Questions to ask the recruiter in a cyber interview

At the end of almost every cybersecurity interview comes the line "Do you have any questions?". Many candidates treat it as a formality, yet it is the only moment when you run the investigation. Here are the questions that genuinely tell you something about the role, grouped by theme, with what a good or a bad answer should signal to you.

Why your questions matter as much as your answers

An interview does two jobs: it lets the company assess you, and it lets you assess the company. Security candidates often forget the second half, because they focus their preparation on the technical part, as we describe in our guide to passing a cybersecurity technical interview.

Your questions play two roles:

They protect you. A SOC analyst role with poor tooling, a CISO role with no budget and no executive backing, a pentest position that turns out to be compliance auditing: these are gaps you discover by asking the right questions, or three months after you start.
They say who you are. An experienced interviewer learns a lot from what you are curious about. Asking how incident reviews work shows a culture of continuous improvement. Asking nothing suggests you have not thought much about the role.

Questions about the team and the organisation

The same job title covers very different realities depending on where the security team reports and how it is staffed.

Who does the security team report to: IT, the executive team, the risk function?
How many people are on the team, and what are their roles?
Who would be my direct manager, and what is their background?
Is this a new role or a replacement? If it is a replacement, why did the person leave?
Which activities are outsourced (SOC, pentesting, vulnerability management), and which providers do you work with?

The replacement question is delicate but legitimate. A clear answer ("she moved into an internal architect role") is a good sign. An evasive one is worth exploring tactfully in the next round.

Questions about the day to day and the tools

These give you the most concrete picture of your working week. Adapt them to the role.

What does a typical week look like in this role?
Which tools do you use daily: SIEM, EDR, scanners, cloud platforms, ticketing?
How much time goes to run activity, and how much to improvement projects?
What was the team's last significant incident or project, and what did you learn from it?
How are procedures documented, and who keeps them up to date?

For a SOC role, also ask how alerts are split between tiers and how an analyst grows. Our article on moving from SOC analyst L1 to L3 helps you recognise an organisation that genuinely develops its people.

Questions about working conditions

These are sometimes seen as awkward, wrongly so. In security, on-call and shift work deeply shape daily life: discovering them after signing would be careless.

Topic	Question to ask	What a good answer includes
On-call	How does on-call work, and how often?	A rota, compensation and rest time, set out in writing
Call-outs	How many times were you called out in recent months?	An honest order of magnitude, not "hardly ever" with no detail
Remote work	What is the team's actual remote work pattern?	Real practice, not just the official policy
Training	What budget and time are set aside for training and certifications?	Recent examples of training the team has done
Workload	How do you handle peaks in activity?	Concrete mechanisms: extra staff, prioritisation, postponed projects

If on-call remains vague, our employer-side article on remote work and on-call lists the points a serious company should be able to clarify.

Questions about the place of security in the company

These are especially useful for lead, architect or CISO roles, but they tell any candidate how much room the team really has.

How does senior management follow security topics? Is there a dedicated committee?
When the security team recommends something that slows a project down, how is the decision made?
Is the company in scope of a framework such as NIS2 or DORA, and where does it stand?
What are the three security priorities for the coming year?
Is there an identified security budget, and who arbitrates it?

A company that answers these precisely usually has a more mature security function. A company that is hearing the question for the first time is not necessarily a bad choice, but you now know the role will involve a good deal of teaching and persuasion.

Questions about growth and success

What does success look like in this role after six months, and after a year?
How do annual reviews and pay reviews work?
Can you give me an example of someone on the team who grew internally?
What are the prospects if the team expands?

The first question is often the most revealing. If your interviewer struggles to describe what they expect from you, objectives are likely to stay vague throughout the probation period.

Questions about the rest of the process

Never leave an interview without knowing what comes next.

What are the next steps, and on what timeline?
Will there be a hands-on test? In what format and for how long?
Who else will I meet?
Do you have any reservations about my application at this stage?

The last one takes some nerve, but it gives you a chance to correct a misunderstanding while you are still in the room. If a practical test is planned, our guide to preparing a cybersecurity practical test will help you approach it calmly.

Tailoring your questions to the person in front of you

You will rarely meet just one person. Each sees the role from a different angle, so ask each the questions they can actually answer.

The recruiter or HR contact: process, timeline, contract terms, salary range.
Your future manager: priorities, objectives, how the team works, success criteria.
A future colleague: the real day to day, tools, atmosphere, workload during on-call.
Senior management: the place of security, budget, medium-term ambitions.

Asking two different people the same question is also a good way to check that the story is consistent.

Questions to avoid

Some questions hurt your application, not because they are forbidden, but because they come at the wrong time or show a lack of preparation.

A question already answered in the job ad or on the company's website.
Questions focused only on holidays and remote work in the very first conversation.
A question asking for confidential details about the company's security: known vulnerabilities, detailed architecture, undisclosed incidents. A security professional should know where legitimate curiosity ends.
Salary negotiation in the middle of a technical interview with a future colleague.

On that last point, pay deserves to be raised early with the right person, then negotiated at the right time: our article on negotiating your cybersecurity salary explains the method.

Preparing your list beforehand

Arrive with five to eight written questions, ranked by priority, and adjust them as the conversation unfolds. Some will be answered along the way: in that case, build on the answer rather than asking again ("You mentioned the EDR migration, who is leading it?"). Take notes on the answers: they will help you compare offers and prepare for the next round.

In short

The questions you ask in an interview help you avoid a bad move and show your professional maturity. Ask about the organisation, the day to day, working conditions, the place of security and the criteria for success, and tailor them to each person you meet. A good interview is an exchange between two parties who both want to make the right decision.

Preparing for your next interviews? Join the Cyber Recrut network for free. We share what we know about the role and the team ahead of time, and our shortlisted candidates prove their skills on hands-on labs, which leaves more room for a real conversation in the interview. See how we work.