides most hiring outcomes. UK employers told DSIT in 2026 about AI-generated CVs, candidates overclaiming skills and applicants failing technical interviews, while some small firms received more than a thousand CVs for one post. This guide covers what interviewers are actually assessing for the main role families, the technical and behavioural skills to prepare, how to research the role and build evidence, how to talk about certifications, and how to handle offers and progression conversations. It is written for people preparing for a first security job, practitioners moving between specialisms and hiring managers who want to run fairer interviews. Role-by-role career routes are in the Cybersecurity Careers Guide.

Key takeaways

Interviewers test reasoning, not recall. They want to hear how you work through an unfamiliar log, design or risk, what you would check next and where your knowledge stops.
Evidence beats claims. Write-ups, lab repositories, detections, policies or assessments you produced are the strongest answer to "how do you know?" and the best defence against overclaiming doubts.
Prepare for the specific role family. A SOC, GRC, engineering or offensive interview each has a different technical core; generic preparation wastes time.
Behavioural questions carry real weight. ISC2's 2025 study found hiring managers rank problem solving (29%) and collaboration (24%) among the most important non-technical skills.
Say "I do not know" well. Admitting a gap, then explaining how you would find out, scores better than a confident wrong answer in almost every security interview.

What the role does

Before preparing, pin down which role you are interviewing for, because the technical core differs. The NICE Framework (components v2.2.0, April 2025) defines 42 work roles across categories such as Oversight and Governance, Design and Development, Implementation and Operation, Protection and Defense, and Investigation. Reading the work role that matches the advert, for example PD-WRL-001 Defensive Cybersecurity or OG-WRL-017 Cybersecurity Supply Chain Risk Management, gives you the task and knowledge statements interviewers draw on.

Role family	What interviewers usually test	Typical exercise	Career guide
SOC and detection	Log reading, Windows events, networking, triage reasoning, ATT&CK mapping	Walk through a phishing or suspicious sign-in alert; read a log extract	SOC Analyst Career Guide
Threat hunting and IR	Hypothesis building, query fluency, timelines, containment decisions	Live query or a scenario-based incident walk-through	Threat Hunter Career Guide
Security engineering	Design trade-offs, protocols, cloud IAM, hardening, automation	Whiteboard a secure design or review a configuration	Network Security Engineer Career Guide
Application and DevSecOps	Code review, vulnerability classes, pipeline security, secrets	Review a code snippet or a pipeline definition for flaws	DevSecOps Engineer Career Guide
GRC, risk and audit	Frameworks, risk statements, evidence evaluation, stakeholder handling	Assess a supplier or control from a short evidence pack	Third-Party Risk Analyst Career Guide
Offensive security	Methodology, scoping and rules of engagement, reporting quality	Explain how you would scope an engagement and report a finding	Red Teamer Career Guide
Management	People leadership, incident command, metrics, budget	Discuss a major incident you led or a team problem you solved	Security Operations Manager Career Guide

How a typical process runs

Screening call: motivation, salary expectations, right to work, notice period, a few basic technical questions.
Technical interview or exercise: scenario questions, a live exercise or a take-home task.
Behavioural or competency interview: past situations, teamwork, handling pressure and mistakes.
Final or panel: hiring manager and stakeholders; culture, judgement and questions you ask them.
Checks: references, and in some sectors background or security vetting, which can take weeks.

DSIT reports employers using skills-led interviews, blind CVs and adapted tests for neurodivergent applicants. If you need adjustments, ask for them early; it is a normal request.

Core skills and tools

Technical preparation

Area	Questions you should be able to answer	How to prepare
Networking	What happens when you browse to a website; TCP handshake; DNS resolution; what TLS protects and what it does not	Explain each aloud from memory, then check against a packet capture
Identity	Authentication versus authorisation; how MFA can still be bypassed; what OAuth tokens and service accounts are and why they are targeted	See the Zero Trust Identity Guide
Operating systems	Key Windows logon events (4624, 4625, 4688); Linux permissions and auth logs; persistence locations	Generate the events in a lab VM
Attacks and defences	Phishing to ransomware kill chain; credential theft; how you would detect and contain each step	Map one public incident to ATT&CK techniques and controls
Cloud	Shared responsibility; IAM policy basics; why public storage buckets and long-lived keys cause breaches	Build and review a free-tier account
Risk and frameworks	Inherent versus residual risk; NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover); what ISO/IEC 27001 certification does and does not prove	Write a risk statement for a real scenario
Scripting	Read and explain a short Python or PowerShell script; automate a simple task	Automate one part of your own lab work

Live exercises: narrate your thinking. Say what you are looking for, what you found, what it means and what you would check next. If you get stuck, state your assumption and carry on. Interviewers mark the method; few expect a perfect answer.

Behavioural preparation

ISC2's 2025 Cybersecurity Workforce Study (16,029 respondents) found hiring managers' most sought non-technical skills included problem solving (29%), collaboration (24%), willingness to learn (20%) and strategic thinking (16%). Prepare six to eight short stories using a simple structure: situation, what you did, the result, and what you learnt.

A problem you solved: a technical issue you investigated to root cause.
A mistake: what went wrong, how you reported it and what changed.
Disagreement: pushing back on a risky request without damaging the relationship.
Explaining to a non-specialist: turning a finding into a business decision.
Pressure: an incident, outage or deadline and how you prioritised.
Learning fast: a tool or topic you picked up quickly, with evidence.

