soc

Three words every SOC uses and many candidates blur. The answer that scores defines each by what it obliges you to do, and names the decision that turns an alert into an incident.

The process tree tells most of the story in five minutes. Interviewers want an order of questions, the evidence for each, and a clear point at which you contain rather than keep looking.

Anyone can write a query that matches an attack. The interview is about everything else: the data source you trust, the benign activity that looks the same, how you proved it fires, and what the analyst does when it does.

Detections are production code that pages people. Treating them that way means version control, tests that prove they fire, review, staged rollout and metrics that decide which ones live.

A green heatmap is the easiest thing in security to fake. Interviewers want ATT&CK used to plan and test, with coverage that means 'proven to fire on the variants we expect', not 'a rule exists'.

Analysts closing ten thousand alerts a week will miss the one that matters. The fix is not more analysts; it is fewer, better alerts and automation for the rest, measured by outcomes rather than throughput.

A hunt is a testable hypothesis about an attacker your detections missed. Without one, it is just browsing logs. The output that justifies it is usually a new detection, not a captured attacker.

Trace field origin through telemetry, summaries and response proposals. Preserve evidence, verify current targets and playbooks, and test both missed threats and harmful containment.

Design investigation, response policy and execution with distinct authority. Build an action matrix, handle failed dependencies and tenant boundaries, and evaluate useful work alongside missed incidents and wrongful containment.

Preserve the source and limits of each signal, verify model claims and bind response actions to exact targets. A passing authentication result does not prove benign mail.