shared ute interview

Tell me about yourself.

I have a bachelor's degree in cybersecurity and hands-on experience from my SOC internship, where I investigated security alerts, analyzed logs, and identified suspicious activity. That experience made me realize I enjoy the investigative side of cybersecurity, especially understanding why something happened rather than just identifying a threat. I'm now looking to build on that foundation by gaining more experience in incident response, threat hunting, and vulnerability management, while becoming someone a security team can rely on.

What experience do you have with SIEM tools?

During my SOC internship, I gained experience reviewing security alerts and analyzing logs to identify suspicious activity. I would examine details like source IP addresses, timestamps, and login attempts to determine whether something required further investigation or escalation.

How do you investigate a security alert?

I start by reviewing the alert details, including the source IP, affected system, and timestamp. Then I check related logs to determine whether the activity is suspicious, document my findings, and escalate if necessary. Example: If an alert shows multiple failed logins followed by a successful login from an unfamiliar IP address, I would investigate whether the account was compromised.

What is a SIEM?

A SIEM, or Security Information and Event Management system, collects and analyzes logs from different devices and systems to detect suspicious activity and generate security alerts. Example: A SIEM might detect hundreds of failed login attempts against an account and generate an alert for a possible brute-force attack.

What is incident response?

Incident response is the process of identifying, investigating, containing, removing, and recovering from security threats. Example: If a computer is infected with malware, the security team investigates the infection, isolates the computer, removes the malware, and restores the system.

What are the phases of incident response?

The main phases are preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Example: If ransomware infects a computer, the team detects the infection, isolates the device, removes the threat, restores clean backups, and reviews how the attack happened.

What would you do if you detected a suspicious login?

I would review the login logs, source IP address, location, and timestamp. I would check for repeated failed attempts or unusual activity and escalate if I suspected the account was compromised. Example: If an employee normally logs in from Colorado but suddenly logs in from another country, I would investigate whether it was legitimate or potentially unauthorized.

What is threat hunting?

Threat hunting is proactively searching through logs, network traffic, and systems to find potential threats that automated security tools may have missed. Example: Searching authentication logs for unusual late-night logins or suspicious PowerShell activity, even when no security alert was generated.

How would you perform a basic threat hunt?

I would start by identifying suspicious behavior to look for, such as unusual logins or connections. Then I would search relevant logs, investigate anything unusual, and document my findings. Example: I might search for accounts logging in from unfamiliar locations or devices communicating with suspicious external IP addresses.

What is a false positive?

A false positive is when a security tool generates an alert for activity that appears suspicious but is actually harmless. Example: A vulnerability scanner performing an authorized network scan might trigger an intrusion detection alert because its activity resembles an attack.

What is vulnerability management?

Vulnerability management is the process of identifying, assessing, prioritizing, and fixing security weaknesses in systems and applications. Example: Running vulnerability scans, identifying outdated software, and working with IT to install security patches.

How do you prioritize vulnerabilities?

I would consider the severity of the vulnerability, whether it's being actively exploited, how exposed the system is, and how important the affected system is to the organization. Example: A critical vulnerability on an internet-facing server would generally be a higher priority than a low-risk vulnerability on an isolated test computer.

What is a vulnerability scan?

A vulnerability scan is an automated process that checks systems for known security weaknesses, missing patches, and insecure configurations. Example: Using Nessus to scan a server and identify outdated software or missing security updates.

What is CVSS?

CVSS stands for Common Vulnerability Scoring System. It rates the severity of vulnerabilities on a scale from 0 to 10, with 10 being the most severe. Example: A vulnerability with a CVSS score of 9.8 is considered critical and would typically require urgent evaluation.

What is the difference between a vulnerability and a threat?

A vulnerability is a weakness in a system, while a threat is something that could exploit that weakness and cause harm. Example: An outdated operating system is a potential vulnerability, while a hacker attempting to exploit it represents a threat.

What would you do if you discovered a critical vulnerability?

I would verify the vulnerability, identify affected systems, assess the risk, notify the appropriate team, and help track remediation through patching or other security controls. Example: If a critical vulnerability was discovered in a public-facing web server, I would notify the security team so it could be patched or protected as quickly as possible.

What is an IOC?