Questions to ask them

What does success look like in the first six months?
How is on-call or shift work organised, and how often does it recur?
What training budget and certification support is there?
Who would I escalate to during an incident, and what authority does the team have?
What is the biggest security problem the team is working on now?

Routes into the role

Interview preparation starts before the application. DSIT's Cyber security skills in the UK labour market 2026 found that in 2025 only 16% of core cyber postings were open to people with under a year's experience, 64% asked for two to six years, and 77% asked for a degree or equivalent, although 65% of firms that had recruited since 2024 had hired through non-degree routes. That gap is why evidence matters.

Decode the advert: list the five core requirements, match each to an example or artefact, and note gaps you will address honestly.
Research the organisation: sector regulation, recent public incidents in that sector, the tools named in the advert, and the team structure.
Build a small evidence pack: two or three write-ups, a repository or sample work relevant to the role, kept free of employer or client data.
Rehearse aloud: technical explanations and behavioural stories, ideally with someone who works in the field.
Prepare the logistics: test video and audio, have a notepad, and know your notice period and salary range.

Career changers should frame previous experience in security terms: audit, fraud, policing, development or IT support all bring transferable habits. See the Career Change into Cyber Security Guide.

Honesty about AI use: employers told DSIT they are seeing AI-generated CVs and candidates who overclaim. Use AI tools to practise if you like, but make sure every line on your CV is something you can explain in depth under questioning. If a take-home task allows AI assistance, say how you used it and how you checked its output.

Certifications that help

Certifications help at screening and give structure to study, but interviewers probe whether you can apply the knowledge. Be ready for "you hold X: how would you use it here?" The table is descriptive, not a ranking; check each body's current requirements.

Stage	Common certifications	How interviewers treat them
Entry	ISC2 CC, CompTIA Security+, CompTIA Network+	Shows baseline vocabulary; expect fundamentals questions that go beyond the syllabus
Operations	CompTIA CySA+, GIAC GCIH, GCIA	Expect live log or traffic analysis to confirm practical skill
Engineering and cloud	Cloud provider security certifications, CKS, GIAC GCSA	Expect design and configuration questions on that platform
GRC and audit	ISACA CISA, CRISC, CISM	Expect scenario questions on evidence, risk and frameworks
Senior and management	ISC2 CISSP, CISM, GIAC GCIL	Treated as breadth; leadership examples matter more

For exam detail see the CISSP Certification Guide and CRISC Certification Guide. If you are studying for one, say so and say when you expect to sit it; that shows direction.

Progression

Interviews do not stop after the first job: internal moves, promotions and specialist transfers all involve them. ISC2's 2025 study reported hiring freezes at 39% of respondents' organisations and promotion freezes at 34%, so expect competition for internal moves too.

Move	What changes in the interview	Prepare
Junior to mid-level	Depth on investigations or projects you owned	Two detailed case studies with your decisions explained
Specialist switch (for example SOC to cloud)	Proof you have started the new specialism	Lab work and a certification in progress in the target area
Individual contributor to lead	Coaching, prioritisation, stakeholder handling	Examples of mentoring and influencing without authority
Manager to head of function	Strategy, budget, board communication	A short written view of the function's next 12 months. See the Path to CISO Career Guide

Offers and pay

Know the market before you talk numbers. DSIT reports a mean advertised salary of £60,800 (median £58,050) across UK core cyber roles in 2025, with London at £70,200, but 76% of postings gave no salary and entry roles are typically well below the mean. In the US, the Bureau of Labor Statistics reports a median of $129,180 (May 2025) for information security analysts. DSIT also notes some candidates have unrealistic expectations at entry level. Compare total package: shift allowances, on-call pay, training budget, certification funding and flexible working.

For hiring managers: fairer interviews

Score against the job: agree the five to seven competencies and a scoring guide before interviews start.
Use realistic exercises: a log extract, a design or an evidence pack from your own work, sanitised, rather than trivia.
Keep tasks bounded: take-home exercises of a few hours at most, with clear rules on tools and AI use.
Offer adjustments: DSIT reports employers adapting tests for neurodivergent applicants and using blind CVs.
Measure the process: time to hire, offer acceptance rate, and the share of hires still in post and performing at 12 months.

Common failure patterns

Memorising answers: reciting a definition of the CIA triad, then failing to apply it to a scenario.
Overclaiming: listing tools you have only seen in a video; interviewers probe until it shows.
Silent thinking: working through a live exercise without narrating, so the interviewer cannot credit your method.
No questions for them: signals low interest and misses the chance to learn about rota, training and authority.
Sharing confidential material: using a previous employer's real logs, reports or client names as portfolio evidence.

Practitioner checklist

Identify the role family and read the matching NICE work role and three current adverts.
Map every core requirement in the advert to an example or artefact.
Rehearse aloud: what happens when you browse to a website, an alert triage, and a risk statement.
Prepare six to eight behavioural stories with results and lessons.
Build a small, sanitised evidence pack of write-ups or sample work.
Make sure you can explain every tool, certification and claim on your CV in depth.
Prepare five questions about the team, rota, training and authority.
Research the salary range and total package before the screening call.
After each interview, write down the questions you found hard and study them.

Cyber Security Interview Preparation Guide: How to Prepare and Perform