Remote cybersecurity analyst interview questions and answers
SOC and cybersecurity analyst interviews are practical. Expect networking and operating system basics, a walk-through of how you'd investigate an alert or phishing email, some SIEM query questions, and situational questions about incidents and escalation. Remote employers, especially managed security providers, add questions about shift work, handovers and how you secure your own setup.
The questions below are the ones that come up most often, with what a good answer covers.
Updated October 2026 by the WorkRemote careers team
On this page
About the role and your experience
Openers that check you understand the job and have done the work.
Why do you want to work in security operations?
Why they ask
They want to know you understand the job, including the repetitive parts, and aren't just attracted by "hacking".
How to answer
Show you know what SOC work involves, mention what you've done to prepare, and refer to something you follow (an incident write-up, a threat report).
Show a sample answerHide the sample answer
I like investigation: taking a few odd log lines and working out what really happened. I've spent the past year in IT support at a bank in Lagos, where I helped the SOC with phishing cases, and I've built a home lab with Sysmon and Wazuh. I read incident write-ups every week, and I know a lot of the work is careful triage, which suits me.
Technical questions
What you know and how you'd do the work, often with a live task or test.
Explain the TCP three-way handshake.
Why they ask
A basic networking check. It also leads into questions on scans and connection-based attacks.
How to answer
Client sends SYN, server replies SYN-ACK, client sends ACK, and the connection is established. Mention that a SYN flood abuses this by sending many SYNs and never completing, and that many scanners send SYNs to see which ports answer.
Show a sample answerHide the sample answer
The client sends a SYN with its starting sequence number, the server responds with SYN-ACK, and the client confirms with ACK. In logs, lots of SYNs from one IP to many ports with no completed connections usually means someone is port scanning us.
Which ports and services should every analyst recognise?
Why they ask
You'll read firewall and network logs constantly. Unusual ports are often the first clue.
How to answer
List the common ones with what they are and why they matter for security.
Show a sample answerHide the sample answer
22 for SSH, 25 for SMTP, 53 for DNS, 80 and 443 for HTTP and HTTPS, 445 for SMB, 3389 for RDP, 88 for Kerberos and 389 or 636 for LDAP. RDP or SMB exposed to the internet is a big red flag, and lots of DNS traffic to odd domains can mean tunnelling or malware talking to its server.
What is the difference between hashing, encryption and encoding?
Why they ask
These are often confused. Analysts use all three when handling files, passwords and obfuscated commands.
How to answer
Encoding changes the format for transport and isn't security (Base64). Encryption protects confidentiality and is reversible with a key (AES, RSA). Hashing is one-way, used for integrity and password storage (SHA-256; passwords should use slow hashes like bcrypt or Argon2).
Show a sample answerHide the sample answer
Base64 is just encoding: anyone can decode it, which is why attackers use it to hide PowerShell commands from casual reading. Encryption needs a key to reverse. A hash like SHA-256 can't be reversed, so I use file hashes to look up malware on VirusTotal and to check a file hasn't changed.
Walk me through how you'd investigate a phishing email a user reported.
Why they ask
The most common case in most SOCs. They want a structured, complete process.
How to answer
Check headers (sender, return-path, SPF, DKIM, DMARC results), analyse links and attachments safely (URLScan, sandbox, hash lookups), find all recipients, check who clicked or entered credentials, then contain: block sender and URL, purge the email, reset passwords and revoke sessions for anyone affected. Document and tell the user the outcome.
Show a sample answerHide the sample answer
I'd look at the headers first: the display name says our CEO, but the return-path is a Gmail address and DMARC failed. I'd run the link through URLScan in a safe environment; if it's a fake Microsoft login page, I search email logs for everyone who got the same message, purge it, and block the domain. Then I check proxy and sign-in logs for anyone who clicked, reset their passwords and revoke active sessions. Finally I close the ticket with notes and thank the user who reported it.
You get an EDR alert: winword.exe spawned powershell.exe with an -EncodedCommand argument. What do you do?
Why they ask
A classic malicious-document pattern. It tests triage, decoding and containment decisions.
How to answer
Treat it as likely malicious: Word rarely starts PowerShell. Look at the process tree, decode the Base64 command, check network connections and files created, check whether the document came by email, and isolate the host if it looks real. Then search for the same indicators on other machines.
Show a sample answerHide the sample answer
Word launching PowerShell is suspicious on its own. I'd decode the Base64 (it's UTF-16LE) to see what it runs; often it downloads a second stage. I'd check the process tree and network connections for the download URL, look for the email that delivered the document, and isolate the laptop through the EDR if anything was downloaded or executed. Then I'd hunt for the same hash, URL or command line across all endpoints and escalate to tier 2.
Write a query to find possible brute-force attempts against Windows logons.
Why they ask
SIEM querying is the daily job. Brute force is the most common first query people write.
How to answer
Filter failed logons (Windows event ID 4625), group by source and time window, and set a threshold. Mention checking for a success (4624) afterwards from the same source.
