Security Engineer
Interview Guide

CISSP (Certified Information Systems Security Professional) is the gold standard for senior security roles. For specializations: CEH or OSCP for penetration testing, AWS Security Specialty for cloud security, CISM for security management. Entry-level: CompTIA Security+ is widely recognized. OSCP (Offensive Security Certified Professional) is particularly respected for hands-on technical credibility.

STRIDE is a structured threat modeling approach: Spoofing (fake identity), Tampering (modifying data), Repudiation (denying actions), Information Disclosure (data exposure), Denial of Service (disrupting availability), Elevation of Privilege (unauthorized access). It's used to systematically identify threats to a system. Practice applying STRIDE to systems you've worked on.

Very important for application security and security tooling roles. Python is the most common scripting language for automation, tool development, and exploit PoCs. Bash for system administration. Understanding of Java, JavaScript, Go, or C/C++ depending on the systems you're securing. Code review is a core AppSec skill — you need to read code fluently even if you're not writing production code.

Zero-trust is a security model that assumes no implicit trust — every request must be authenticated and authorized regardless of network location. Key principles: verify explicitly (always authenticate and authorize), use least-privilege access, and assume breach (minimize blast radius). Implementation involves strong identity (MFA), device trust, micro-segmentation, and continuous monitoring. Zero-trust is now the dominant enterprise security architecture framework.