FreeExam

Technical leadership

A senior security engineer interview on leading security work across teams, from getting findings fixed and prioritizing risk to rolling out controls, owning incidents, and explaining risk to executives.

These prompts are original practice. They are not questions from a named employer or a live hiring loop.

  1. 1.You lead application security at a ticketing company. A product team says your review comments always arrive as a list of blockers the week before launch. What change helps most?

  2. 2.A team at a pet insurance company pushes back on your finding, saying the fix would take a month. You think a smaller change removes most of the risk. What do you do?

  3. 3.Your team is known internally as the people who say no. Which habit most changes that reputation over a few months?

  4. 4.A product manager asks why a finding you raised matters, since no customer has complained. How do you answer?

  5. 5.You find the same missing authorization check in three services owned by one team. The team lead is defensive. What is a good first move?

  6. 6.A team asks for an exception to the rule that all services sit behind the shared login gateway. Their reason seems sound. What should you do?

  7. 7.Your scanner opens tickets in every team's backlog. Most sit untouched for months. What do you change first?

  8. 8.A team fixed a serious finding quickly and well. What is the most useful thing you can do next?

  9. 9.You inherit a backlog of 4,000 open vulnerability findings at a logistics company. Leadership wants a plan in two weeks. What do you do first?

  10. 10.A critical-rated library flaw sits in an internal batch job with no network access. A medium-rated flaw sits in your public login page. Which do you push first?

  11. 11.Teams complain that your vulnerability deadlines are the same for every finding regardless of context. What change helps most?

  12. 12.A flaw in a widely used library is being actively exploited on the internet. Your backlog already has 300 overdue items. What do you do?

  13. 13.Your vulnerability dashboard shows the open count rising each month. An executive asks if things are getting worse. How do you answer honestly?

  14. 14.A team has 200 low-risk findings and says they cannot fix them without stopping feature work. What is a sensible approach?

  15. 15.Two teams dispute who owns a vulnerable shared image used by forty services. The finding has been open for three months. What do you do?

  16. 16.You want teams to fix risky findings faster. Which measure is most useful to report each month?

  17. 17.A scanner vendor offers a new feature that flags ten times more findings. Your teams already struggle with the backlog. What do you do?

  18. 18.Your vulnerability program reports progress by count of findings closed. A team closed 500 last month, mostly by marking them as not applicable. What do you do?

  19. 19.You are leading a single sign-on (SSO) rollout across 120 internal tools at a retail company. How do you sequence it?

  20. 20.You are rolling out secret scanning that blocks commits containing keys. In week one, developers complain about false positives. What do you do first?

  21. 21.You want every repository to pin its dependencies to exact versions. Thirty teams own the repos. What is the best way to drive adoption?

  22. 22.Halfway through a single sign-on (SSO) migration, ten teams have not started and the deadline is in six weeks. What do you do?

  23. 23.A team says the new multi-factor login breaks a vendor tool their support staff need every day. The rollout deadline is Friday. What do you do?

  24. 24.Before rolling out a new control to all teams, you want to know if it will break builds. What is the most reliable way?

  25. 25.Your secret scanning rollout is complete in all active repos. What is the next step that keeps it working?

  26. 26.You must pick between two secret scanning tools for 80 teams. One is more accurate. The other fits the code review flow teams already use. How do you decide?

  27. 27.You are rolling out dependency pinning. One team says it will slow their security patching because updates now need a pull request. What do you do?

  28. 28.A payments feature launches Monday. On Thursday you find a flaw that lets one merchant view another merchant's refund totals. What do you do first?

  29. 29.A product leader wants to ship with a known medium-risk flaw and fix it next month. Who should accept the risk?

  30. 30.A vice president accepted a launch risk in writing three months ago. The promised fix date has passed and nothing was done. What do you do?

  31. 31.The team wants to launch with a known flaw. You think the risk is too high, but the product owner accepts it in writing with full information. What do you do?

  32. 32.You must summarize a launch risk for the product owner who will accept it. What belongs in the summary?

