JPMorgan Chase AI Security Engineer interview questions

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.

Five minutes, no jargon, one decision. Candidates who explain how attention works have already lost the room.

STRIDE assumes components follow their code. A model follows its inputs. The scored answer keeps the six categories and adds what probabilistic, persuadable components need.

Every senior security engineer has one. The scored answer shows you reduced the risk, made the residual visible, got the right owner to accept it, and kept watching.

A leadership question. The scored answer finds out what exists, fixes the highest-impact exposures, and builds the few shared controls that make every later project cheaper.

Good metrics change decisions. The scored answer picks a few in coverage, risk, outcomes and speed, defines each precisely, and explains what action each one triggers.

A judgement question with an ethical edge. The scored answer makes the risk clear in business terms, offers options, accepts a properly informed decision, and knows the rare cases where it is not enough.

A checklist recital scores 'weak'. The strong answer orders controls by the attacker they stop, treats the baseline as code, and explains how you would notice when someone drifts from it.

Kernel exploits make headlines; misconfigured services, impersonation and stored credentials do the work. The scored answer groups escalation into classes and attaches a control and a detection to each.

Interviewers ask for the protocol first because every AD attack is a protocol property used against you. The strong answer derives each attack from a step in the ticket flow, then attaches the control that breaks it.

You cannot stop every laptop being compromised. You can decide what that laptop holds. The strong answer is about which credentials live where, and making stolen ones useless elsewhere.

A bypass screenshot is not a finding. Interviewers look for whether you can separate 'I changed my own copy of the program' from 'I can now do something the server should have stopped'.

A single check is a single patch. The design question is how to make removing protection expensive, detectable at scale, and pointless because the server holds the real decisions.

NTLM proves you can answer a challenge. It never proves which server you meant to answer, so whoever sits in the middle can pass your answer to a server you never chose.

Once an attacker is admin on one machine, the credentials cached there decide whether they stop at one machine or reach the domain. Every control in this answer is about that step.

Flat networks turn one infected laptop into a company-wide incident. The scored answer draws zones from what talks to what, and shows how identity-based policy replaces IP lists as the network grows.

Inspection is a man in the middle the organisation chose. Interviewers want the mechanism, then a clear view of the new single point of failure it creates and the traffic it must never touch.

Pinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.

SPF checks a server, DKIM checks a signature, and neither checks the From line the user reads. DMARC ties them to that line. Interviewers want the alignment idea, then the phishing that still gets through.

Both keep keys out of application memory; they differ in who you must trust and what you can prove. The scored answer chooses by threat model and requirement, not by fashion.

Data encrypted today can be recorded and decrypted when a capable quantum computer exists. The scored answer prioritises by how long data must stay secret, starts with key exchange, and builds crypto agility.

The response differs sharply between a signing key and an encryption key. The scored answer contains use, rotates, revokes trust, assesses what the attacker could forge or read, and repairs what depended on it.

An HSM's promise is narrow and strong: the key cannot leave in plaintext. Everything else, including who may ask the HSM to use the key, is your design.

Two enterprise workhorses with very different designs. The scored answer explains each flow, where the trust lives, and the attacks that follow from it.

A bearer token works for whoever holds it. The scored answer explains how binding a token to a key changes that, the two standard ways to do it, and the cost.

A confirmation click proves someone was present; step-up proves it was the user, recently. The scored answer decides which actions need it and wires it through tokens so the agent cannot fake it.

Liveness checks were built to catch a photo held up to a camera. Deepfakes often never go near the camera at all.

Phishing-resistant MFA is only as strong as the process that replaces it when someone loses their phone. Attackers have noticed, and so do interviewers.

Model a bounded reservation workflow, run an offline invariant fixture, and reason about retries, contention, immutable intent and uncertain external outcomes.

Every check passed and every write succeeded. The money still left twice, because the check and the write were two steps and another request got between them.

Both platforms sandbox apps and require signing; they differ in who decides what runs and how fast fixes arrive. Interviewers want the shared model first, then the differences that change a threat model.

The sandbox is a Linux user ID, SELinux and a signature that decides who you are. Get those three right and most Android security questions become reasoning rather than recall.

