Security interviews blend conceptual (CIA, OWASP) and scenario ("How would you store passwords?" "What if S3 bucket is public?").
Prepare stories
- Fixed XSS or SQLi in review
- Responded to leaked API key
- Designed MFA rollout or RBAC model
Answer structure
Threat → impact → controls → monitoring → trade-offs. Mention least privilege and logging.
Important interview questions and answers
- Q: How store passwords?
A: Slow hash + salt + pepper optional; never plaintext. - Q: Public S3?
A: Block Public Access, audit ACLs, enable logging, rotate exposed data plan.
Self-check
- Name two story types to prepare.
- Password storage interview answer?
Tip: Practice 60s answers: password storage, HTTPS, IDOR, incident steps.
Interview prep
- Store passwords?
Slow salted hash (Argon2/bcrypt)—never plaintext.