The Security Fundamentals Interview Roadmap: What to Learn, in Order

Security interviews for very different roles share a surprising amount. Whether you are applying for application security, detection engineering, cloud security or AI security, the follow-up questions drift back to the same foundations. This roadmap orders them so each stage builds on the last.

Stage 1: how computers and networks work

Processes, memory, the kernel and permissions; packets, TCP, DNS, NAT and firewalls; trust boundaries and threat modelling. If you can walk a request from a laptop to a server and say what an attacker at each hop can do, you have the base for everything else.

Stage 2: trust

Hashing, encryption and signatures; how TLS authenticates servers; roots, intermediates and certificate validation; mutual TLS and VPN cryptography; authentication, sessions, OAuth and passkeys; keys and secrets. Most security controls are built from these pieces.

Stage 3: platforms

How Linux, Windows and Active Directory, macOS, Android and iOS enforce privilege, isolation, signing and boot integrity, and how containers and virtual machines differ. Interviews love "what if the device is rooted?" and "are containers secure?" here.

Stage 4: applications, data and cloud

Injection, XSS, access control, SSRF, deserialisation, sessions and business logic; database security; cloud identity and storage; Kubernetes; the software supply chain.

Stage 5: how attacks work

Where vulnerabilities come from, how a bug becomes an exploit conceptually, how malware persists and calls home, how penetration tests run, and how attackers move from one foothold to domain control. This is where you learn to think in chains.

Stage 6: AI systems and their attacks

How LLM applications, retrieval and agents work, and how prompt injection, data exfiltration, memory poisoning, model extraction and poisoning attack them. Essential for AI security roles and increasingly asked elsewhere.

Stage 7: defend, respond, lead

Detection engineering, incident response and forensics, vulnerability prioritisation, governance and regulation, and the stakeholder skills that turn findings into decisions.

How to practise

For each essential question, answer it, then change one constraint and answer again. What if the bootloader is locked? What if signing is required? What if the attacker controls the device? Interviews are mostly made of these follow-ups, and answering from the mechanism is what makes you sound experienced.

Why order matters

Security topics depend on each other more than course catalogues suggest. Certificate pinning makes little sense without certificate validation, which makes little sense without understanding what an attacker on the network can do. Container escapes make little sense without knowing that the kernel makes every privilege decision. Prompt injection is easier to reason about once you have seen classic injection and authorisation failures. Learning out of order produces answers that recite facts but collapse when the interviewer changes one detail.

Following the stages also makes revision efficient. When you meet a new topic, you can usually place it in one stage and connect it to what came before, which is what experienced engineers do when they meet unfamiliar systems at work. Interviewers notice that habit quickly, because it turns an unfamiliar question into a familiar one asked from a new angle.

Where to start

The learning journey lists every question and lesson in this order with essentials marked and prerequisites shown. The Security Fundamentals course walks stages one to five in seven lessons, and its first two lessons are free.