A standard is a checklist only if you use it badly. The answer interviewers want maps the app's data and threats onto MASVS areas, then picks which MASTG tests are worth the time.

'Use the Keychain' is half an answer. Interviewers check whether you know the key never leaves the hardware, the data it protects still does, and which settings stop it riding along in a backup.

Every exported component is an API that any app on the phone can call. The vulnerabilities are the same ones you know from web APIs: missing authorization, trusted input, and a confused deputy.

Any app can claim myapp://. That single fact breaks OAuth redirects, password-reset links and payment flows that trust a custom scheme. The fix is a link the operating system verifies against your domain.

A WebView puts a browser inside your app, without the browser's address bar, and often with a bridge to native code. XSS in that page is no longer 'just XSS'.

The token is safely in the Keychain, and also in the crash log, the analytics payload and the app-switcher screenshot. Interviewers want the list of side doors, not the front door again.

The device is in the attacker's hand in half the scenarios. A strong model sorts threats by where the attacker sits, then puts every decision that moves money behind a check the phone cannot fake.

Pinning narrows trust, and every outage story about it is a rotation story. The scored answer decides whether to pin at all, pins public keys with backups, and plans for the release that can never update.

Two different questions hide here: does the app validate TLS at all, and does it pin? Testers who merge them either miss the critical bug or report a non-issue as one.

Detection that runs on the attacker's device reports whatever the attacker allows it to. Interviewers want to hear what it is still good for, and what it must never decide alone.

Attestation gives your server a signed statement it did not have to trust the client for. The design question is what that statement covers, how you bind it to a request, and what you do when it is missing.

Anything in the app binary belongs to whoever downloads it. The strong answer stops trying to hide a client secret and builds on user tokens, PKCE, device-bound keys and server-side limits.

Unzip, decompile, read the manifest, then watch it run. The interview checks whether you know where the interesting parts of an app hide, and that obfuscation changes your effort, not your conclusions.

Moving a secret into C changes who can find it in an afternoon, not whether it can be found. The scored answer shows how an analyst would recover it, then replaces the design with one that does not need a shared secret.

No shield is unbreakable, so 'can it be bypassed' is the wrong test. Measure how much it raises an attacker's cost on the threats you actually face, and what it costs you in crashes, performance and false positives.

Pinning protects the user from the network. It was never going to protect your API from the person holding the phone, and the good answer explains both halves.

Both platforms let an app declare its transport rules in a file the reviewer can read in seconds. Knowing which lines are dangerous makes you fast in a mobile review.

A key the app cannot export is only half the story. The other half is making the key usable only after the user is really present, which a hooked 'authentication succeeded' callback can fake.

Your app can be fully patched on a phone whose kernel is two years old. The answer separates what you control, what the platform controls, and what you can only measure.

Sending prompts to a provider is a data flow like any other. The scored answer keeps it on private paths where possible, forces all model traffic through one controlled exit, and blocks everything else.

An SBOM lists libraries. An AI-BOM has to answer a harder question: which base model and which data is this behaviour descended from?

A vendor breach becomes yours through the access you gave them. The scored answer inventories that access, rotates and revokes it, looks for misuse, and works out what data was exposed.

Supply chain risk spans what you consume, how you build and what you ship. The scored answer sequences the work by risk reduced per effort and covers models and datasets as dependencies too.

Encryption is the last stage of a ransomware attack, not the first. The strong answer contains spread fast, protects backups and identity systems, and knows that recovery depends on choices made months earlier.

The group change is one event; the question is the chain behind it. The strong answer treats tier 0 as compromised until proven otherwise and works backwards from who made the change and with what credentials.

Resetting the password is step four, not step one. Attackers keep access through sessions, app consents and mailbox rules, and the money moves faster than the investigation.

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

The Arup case cost about US$25 million because everyone on the call looked and sounded right. The control that works does not involve spotting the fake at all.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.

Importing hashes and IP addresses from a report feels productive and changes almost nothing. The answer climbs from indicators to behaviours and ends with a test that proves the change.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

LLM observability quietly becomes the largest copy of customer data in the company. The scored answer minimises what is captured, separates what must be kept, and treats trace stores as production data.

When people act on wrong output, the harm is real even though nothing was hacked. The scored answer names the concrete failures and designs the product so verification is easy and required where it matters.

