SOC Analyst interview questions and practice.
Works in a security operations centre triaging alerts, investigating incidents and responding to threats in real time.
No card for the taster. Full interviews are paid one at a time. Nothing renews.
Last reviewed
This page is still being written: no authored question bank for this competency family. The role is fully supported in the interview itself; only the published question bank is outstanding.
What interviewers for SOC Analyst actually ask
The question bank for this role is still being written. These are the first three competencies in the model the interview is scored against.
Identifies realistic threats to a system, assesses likelihood and impact, and prioritises controls by risk rather than by checklist or headline.
Finds and fixes vulnerabilities in architecture and code (authentication, authorisation, injection, secrets, crypto misuse) and helps developers avoid them.
Detects intrusions from logs and telemetry, contains and eradicates them methodically, preserves evidence, and communicates clearly during an incident.
What they are really assessing
Interviewers rarely score whether you seemed nice. They score against a model like this one, usually without telling you it exists. Each competency has a weak, adequate and strong shape, and the difference is almost always the level of specific detail you volunteer without being asked.
Threat modelling & risk-based prioritisation
Identifies realistic threats to a system, assesses likelihood and impact, and prioritises controls by risk rather than by checklist or headline.
- Weak
- Security is a list of tools or controls; cannot describe a threat model for a real system, who the attackers are, or why one finding was prioritised over another.
- Adequate
- Has run a threat modelling session (STRIDE or similar) on a real system and ranked findings by likelihood and impact, but the model was one-off and not tied to design changes.
- Strong
- Walks through a real threat model: assets, attackers, entry points, the top risks with reasoning, the controls chosen versus rejected on cost, and how the model was kept current as the system changed.
Secure design & code review
Finds and fixes vulnerabilities in architecture and code (authentication, authorisation, injection, secrets, crypto misuse) and helps developers avoid them.
- Weak
- Knows the OWASP Top 10 by name but cannot explain a vulnerability they found in real code, how it was exploitable, or the fix beyond 'sanitise input'.
- Adequate
- Has found real issues in reviews (IDOR, injection, weak session handling) and worked with developers on fixes, but cannot describe systemic fixes such as safe libraries or linting rules.
- Strong
- Gives a specific vulnerability found with its exploit path and blast radius, the fix, and the systemic change (framework defaults, SAST rule, secure library) that removed the class of bug across teams.
Detection & incident response
Detects intrusions from logs and telemetry, contains and eradicates them methodically, preserves evidence, and communicates clearly during an incident.
- Weak
- Incident stories are vague ('we had a phishing incident and reset passwords'); no timeline, containment reasoning, evidence handling or lessons learned.
- Adequate
- Describes an incident with detection source, containment steps and root cause, but cannot say how they scoped the blast radius, what evidence was preserved, or what detection was added afterwards.
- Strong
- Gives a specific incident with timeline, how blast radius was established, containment trade-offs (e.g. isolate now vs observe), evidence preservation, stakeholder updates, and the new detections and controls that followed.
Vulnerability & attack-surface management
Keeps the organisation's attack surface known and patched: asset inventory, scanning, prioritisation by exploitability, and driving remediation across teams.
- Weak
- Vulnerability management is running a scanner and emailing the report; cannot describe the asset inventory, how findings are prioritised, or remediation rates.
- Adequate
- Prioritises using CVSS plus exposure and drives remediation with SLAs, but inventory is incomplete and remediation rates are not tracked or reported.
- Strong
- Describes building or fixing an inventory, prioritising with exploitability and exposure (not just CVSS), measured remediation SLAs with numbers before and after, and how they handled a team that would not patch.
Identity, access & cloud security
Designs and operates authentication, authorisation and cloud controls that enforce least privilege without stopping people from doing their jobs.
- Weak
- Access is granted on request and rarely reviewed; cannot explain OAuth/OIDC flows, IAM policy evaluation, or a privilege escalation they prevented.
- Adequate
- Has implemented SSO, MFA and role-based access, and reviewed IAM policies, but cannot describe measuring over-privilege or handling break-glass access.
- Strong
- Describes reducing over-privileged access with measured results, designing break-glass and access review processes, and a cloud misconfiguration they found (public bucket, wildcard policy) and prevented systemically.
Influencing without blocking
Gets engineering and business teams to adopt secure practices by making the secure path easy and framing risk in their terms, rather than by saying no.