  33. 33.A launch has a known flaw that could expose user email addresses. You cannot fix it in time. Which mitigation is most useful to propose?

  34. 34.Your company has no record of which known security risks have been accepted. Teams keep shipping with known flaws. What do you set up?

  35. 35.A launch is tomorrow. You find a severe flaw that lets anyone reset any user's password. The product owner wants to ship anyway. What do you do?

  36. 36.You are incident lead for a suspected stolen admin token at a food delivery company. Engineers are debating the root cause in the main channel. What do you do?

  37. 37.During a data exposure incident, the head of sales asks you every ten minutes for updates. What do you do?

  38. 38.An incident was caused by an engineer who disabled a security check to unblock a deploy. In the review, a manager asks who to hold accountable. How do you respond?

  39. 39.You are leading response to a likely breach. Legal wants to wait before notifying customers. The engineers want to post a public notice now. What do you do?

  40. 40.Three weeks after an incident, half the follow-up items are still open. What do you do?

  41. 41.A junior responder made a wrong call during an incident that delayed containment by an hour. What is your best response afterward?

  42. 42.You are writing the incident review for a credential leak. Which framing is most useful?

  43. 43.In the middle of an incident, a senior engineer suggests a risky fix that could cause an outage. You are incident lead. What do you do?

  44. 44.After an incident, you notice the same weakness exists in six other services. The incident review covers only the first service. What do you do?

  45. 45.An hour into an incident, you realize you are both incident lead and the main person digging through logs. Progress has slowed. What do you do?

  46. 46.You want to start a security champions program across 25 product teams. How do you pick champions?

  47. 47.Six months into a champions program, attendance at monthly meetings has dropped by half. What do you do first?

  48. 48.A security champion asks you to review every pull request on their team. What do you do?

  49. 49.Which responsibility is best to hand off to security champions first?

  50. 50.A champion's manager says they cannot spare the engineer's time this quarter. The champion is eager to stay. What do you do?

  51. 51.You want to grow a strong engineer on your own team into a security lead. Which step helps most?

  52. 52.A junior engineer on your team asks to take on the threat model for a big new feature. You could do it twice as fast. What do you do?

  53. 53.How should you measure whether a security champions program is working?

  54. 54.A champion on the mobile team finds a real flaw and fixes it, but skips telling you. You learn of it a month later. What do you do?

  55. 55.The chief financial officer asks why you need budget to replace an old secrets system. What is the most persuasive framing?

  56. 56.An executive asks, in a hallway, whether the company is secure. How do you answer?

  57. 57.You are presenting security risks to the board. You have ten minutes. What do you lead with?

  58. 58.An executive keeps rejecting your security proposals as too expensive. What change is most likely to help?

  59. 59.A peer company suffers a large breach in the news. Your chief executive asks if it could happen to you. What do you do?

  60. 60.You need executives to fund paying down security debt in an old customer portal. Which argument fits best?

  61. 61.An executive asks for a single score that shows the company's security posture. What do you offer?

  62. 62.Your security budget request was cut in half. What do you do next?

  63. 63.An executive wants to know how likely a ransomware attack is this year. You do not have precise data. How do you answer?

  64. 64.You want to move the company from shared database passwords to short-lived credentials. How do you start?

  65. 65.Your design doc for a new access control model gets no comments after a week. What do you do?

  66. 66.Which section of a security design doc most helps reviewers make a good decision?

  67. 67.You are setting a three-year direction for identity and access at a fast-growing company. What should the plan include?

  68. 68.Several teams are each building their own way to store secrets. You want one standard approach. What do you do first?

  69. 69.A design doc you wrote is rejected by the architecture group because it adds too much load on the platform team. What do you do?

  70. 70.You need to choose an encryption key management approach. Two options are close, and testing both would take a month. What do you do?

  71. 71.You made a decision six months ago to use a certain token format. New facts suggest it was the wrong choice. What do you do?