A gateway turns dozens of ad hoc model integrations into one place to enforce and observe. The scored answer chooses what belongs centrally and what must stay in each application.

Banning tools people find useful mostly moves the leak somewhere you cannot see. The scored answer offers an approved route, then adds policy, technical controls and visibility around it.

Regulated data turns every copy the AI pipeline makes into an audit question. The scored answer keeps the regulated data out of the model where possible and brings each remaining copy under the regime.

The regulator does not care which classifier you used. The design that scores puts authorisation and commitments in code, uses classifiers where they are good, and decides in advance what happens when a streamed answer goes wrong halfway.

One agent is a design review. Four hundred agents is an operations problem: who owns each, what it can touch, how much it can spend, and how you stop one, a class or all of them in minutes.

Fraudsters are the original adaptive adversaries. The scored answer attacks with realistic, feasible changes, probes the whole decision system rather than the model alone, and measures dollars, not just accuracy.

A framework, a certifiable standard and a law. They overlap heavily and substitute for each other not at all.

Tiers are decided by use, not by model. And for high-risk providers, Article 15 makes AI security a legal requirement.

Naming Govern, Map, Measure and Manage takes five seconds. Saying what each one produces in your organisation is the answer.

You cannot govern what you have not listed. The register is the list; the routing is what makes it worth keeping.

Banning AI tools moves usage to personal accounts. The answer that works gives people a sanctioned path that is easier than the shadow one.

A policy that says 'AI systems shall be secure' changes nothing. A release gate that blocks deployment until the red-team regression suite passes changes everything.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

A policy saying humans review decisions proves nothing. The scored answer specifies the logs, metrics and tests that show reviewers can and do change outcomes.

When everyone owns AI risk, nobody does. The scored answer puts one accountable owner on each decision and makes the specialist teams responsible for the work they are best at.

AI vendors add questions a standard security questionnaire never asked. The scored answer covers training use, retention, subprocessors, model changes and incident terms, and verifies rather than trusts.

Regulatory reporting has to plug into ordinary incident response. The scored answer knows who reports what to whom and by when, and is honest about the open question on timing.

Six months is possible for a well-run organisation with a narrow scope. The scored answer sets the scope first, reuses an existing management system, and schedules the audits backwards from the date.

Seven characteristics that frame most AI governance conversations. The scored answer names them precisely and shows how security supports, and trades off against, the others.

Fairness has several incompatible definitions, so the audit starts with a decision, not a metric. The scored answer picks measures for the context, gets the data to compute them, and audits the whole decision process.

The same model in a different context carries different obligations and harms. The scored answer names what each sector adds on top of baseline AI security.

Slides on prompt injection change little. The scored answer teaches through the developers' own code, gives them paved roads, and measures behaviour change.

The one governance answer that goes stale. The scored answer gives the timeline as amended in 2026, the fine tiers, and a process for tracking changes rather than memorised certainty.

Three frameworks, three different questions: what can go wrong in what we build, how attackers actually operate, and how the organisation manages the risk. Using one for another's job is the common mistake.

'Prompt injection' is a technique, not a risk entry. Entries that get funded describe a scenario, an asset, a consequence in business terms, an owner and a measurable treatment.

A central committee reviewing every AI feature either blocks the company or gets bypassed. The model that works centralises standards and platforms, tiers by risk, and gives teams paved roads they want to use.

There is no single 'AI incident' notification rule. The incident is usually a personal-data, contractual or sector incident that happens to involve AI, and the clock may already be running.

The first ten minutes of any design review decide its quality. This answer shows the sketch, the one question that finds most bugs, and why controls come last.

Candidates who say 'everything is new' and candidates who say 'nothing is new' both lose this one. The answer that scores names exactly three differences and keeps the rest of the toolkit.

Reciting the six letters earns little. What scores is a diagram drawn aloud, one boundary walked in depth, and a list of threats with owners.

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

Definitions take ten seconds. The interviewer wants a worked failure: which layer broke, which one held, and why they did not break together.

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

Most candidates start by deleting the commit. The key was copied the minute it went public; the clock starts with revocation.

A reset flow is a second login page with weaker checks. Interviewers use it because every step has a classic bug, and the strong answer finds them in order.