Security Engineering & Operations Topics
Operational security practices, secure systems implementation, threat modeling, penetration testing, vulnerability assessment, and security operations at production scale. Covers network security, endpoint security, secure architecture implementation, incident response mechanics, and security automation. Distinct from Security & Compliance (which addresses governance, compliance frameworks, and policy) and from Security Research & Innovation (which addresses novel techniques and research contributions).
Software Composition Analysis (SCA) & Supply Chain Security
Understand how to identify and manage third-party dependencies and open-source components. Know tools and techniques for detecting vulnerable dependencies, managing license compliance, and responding to supply chain attacks. Discuss how to evaluate third-party security, conduct security reviews of dependencies, and maintain a software bill of materials (SBOM).
Process Improvement and Organizational Impact
Identify, drive, and measure improvements to team processes, tooling, and workflows that increase efficiency, repeatability, and strategic value of the work being done. Candidates should discuss building or adopting reusable tools and automation, integrating improvements into existing development or operational workflows, streamlining handoffs between teams or stages, and measuring the impact of these changes on productivity, quality, and organizational maturity. Include concrete examples of how a process change reduced cycle time, improved output quality, influenced how other teams or stakeholders worked, and created measurable organizational benefits.
Authentication and Authorization
Cover core concepts and implementation trade offs for securing backend services. Candidates should demonstrate understanding of token based authentication and server side session strategies, how to securely issue and rotate credentials, techniques for revocation and refresh, secure storage of secrets, use of third party identity providers, common threat mitigations such as cross site request forgery protection and secure transmission practices, and design patterns for role based and attribute based access control. Interviewers will evaluate the candidate ability to reason about scalability and revocation trade offs and to design secure application programming interface permission checks.
Security Testing Fundamentals
Fundamental practices for identifying and mitigating security vulnerabilities in software. Candidates should understand common failure modes described by the Open Web Application Security Project Top Ten and related risks such as injection attacks including structured query language injection, cross site scripting, broken authentication and authorization, insecure direct object references, and security misconfiguration. Coverage includes secure coding patterns such as input validation, output encoding, parameterized queries, secure session handling, least privilege, and secret management. Testing approaches include manual exploratory security testing, threat modeling, dynamic security scanning, static analysis, dependency and composition analysis, fuzz testing, and targeted penetration testing. Candidates should also be able to explain how to integrate security checks into automated test suites and continuous integration pipelines and how to prioritize security fixes by impact and exploitability.
OWASP Top Ten and CWE Top Twenty Five
Comprehensive knowledge of the Open Web Application Security Project Top Ten categories and the Common Weakness Enumeration Top Twenty Five weaknesses, focused on identification, exploitation mechanisms, root causes, business impact, and prevention. Candidates should understand each vulnerability class in depth, including injection, broken authentication and authorization, cross site scripting, cross site request forgery, security misconfiguration, insecure design, vulnerable and outdated components, cryptographic and data integrity failures, logging and monitoring gaps, server side request forgery, and related common weakness patterns. Assessment covers how to find these issues in source code and running applications, how attacks are constructed, secure coding fixes and remediation, threat modeling and secure design choices to prevent them, use of static and dynamic analysis and dependency scanning tools, vulnerability prioritization and patching strategies, and runtime detection and monitoring practices. Candidates should be able to explain concrete code examples, demonstrate fixes, and map specific code patterns to CWE entries when relevant.
Authentication and Access Control
Comprehensive coverage of methods, protocols, design principles, and practical mechanisms for proving identity and enforcing permissions across systems. Authentication topics include credential based methods such as passwords and secure password storage, Multi Factor Authentication, one time passwords, certificate based and passwordless authentication, biometric options, federated identity and single sign on using Open Authorization, OpenID Connect and Security Assertion Markup Language, and service identity approaches such as Kerberos and mutual Transport Layer Security. Covers token based and session based patterns including JSON Web Token and session cookies, secure cookie practices, token lifecycle and refresh strategies, token revocation approaches, refresh token design, and secure storage and transport of credentials and tokens. Authorization and access control topics include role based access control, attribute based access control, discretionary and mandatory access control, access control lists and policy based access control, Open Authorization scopes and permission modeling, privilege management and the principle of least privilege, and defenses against privilege escalation and broken access control. The description also addresses cryptographic foundations that underlie identity systems including symmetric and asymmetric cryptography, public key infrastructure and certificate lifecycle management, secure key management and rotation, and encryption in transit and at rest. Common threats and mitigations are covered, such as credential stuffing, brute force attacks, replay attacks, session fixation, cross site request forgery, broken authentication logic, rate limiting, account lockout strategies, secrets management, secure transport, and careful authorization checks. Candidates should be able to design authentication and authorization flows for both user and service identities, evaluate protocol and implementation trade offs, specify secure lifecycle and storage strategies for credentials and tokens, and propose mitigations for common failures and attacks.
Production Incident Management
Production/service incident response: how an on-call engineer detects, triages, and resolves outages or reliability degradation. Covers detection via monitoring metrics, logs, and distributed traces; mitigation via rollbacks, circuit breakers, feature flags, or network ACLs; incident communication and stakeholder updates; root-cause analysis; and blameless postmortems. No adversary, no malware, no legal evidence chain: the concern is system failure and reliability, not intrusion or malicious activity.
Secure Coding and Application Security
Covers the principles and practices for building and maintaining secure software throughout the secure software development lifecycle. Topics include secure coding patterns, common vulnerabilities and mitigations such as injection, cross site scripting, insecure deserialization, broken authentication and authorization, improper error handling, and insecure configuration. Includes threat modeling, secrets management, dependency and supply chain hygiene, vulnerability and patch management, and principles of least privilege and defense in depth. Covers code level controls such as input validation and output encoding, use of vetted libraries, avoiding dangerous custom cryptography, and guarding against side channel and timing attacks. Also covers security activities and tools including code review best practices, static application security testing, dynamic application security testing, interactive application security testing, dependency scanning, and how to integrate security testing and gates into continuous integration and continuous delivery pipelines to improve application security maturity.
Attack Vectors and Threat Landscape
Comprehensive knowledge of cyberattack types, common attack vectors, and the evolving threat landscape across human, application, network, and supply chain layers. Candidates should be able to explain how each attack class operates, typical entry points and vulnerable assets, and real world examples. Core topics include phishing and social engineering; malware families such as ransomware and rootkits; denial of service and distributed denial of service attacks; man in the middle attacks; injection attacks including structured query language injection; cross site scripting; cross site request forgery; broken authentication and session management; insecure direct object references and other entries from the Open Web Application Security Project Top Ten; privilege escalation; brute force attacks; zero day exploits; insider threats; insecure configuration; insecure deserialization; and supply chain attacks. For each class candidates should cover indicators of compromise and detection signals, logging and monitoring strategies, behavioral analysis and anomaly detection methods, and threat hunting approaches. Candidates should also discuss prevention and mitigation controls such as secure coding practices, input validation and parameterized queries, output encoding and content security policy, secure authentication and session management, access controls and network segmentation, rate limiting and traffic filtering, secure configuration and patch management, backup and recovery, and supply chain risk management. They should be able to map these controls to incident response activities including containment, eradication, recovery, and post incident remediation, and demonstrate how to use threat modeling to prioritize defenses based on asset criticality and likely attack paths. Finally, candidates should be prepared to describe trends in the threat landscape, high profile breaches and lessons learned, the difference between active and passive attacks, and how threats and defensive priorities vary by industry and organizational scale.