SOC analyst interview questions: a practical grid

A SOC analyst interview easily drifts into a tour of tools: which SIEM, which EDR, how many alerts a day. You leave without knowing whether the person can triage an alert, run an investigation or write a ticket a colleague can pick up at 3 a.m. Below is a set of questions organised by theme and adapted to the level of the role, with what a good answer contains and the signals that should worry you.

Before the interview: settle the level and the context

A useful grid starts from the real job. Before you meet the first candidate, decide three things:

• The level: L1 who qualifies and escalates, L2 who investigates, L3 who handles complex incidents and improves detection.
• The context: an in-house SOC that knows a single environment, or an MSSP that monitors several clients with different setups.
• The rhythm: shift work, on-call duty, nights or weekends.

If these are not settled yet, our guide to hiring a SOC analyst covers the scoping, and our SOC analyst job description template helps you write it down.

Not every question below suits every level. For an L1, focus on method, rigour and the reflex to escalate. For an L2 or L3, push on investigation, correlation and improving detection.

Triage and alert qualification

Triage is the heart of the job. It is also the hardest part to simulate in an interview, which is why concrete questions matter.

"An alert fires: a successful sign-in on a user account from an unusual country. What do you check before concluding?"

A good answer lists checks in a logical order: the account's sign-in history, known travel or VPN use, the device involved, whether multi-factor authentication was completed, and what happened after the sign-in (mailbox rules, downloads, password change). The candidate should also say when they escalate.

Red flag: an instant verdict ("false positive, it's the VPN") with nothing checked.

"How do you tell a false positive from an incident when you are not sure?"

You want an honest answer: record what was checked and what was not, and escalate while saying so rather than closing by default. The strongest candidates add that a recurring false positive should be reported so the rule can be tuned.

"You have thirty alerts waiting and you are the only one available. How do you prioritise?"

Good answer: how critical the asset is, the severity of the rule, combined signals on the same host or account, anything touching privileged accounts. The candidate should mention telling their manager when the load exceeds what they can handle properly.

Reading logs and EDR

These questions are mainly for L2 and L3, but a lighter version works for an experienced L1.

"Which Windows events do you look at to follow a suspicious sign-in, then a privilege escalation?"

The candidate should name the relevant families of events (successful and failed logons, logon types, process creation, additions to privileged groups, new services or scheduled tasks) and, above all, explain what each lets you reconstruct. A strong profile also says what these logs will not show if auditing is not configured.

Red flag: a list of event IDs recited with no idea of what each one tells you.

"The EDR shows an office document spawning a command interpreter, which then downloads a file. What do you read in this process tree?"

You want a parent-to-child reading: the document as a likely entry point (phishing), the interpreter as a sign of abnormal execution, the download as a second stage. Then the actions: trace where the document came from, look for other affected machines, weigh isolating the host and what that means for the user.

"Talk me through, or sketch on a whiteboard, the logic of a SIEM query that finds every machine that contacted a suspicious domain last week."

The query language barely matters. What counts: the right source (DNS or proxy), the time window, aggregation by host, then the pivot to the users involved. A candidate who knows a different SIEM from yours but reasons correctly is a very good sign.

Investigation and escalation

"Tell me about the investigation you are proudest of."

This is often the most revealing question. Listen for the timeline, the hypotheses raised then dropped, the sources used, the final decision. Follow up on a technical detail: a story the candidate actually lived holds up under questioning.

"When do you escalate, and what goes into your escalation message?"

Good answer: escalate as soon as the potential impact goes beyond what the playbook covers, or as soon as a serious doubt remains. The message holds the context, what was checked, the indicators found, the actions already taken and the precise question for the next tier.

"You suspect an administrator account has been compromised on a Friday evening. What do you do in the first hour?"

You want a structured approach: confirm the signals, raise the alarm through the right channel (on-call, manager), preserve useful evidence, propose containment steps without acting alone on a critical account unless the playbook allows it. Our incident response interview questions take this kind of scenario further for more senior profiles.

Red flag: the candidate disables the account on their own without telling anyone, or waits until Monday.

Knowledge of attack techniques

"Explain how an attacker moves from one compromised machine to others on the network."

Expected: credential theft from memory or files, password reuse, remote connections with legitimate accounts, abuse of excessive rights. A good candidate links each technique to the traces it leaves and how to detect it.

"How do you use MITRE ATT&CK in your work?"

A mature answer describes a tool for structuring an investigation or assessing detection coverage, not a grid to recite. For an L3, ask for a rule they wrote or improved from a specific technique.

Writing and communication

In a SOC, the quality of handovers depends on the quality of tickets. This part is too often skipped.

"Write, in five lines, the ticket for an alert you qualified as an incident."

Actually have them do it, on paper or on screen. You are looking for: what happened, what was checked, the indicators, the actions taken, what is left to do. A ticket you understand without being technical is a good sign.

"Explain this incident to a business director who wants to know whether to worry."

The candidate should move from technical vocabulary to impact: which data or services are involved, what is under control, what is not yet.

Rhythm, on-call and motivation

"What draws you to SOC work, and what wears you down?"

An honest answer about alert fatigue or night shifts is worth more than forced enthusiasm. It also opens a frank conversation about your own conditions.

"How do you keep up with threats?"

Regular reading, personal labs, CTFs, public threat reports: the format matters less than consistency and the ability to name a recent topic they dug into.

Summary grid

Score every candidate on the same grid, right after the interview.

Pair the interview with a hands-on exercise

An interview measures reasoning and communication. It does a poor job of measuring whether someone can investigate alone, on real data, against the clock. A short exercise on synthetic logs, followed by a debrief ("why this lead, what did you rule out?"), fills that gap. Our article on assessing cybersecurity skills explains how to design it fairly, and if nobody in-house can run the technical part, our guide to structuring a technical cyber interview without being an expert gives you something to lean on.

In short

A good interview grid for a SOC analyst covers triage, reading logs and EDR, investigation and escalation, knowledge of attack techniques, writing, and how the candidate relates to the rhythm of the job. Adapted to the level you need, scored the same way for everyone and paired with a hands-on exercise, it lets you decide on facts rather than on a list of tools.

Hiring a SOC analyst? At Cyber Recrut, a recruiter and a security practitioner run every search together, and our shortlisted candidates prove their skills on hands-on labs built around your environment. See how we work or share your hiring need.