An Indicator of Compromise is evidence that a system may have been attacked, such as a malicious IP address, suspicious file hash, or unusual network activity. Example: A computer repeatedly communicating with an IP address associated with known malware could be an indicator of compromise.

What is the difference between IDS and IPS?

An IDS, or Intrusion Detection System, monitors network traffic and alerts on suspicious activity. An IPS, or Intrusion Prevention System, can also automatically block malicious traffic. Example: If someone attempts a known network attack, an IDS might alert the security team, while an IPS could block the malicious traffic.

What is EDR?

Endpoint Detection and Response is a security tool that monitors computers and servers for suspicious activity and helps security teams investigate and respond to threats. Example: Microsoft Defender for Endpoint might detect suspicious PowerShell activity on an employee's laptop and generate an alert.

What is the difference between SIEM and EDR?

A SIEM collects and analyzes logs from multiple systems across a network, while EDR focuses on monitoring and protecting individual endpoints like laptops and servers. Example: Splunk can be used as a SIEM to investigate logs from multiple sources, while Microsoft Defender for Endpoint monitors suspicious activity on individual computers.

How would you investigate a phishing email?

I would examine the sender's address, email headers, links, and attachments for suspicious indicators. I would also check whether other users received the email and escalate if it was malicious. Example: If an employee receives an email pretending to be Microsoft asking them to reset their password, I would inspect the sender and URL to determine whether it leads to a fake login page.

What would you do if a computer was infected with malware?

I would follow the incident response procedure, isolate the affected computer if authorized, preserve evidence, and work with the security team to remove the malware and restore the system. Example: If an EDR tool detects ransomware on a laptop, I would escalate immediately and help isolate the device to prevent the infection from spreading.

What is ransomware?

Ransomware is malware that encrypts files or steals sensitive information and demands payment, often in exchange for restoring access or preventing data exposure. Example: An attacker infects a company's computer, encrypts important files, and demands money to provide a decryption key.

What is phishing?

Phishing is a social engineering attack where attackers use fraudulent emails or messages to trick users into revealing sensitive information or clicking malicious links. Example: An attacker sends an email pretending to be the IT department and asks employees to enter their passwords on a fake login page.

What is the CIA triad?

The CIA triad represents three main security principles: confidentiality protects sensitive information, integrity ensures information remains accurate, and availability ensures systems and data are accessible when needed. Example: Encryption protects confidentiality, file integrity checks help detect unauthorized changes, and backup systems support availability.

What is a firewall?

A firewall is a security tool that monitors and controls incoming and outgoing network traffic based on configured security rules. Example: A firewall can block unauthorized connections from the internet while allowing employees to access approved websites.

What is DNS?

DNS stands for Domain Name System. It translates domain names like google.com into IP addresses so computers can locate websites and services. Example: When you type google.com into a browser, DNS helps your computer find the IP address needed to connect to Google's servers.

What is DHCP?

DHCP stands for Dynamic Host Configuration Protocol. It automatically assigns IP addresses and other network settings to devices connected to a network. Example: When you connect your laptop to Wi-Fi, DHCP can automatically assign it an IP address, subnet mask, gateway, and DNS settings.

What is the difference between TCP and UDP?

TCP is connection-oriented and ensures reliable, ordered data delivery. UDP has less overhead but doesn't guarantee delivery or order. Example: HTTPS commonly uses TCP, while online gaming and voice calls often use UDP because low latency is important.

What are some common network ports?

Port	Service	What it's used for
20/21	FTP	Transferring files (unencrypted)
22	SSH	Secure remote access to computers and servers
23	Telnet	Remote access (unencrypted)
25	SMTP	Sending email between mail servers
53	DNS	Translating domain names into IP addresses
67/68	DHCP	Automatically assigning IP addresses
80	HTTP	Unencrypted website traffic
88	Kerberos	Network authentication, commonly in Active Directory
110	POP3	Retrieving emails
123	NTP	Synchronizing system clocks
135	RPC	Windows remote procedure calls
139	NetBIOS	Legacy Windows file sharing
143	IMAP	Accessing and managing emails
161/162	SNMP	Monitoring network devices and receiving alerts
389	LDAP	Directory services and user information
443	HTTPS	Encrypted website traffic
445	SMB	Windows file and printer sharing
465/587	SMTP	Sending email securely
514	Syslog	Sending system and security logs
636	LDAPS	Encrypted LDAP directory communication
993	IMAPS	Secure email access
995	POP3S	Secure email retrieval
1433	MS SQL	Microsoft SQL Server database connections
3306	MySQL	MySQL database connections
3389	RDP	Remote Desktop access to Windows computers
5432	PostgreSQL	PostgreSQL database connections

How do you identify suspicious network traffic?

