How do you write an incident report that works for both technical teams and non-technical leaders?
What the interviewer wants to hear
- Executive summary first: what happened, impact, current status
- Clear UTC timeline of key events
- Root cause and how the attacker got in
- Actions taken and recommendations with owners
- Plain language with technical detail in an appendix
Model answer
I structure the report so each reader finds what they need quickly. It starts with a short executive summary in plain language: what happened, what business impact it had, whether data was affected, and the current status. Next comes a clear timeline in UTC, from initial access to containment and recovery. Then I explain the root cause, for example a phished account without MFA, and how the attacker moved. After that I list what we did to contain and fix it, and recommendations with owners and due dates, prioritised by risk reduction. Technical details like IOCs, queries and ATT&CK mappings go into an appendix so engineers can use them without overwhelming leaders. I avoid jargon and blame, state facts and confidence levels, and keep evidence references.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cybersecurity Analyst questions
- Walk me through how you triage a new SIEM or EDR alert.
- You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
- What is MITRE ATT&CK and how do you use it in your work?
- You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
- Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
- A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
- How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
- A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
- EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.