- Weak
- Describes security as enforcing rules; developers are 'the problem'; cannot give an example of changing behaviour without mandate.
- Adequate
- Runs training and reviews, and has persuaded a team to fix something, but relies on escalation when there is pushback.
- Strong
- Gives an example of a paved road (secure template, library, pipeline check) that teams adopted voluntarily with adoption numbers, and a case where they reframed a security risk in business terms to change a decision.
Compliance, privacy & governance
Maps controls to regulatory and contractual requirements (POPIA, GDPR, PCI DSS, ISO 27001) so that compliance evidence comes from real security work, not paperwork.
- Weak
- Compliance is filling in questionnaires; cannot explain what POPIA or PCI DSS actually requires of the systems they worked on or how evidence was produced.
- Adequate
- Has mapped controls to a framework and supported an audit, but evidence gathering was manual and controls were designed for the audit rather than the risk.
- Strong
- Describes designing controls that satisfied both risk and audit, automating evidence collection, handling a personal data breach notification, and pushing back on a compliance demand that added no security.
Judgement under pressure & honest disclosure
Makes sound calls when a breach, disclosure or executive demand creates pressure, and tells the truth about security posture even when it is unwelcome.
- Weak
- Cannot describe a difficult disclosure decision; downplays incidents or defers entirely to leadership; no example of delivering an unwelcome finding.
- Adequate
- Has reported a serious finding upward honestly and handled a researcher disclosure, but struggled to influence the response and cannot say what they would do differently.
- Strong
- Gives a specific case of telling leadership or a customer something they did not want to hear (breach scope, failed control), how they framed it, the decision it led to, and how they managed the pressure to minimise.
Reading the questions is the easy half. Try answering three of them out loud, to someone who follows up.
Try 5 minutes freeWhat your 30 minutes covers
The same shape as a real first-round interview, pitched at mid-level SOC Analyst and scored throughout.
Warm-up, then Motivation & fit
Build rapport, settle nerves, and get a short walk-through of your background. Why this role, why this employer, and what you are actually looking for.
Your experience
Two or three real situations from your CV in depth: context, what you did, what happened, what you would change.
Pitched at mid-level scope: owns a security domain for a product or environment (appsec for a team, cloud security, detection engineering); accountable for its findings and remediation.
Role-specific questions
The core competencies and domain knowledge for the role, with follow-ups on anything vague.
Drawn from this role's domain: threat modelling a new feature or system with STRIDE or attack trees, finding and fixing injection, IDOR and authentication flaws in code review and investigating a suspected compromise from logs and establishing blast radius, and the rest of the competency model.
Your questions, then Wrap-up
Your questions for the interviewer, and yes, they are assessed. Next steps and a clean finish.
What changes with seniority
The questions barely change between levels. What changes is the answer they will accept.
| Junior | Mid | Senior | |
|---|---|---|---|
| Scope of ownership | Owns defined tasks: alert triage, vulnerability tickets, code review findings, control checks, with review of conclusions. | Owns a security domain for a product or environment (appsec for a team, cloud security, detection engineering); accountable for its findings and remediation. | Owns security architecture and standards across multiple teams or the whole platform; accountable for major incidents and the security roadmap in their area. |
| Tolerance for ambiguity | Handles routine cases and escalates unclear or high-impact findings promptly. | Turns a vague risk concern into a threat model and a prioritised plan; makes judgement calls on severity independently. | Defines security strategy from business risk; makes control and tooling decisions with incomplete information and owns them. |
| People leadership | None formally. | Mentors juniors, reviews others' findings, may lead an incident. | Technical lead for security engineers, runs design reviews, mentors, leads major incident response. |
| Who they deal with | Own team, developers or admins fixing findings. | Engineering teams, DevOps, product managers, compliance, external testers. | Engineering leadership, CISO, legal and privacy, auditors, vendors, regulators where relevant. |
What your report would say
Every competency above scored from your own answers, the sentence that cost you quoted back, and your weakest answers rewritten the way a strong SOC Analyst would have said them.
- Gives a specific incident with timeline, how blast radius was established, containment trade-offs (e.g. isolate now vs observe), evidence preservation, stakeholder updates, and the new detections and controls that followed.
The format, not a result. Scores on your report come from what you actually said.
Is the AI interviewer realistic? See a full sample report