I would look for unusual IP addresses, unexpected ports, repeated connection attempts, large data transfers, or communication with known malicious destinations. Example: If a workstation suddenly starts transferring large amounts of data to an unfamiliar external IP address, I would investigate possible data exfiltration.

What is a brute-force attack?

A brute-force attack is when an attacker repeatedly tries different passwords or credentials to gain unauthorized access to an account. Example: An attacker tries hundreds of passwords against an employee's account until they find the correct one.

What is MFA?

Multi-Factor Authentication is a security method that requires users to verify their identity using two or more different authentication factors, such as a password and an authenticator app. Example: Logging into Microsoft 365 using your password and then approving a notification through Microsoft Authenticator.

What is the principle of least privilege?

The principle of least privilege means giving users only the permissions they need to perform their jobs, reducing the risk of unauthorized access. Example: An employee who only needs to view documents should not have administrator privileges or permission to modify sensitive system settings.

What is the difference between authentication and authorization?

Authentication verifies who a user is, while authorization determines what resources and information that user is allowed to access. Example: Entering your password verifies your identity, while your assigned permissions determine whether you can access a confidential folder.

What is GRC?

GRC stands for Governance, Risk, and Compliance. It helps organizations establish security policies, manage cybersecurity risks, and meet regulatory requirements. Example: A company might use GRC processes to ensure employees follow password policies, security risks are documented, and required audits are completed.

What is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework provides guidelines for managing cybersecurity risks. It has six main functions: Govern, Identify, Protect, Detect, Respond, and Recover. Example: An organization might use NIST guidance to identify important systems, implement security controls, detect attacks, and develop incident response plans.

What is third-party risk management?

Third-party risk management is the process of identifying and managing security risks associated with outside vendors, contractors, and service providers. Example: Before allowing a cloud service provider to store sensitive company data, the organization evaluates the provider's security practices.

How would you assess a vendor's security risk?

I would review the vendor's security practices, certifications, access to sensitive information, and history of security incidents to determine the potential risk to the organization. Example: If a vendor handles sensitive employee information, I would check whether they use encryption, MFA, and appropriate access controls.

Why are security policies important?

Security policies establish rules and expectations for protecting systems and information. They help employees follow consistent security practices and reduce organizational risk. Example: A password policy might require MFA and prohibit password sharing to reduce the likelihood of unauthorized access.

What is the difference between a security event and a security incident?

A security event is an activity recorded on a system or network. A security incident is an event or series of events that threatens the confidentiality, integrity, or availability of systems or information. Example: A failed login is a security event. Multiple failed logins followed by unauthorized account access could be a security incident.

What types of logs would you review during a security investigation?

I would review authentication logs, Windows Event Logs, firewall logs, DNS logs, and endpoint security logs to identify suspicious activity. Example: If I suspected a brute-force attack, I would review authentication logs for repeated failed logins and check whether any attempts were successful.

What would you do if you noticed repeated failed login attempts?

I would investigate the source IP, affected accounts, and timestamps. I would also check whether any attempts were successful to determine whether it could be a brute-force attack. Example: If an account had 200 failed login attempts in five minutes, I would investigate the source and check whether the account had been compromised.

What would you do if you couldn't resolve a security incident?

I would document everything I investigated, collect relevant evidence, and escalate the incident to a senior security analyst while following the organization's procedures. Example: If I discovered suspicious network traffic but couldn't determine its cause, I would share the relevant logs, IP addresses, and timestamps with a senior analyst.

How do you document a security incident?

I would record the alert details, timestamps, affected systems, evidence collected, investigation steps, actions taken, and the final outcome. Example: If I investigated a suspicious login, I would document the username, source IP, login time, related activity, and whether the incident was escalated or resolved.