  72. 72.Why should a security lead keep a written log of key decisions?

  73. 73.In a design review, a senior engineer strongly objects to your plan for token validation. Their argument has some merit. What do you do?

  74. 74.You run a design review for a new login flow. One engineer has said nothing. You know they have worked on similar systems. What do you do?

  75. 75.A design review has gone in circles for three meetings over whether to use one shared authentication service or a library. What do you do?

  76. 76.After a review, the team decides against your recommendation. You still think your option was better. What do you do?

  77. 77.A team brings a design to security review that is nearly finished. You find a basic flaw in how they handle sessions. What do you do?

  78. 78.You notice reviewers in your design reviews mostly comment on naming and formatting. What change helps most?

  79. 79.A staff engineer from another team posts a public critique of your design doc in a large channel. Some points are wrong. What do you do?

  80. 80.You are planning a year-long effort to add audit logging to every service. Leadership wants results in the first quarter. How do you sequence?

  81. 81.Midway through a multi-quarter project, you are behind schedule. What is the best way to cut scope?

  82. 82.A product director asks your team to build a custom fraud detection system. It is outside your charter, and you are already full. What do you do?

  83. 83.Your team has seven projects planned for the quarter and can realistically finish four. What do you do?

  84. 84.A stakeholder wants a security feature that you think adds little value. They are senior and insistent. What do you do?

  85. 85.You are planning a two-year move from passwords to passkeys for customers. What is the best first milestone?

  86. 86.Your manager asks you to take on a second large program while you lead a migration that is at a critical point. What do you do?

  87. 87.A team asks your security team to approve a new open-source tool every time they add one, about twice a week. You cannot keep up. What do you do?

  88. 88.You lead a single sign-on (SSO) project due in eight weeks. You now estimate twelve. When do you tell stakeholders?

  89. 89.A vendor delay puts your secrets migration two months behind. A team that depends on it will miss its own launch. What do you do?

  90. 90.When you report a slip to stakeholders, what should the message contain?

  91. 91.Your team keeps missing estimates on security projects. What is the most useful change?

  92. 92.A project is slipping because one engineer is stuck on a hard problem and has not asked for help. What do you do?

  93. 93.Your project is on track, but you see a risk that could add a month if it happens. Should you tell stakeholders?

  94. 94.A slipping project has a hard regulatory deadline. Cutting scope will not be enough. What do you do?

  95. 95.Your manager wants to skip the penetration test for a launch to save two weeks. You think it is risky. What do you do?

  96. 96.A principal engineer insists that internal services do not need encryption between them. You disagree. How do you approach it?

  97. 97.Product wants a fast checkout. You want an extra verification step for high-risk orders. The two goals conflict. What do you do?

  98. 98.Your manager asks you to tell a team their finding is critical so they fix it faster. You believe it is medium. What do you do?

  99. 99.Two teams both want your team's help this quarter, and both say their work is the top priority. What do you do?

  100. 100.A senior engineer on another team keeps bypassing a security review process you set up. What do you do first?

  101. 101.Your manager decided on a security tool you think is a poor fit. You raised concerns, and the decision stands. What do you do?

  102. 102.The head of engineering wants to cut your team's review step from launches to hit a quarterly goal. You think several launches carry real risk. What do you do first?

  103. 103.Every security-sensitive change at your company needs your personal approval. Reviews now take a week. What do you do?

  104. 104.The same input validation bug keeps appearing in code reviews. What is the most lasting fix?

  105. 105.You are the only person who knows how the company's key management system works. What should you do?

  106. 106.Your team reviews threat models for every new feature. The queue has 40 items. What change helps most?

  107. 107.You want teams to stop committing secrets. Which approach works best in the long run?

  108. 108.You keep getting pulled into every security question in chat. You have no time for planned work. What do you do?

  109. 109.A team wants to add a new security check to the build pipeline. It takes ten minutes per build. What do you advise?

  110. 110.You are going on a two-week vacation in the middle of a security program you lead. What do you do before you leave?