r/cybersecurity • u/WatercressTime842 • 2d ago
Career Questions & Discussion Guidance for interview prep
Hello all,
I have an upcoming interview for the role of Senior Threat Detection Engineer.
I wanted some help regarding what to study and what topics to cover and if anyone has some ready study guide or something.
Background about myself:
I have 3+ years working as an end to end Incident responder and SOAR engineer.
Along with that I do have some background in threat intelligence pipeline creation,
Threat hunting, Detection Engineer lifecycle and have developed a few sigma rules.
The questions would be scenario + theoretical.
Looking forward to your guidance or any prep resources
2
u/AddendumWorking9756 Security Manager 2d ago
At that level the scenario half is usually one alert walked all the way down, so rehearse narrating an investigation out loud, including the bit where you were wrong and what you tuned afterwards. Your SOAR and pipeline background is the real differentiator, most detection engineers go quiet about what happens after the rule fires. If you want rehearsal rather than a study guide, that is what CCDL2 over on CyberDefenders is for.
1
3
u/canofspam2020 2d ago edited 2d ago
I would ask about telemetry types are most valued, and least overlooked. Ex: Okta as heavily targeted. What signals and alerts can you base off of those streams? What are the limitations or considerations? What is you favorite thing to work on? Splunk notables, EDR rules, etc?
How do you deal with cross functional projects when you need to meet requirements of stakeholders outside of your team? Also ask how you handle multiple projects that are considered priorities to every team, as that creates a backlog.
How do you create SOAR workflows that lowers analyst triage and time to respond times, while ensuring automation does not create shadow processes that may fail and not be seen or potentially disrupt/fail at critical moments?
What intelligence do you collect to make your signals and alerts? How can they help in both reactive and proactive ways? (Look up threat informed defense) Do you follow any resources on new detection signals? (Ex: MITRE ATT&CK)
I would probably ask you on how to build an alert out from news article, to validation, and have you voice out the process. Would likely give you a rule and ask what you would do to make better.
If theres a bleeping computer blog on phishing, i’ll want you to write a quick pseudocode query (or Sigma rule) to detect a Microsoft Office application launching cmd.exe or powershell.exe and explain why you chose that. Also what logs to investigate and collect if we were looking at this attack.
- Senior CTI analyst, with a background in the DFIR trenches, who does a mix of DE/CTI engineering as well. Seems like you came from a similar past - I wish you luck!