How do you prioritize multiple security alerts?

I would prioritize alerts based on their severity, potential impact, affected systems, and likelihood of being a real threat. Critical incidents affecting important systems would receive the highest priority. Example: I would prioritize a possible ransomware infection on a production server over a low-severity alert involving an unsuccessful login attempt.

Tell me about a time you investigated suspicious activity.

During my SOC internship, I gained experience reviewing security alerts and analyzing logs for suspicious activity. I would examine details such as source IP addresses, timestamps, and related events to determine whether the activity required further investigation or escalation. For this question, be ready to explain one real incident you investigated, what evidence you reviewed, and what happened afterward. Avoid claiming you performed actions you didn't actually do.

How do you stay updated on cybersecurity threats?

I follow cybersecurity news, CISA security advisories, vulnerability reports, and continue developing my technical skills through hands-on cybersecurity labs and projects. Example: I can review CISA's Known Exploited Vulnerabilities catalog to learn about vulnerabilities attackers are actively exploiting.

Why do you want to work for Southern Ute Shared Services?

What interests me about SUSS is that you're protecting more than just one business. You're supporting different tribal departments and organizations, so the work has a meaningful impact. Career-wise, I want to build on my SOC experience and gain more hands-on exposure to incident response, vulnerability management, and threat hunting.

Why should we hire you?

I bring hands-on SOC experience and a strong investigative mindset. I don't just want to identify suspicious activity; I want to understand why it's happening. I believe I can add value by thoroughly investigating alerts, identifying potential threats, and documenting useful findings that help the team respond effectively. I'm genuinely curious about how attacks happen and how systems can be better protected. I don't like stopping at the surface of a problem. I want to understand the root cause, and I think that mindset will help me grow into someone the security team can depend on.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan automatically identifies known security weaknesses, while a penetration test attempts to exploit vulnerabilities to determine whether an attacker could gain access. For example, Nessus might identify an outdated server, while a penetration tester would attempt to exploit that weakness in an authorized test.

What is the difference between a vulnerability and a misconfiguration?

A vulnerability is a security weakness that could be exploited, while a misconfiguration is an incorrect or insecure system setting. For example, outdated software might contain a vulnerability, while leaving an unnecessary network port open could be a misconfiguration.

What is the difference between a false positive and a false negative?

A false positive is when a security tool flags harmless activity as suspicious. A false negative is when actual malicious activity goes undetected. For example, a legitimate network scan triggering an alert is a false positive, while malware running without generating an alert is a false negative.

What is MITRE ATT&CK?

MITRE ATT&CK is a framework that describes the tactics and techniques attackers use during cyberattacks. Security teams use it to understand attacker behavior, investigate incidents, and identify gaps in their defenses.

What is the difference between a threat, vulnerability, and risk?

A threat is something that could cause harm, a vulnerability is a weakness that could be exploited, and risk is the likelihood and potential impact of that threat exploiting the vulnerability.

What would you do if you discovered suspicious PowerShell activity?

I'd review the PowerShell command, the account that executed it, and the affected device. Then I'd check related endpoint and security logs to determine whether the activity was legitimate or malicious. If it appeared suspicious, I'd document my findings and escalate it.

How would you investigate a possible data exfiltration attempt?

I'd review network traffic and security logs for unusual outbound connections or large data transfers. I'd identify the affected device, destination IP address, and account involved. Then I'd investigate whether the activity was authorized and escalate if necessary.

What is the difference between a security policy, standard, and procedure?

A policy establishes security rules, a standard defines specific requirements, and a procedure explains the steps employees follow. For example, a policy might require secure passwords, a standard defines password requirements, and a procedure explains how to reset a password.

How would you work with IT teams to remediate a vulnerability?

I'd share the vulnerability details, affected systems, severity, and recommended remediation with the responsible IT team. Then I'd help track the remediation and verify the issue was resolved through a follow-up scan or other validation.

What would you do if a vendor experienced a security breach?

I'd notify the appropriate security or risk management team and help determine whether the vendor has access to our systems or sensitive information. Then I'd assist with assessing the potential impact, reviewing the vendor's response, and documenting the findings.