Security engineering interviews are among the most specialized in tech. Unlike SWE generalist roles, they test domain-specific knowledge that can't be crammed in a week. This guide gives you the full picture for AppSec, infrastructure security, and security engineering roles.
Types of Security Engineering Roles
Application Security (AppSec): Embedded in product engineering — code review, SAST/DAST tooling, threat modeling, secure development lifecycle Infrastructure Security: Cloud security, network security, identity and access management, endpoint protection Security Engineering (Platform): Building security tooling — detection systems, SIEM, vulnerability scanners, secrets management Red Team / Penetration Testing: Offensive security — finding vulnerabilities before attackers do
Interview format varies significantly by role type. This guide covers AppSec and Infrastructure Security (most common at tech companies).
Coding Rounds
Security engineers at tech companies are expected to code at the SWE bar. However, problems often have a security flavor:
- Implement a constant-time string comparison (to prevent timing attacks)
- Parse and validate a JWT without using a library — spot the vulnerabilities
- Implement HMAC-based authentication
- Write a function to sanitize HTML input (XSS prevention)
- Identify the security vulnerabilities in a given code snippet
Languages: Python is most common. Know how to read and audit code in multiple languages.
Application Security Knowledge
OWASP Top 10 (2021) — Know all 10 cold:
- Broken Access Control
- Cryptographic Failures
- Injection (SQL, NoSQL, Command, LDAP)
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery (SSRF)
Web security fundamentals:
- XSS: Stored vs reflected vs DOM-based. Prevention: CSP, output encoding,
HttpOnlycookies - CSRF: How it works, SameSite cookie attribute, CSRF tokens
- SQL injection: Prevention via parameterized queries, ORMs, input validation
- IDOR (Insecure Direct Object Reference): Object-level authorization checks, not just authentication
- SSRF: Why cloud metadata endpoints (169.254.169.254) are dangerous, prevention strategies
- JWT security:
alg:nonevulnerability, key confusion attacks, proper validation
Authentication and authorization:
- OAuth 2.0 flows: Authorization Code with PKCE, Client Credentials, implicit (deprecated)
- OpenID Connect: ID token, access token, userinfo endpoint
- Session management: secure cookies, session fixation, session hijacking
- Password storage: bcrypt, Argon2 — why MD5/SHA1 are not acceptable
Infrastructure Security
Cloud security (AWS/GCP/Azure):
- IAM: principle of least privilege, role assumption, service accounts
- VPC: security groups vs NACLs, private subnets, VPC endpoints
- Secrets management: AWS Secrets Manager, Vault — never hardcode credentials
- S3 security: bucket policies, public access blocks, object ACLs, encryption at rest
- CloudTrail / audit logging: what to log, alerting on suspicious activity
Network security:
- TLS: handshake process, certificate validation, pinning, HSTS
- Firewall rules: default deny, egress filtering
- Zero Trust architecture: "never trust, always verify"
- mTLS: mutual authentication for service-to-service communication
Threat Modeling
Threat modeling is tested in senior security roles:
- STRIDE framework: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
- Attack surface analysis: Entry points, data flows, trust boundaries
- Risk prioritization: CVSS scoring, likelihood × impact
- Mitigations: For each identified threat, propose a specific countermeasure
Interview question: "Walk me through how you'd threat model our login flow."
Security Incident Response
- How do you respond to a reported vulnerability? (Triage, assess severity, contain, fix, disclose)
- What's your process for a security incident? (Detection, containment, eradication, recovery, post-mortem)
- How do you handle responsible disclosure from external researchers?
- What makes a good security post-mortem?
6-Week Security Engineer Prep Plan
| Week | Focus | |------|-------| | 1 | OWASP Top 10 deep dive + web security fundamentals | | 2 | Authentication/authorization: OAuth, JWT, session management | | 3 | Cloud security: IAM, VPC, secrets management | | 4 | Threat modeling: STRIDE framework, 5 practice exercises | | 5 | LeetCode: 20 problems + security-flavored coding problems | | 6 | Mock loops + behavioral (security incident response stories) |
Practice explaining security trade-offs out loud with CareerLift.ai — security interviews reward candidates who can communicate risk clearly to both technical and non-technical audiences.