HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
What the interviewer wants to hear
- Work with HR and legal; confirm scope and authority
- Need-to-know, discreet investigation, preserve evidence
- Review DLP, cloud storage, email, USB and code repository logs
- Compare against the user's baseline behaviour
- Document facts objectively; avoid assumptions
Model answer
Insider cases are sensitive, so I first agree scope and authority with HR and legal, and keep the investigation on a need-to-know basis. Monitoring must follow company policy and local privacy law. Then I preserve evidence before anything changes: EDR data, mailbox and cloud storage audit logs, and repository access logs, with chain of custody. I look for signs like large Git clones or downloads, uploads to personal cloud storage or email, USB file copies, printing, and access to repositories outside the person's normal work. Comparing to their own baseline from previous months matters, because a developer cloning code can be normal. I report facts objectively with timestamps, not conclusions about intent. Legal and HR decide on actions, and I help revoke access at the agreed time.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Cybersecurity Analyst questions
- Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.
- Design a threat hunt to find lateral movement in a Windows Active Directory environment.
- Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
- A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?
- How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?
- Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?
- You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
- A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
- How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?