Show a sample answerHide the sample answer
In Microsoft Sentinel with KQL:
```kql
SecurityEvent
| where EventID == 4625
| summarize Attempts = count() by IpAddress, TargetAccount, bin(TimeGenerated, 10m)
| where Attempts > 20
```In Splunk:
index=wineventlog EventCode=4625 | bin _time span=10m | stats count by _time, src_ip, user | where count > 20. Then I'd check whether any of those sources later had a successful 4624 logon.What signs would suggest an attacker is moving laterally in the network?
Why they ask
Spotting lateral movement is the difference between one infected laptop and a company-wide breach.
How to answer
Mention unusual logons between workstations (event 4624 logon type 3 or 10 from unexpected hosts), use of PsExec, WMI, WinRM or RDP by accounts that don't normally use them, new services or scheduled tasks on remote machines, and Kerberos anomalies. Map to MITRE ATT&CK lateral movement techniques.
Show a sample answerHide the sample answer
I'd look for one account logging on to many machines in a short time, especially workstation to workstation, which normal users rarely do. RDP or PsExec from a user's laptop to a server, a new service being created remotely (event 7045) or admin shares being accessed are all signs. I'd map them to ATT&CK techniques like remote services and then check the first machine for how they got in.
What is the difference between a false positive and a false negative, and how do you reduce noisy alerts?
Why they ask
Alert fatigue is a huge problem in SOCs. They want analysts who improve detections, not just close tickets.
How to answer
False positive: an alert that isn't malicious. False negative: a real attack with no alert, which is worse. Reduce noise by tuning rules with specific exclusions, adding context (asset criticality, known admin tools), and reviewing the change so you don't create blind spots.
Show a sample answerHide the sample answer
A false positive is the backup server's scheduled script flagged as suspicious PowerShell every night. A false negative is an attacker doing the same thing unnoticed. I'd tune the rule to exclude that exact script path and service account on that server only, not all PowerShell, and record the change so the team can review it.
What is MITRE ATT&CK, and how do you use it?
Why they ask
It's the shared vocabulary of most SOCs and detection teams.
How to answer
Explain it's a knowledge base of attacker tactics (the goal, like persistence) and techniques (the method, like scheduled tasks). Analysts use it to classify alerts, see what attackers usually do next, and find gaps in detection coverage.
Show a sample answerHide the sample answer
It's a catalogue of how real attackers operate, organised by tactics like initial access, persistence and exfiltration. When I see a phishing alert, ATT&CK reminds me what usually follows, such as credential theft and new mailbox rules, so I check for those too. Teams also map their detections against it to find what they can't see.
What are the phases of incident response?
Why they ask
Checks you know there's a process beyond "fix it".
How to answer
Use the NIST model: preparation; detection and analysis; containment, eradication and recovery; post-incident activity (lessons learned). Give an example of what happens in each.
Show a sample answerHide the sample answer
Preparation is playbooks, logging and access set up before anything happens. Detection and analysis is confirming the incident and its scope. Containment might be isolating hosts or disabling accounts, eradication removes the malware or persistence, and recovery brings systems back safely. Afterwards we review what happened and fix the gaps so it doesn't repeat.
A scan shows 400 vulnerabilities. How do you decide what gets fixed first?
Why they ask
Vulnerability management roles are common remote security jobs, and prioritisation is the skill.
How to answer
Not just by CVSS score. Prioritise vulnerabilities known to be exploited (for example on CISA's Known Exploited Vulnerabilities list), on internet-facing or critical systems, with public exploit code. Then work with system owners on realistic deadlines.
Show a sample answerHide the sample answer
I'd start with anything on CISA's Known Exploited Vulnerabilities list on internet-facing systems, like a VPN appliance or web server, even if its CVSS is lower than an internal finding. Then critical systems holding customer data. A 9.8 on an isolated test box can wait behind a 7.5 that attackers are exploiting on our public servers.
Behavioural questions
Past situations. Answer with a real example: what happened, what you did, what changed.
Tell me about a time you made a mistake in an investigation.
Why they ask
Everyone misses things. They want honesty and evidence that you learn and escalate.
How to answer
Choose a real, contained mistake. Explain how it was found, what you did and the habit you changed.
Show a sample answerHide the sample answer
Early on, I closed an alert for an unusual sign-in as a false positive because the user was travelling. A colleague later noticed the same account created a mailbox forwarding rule. I reopened it, we reset the account and removed the rule. Since then I always check what an account did after a suspicious sign-in, not just where it signed in from.
Situational questions
Hypotheticals about problems you'd meet in the job.
During a night shift you see signs of ransomware spreading on a client's file server. What do you do?
Why they ask
Tests whether you'll act quickly and follow escalation rules under pressure.
How to answer
Follow the client's playbook: escalate immediately to the on-call lead and the client's contact, contain what you're authorised to (isolate affected hosts through EDR, disable compromised accounts), preserve evidence, and keep a timeline. Don't wait until morning.
Show a sample answerHide the sample answer
I'd call the on-call tier 2 lead straight away and follow the client's escalation list, phoning their emergency contact rather than just emailing. If our contract allows it, I'd isolate the affected server and any machines showing the same activity through the EDR, and disable the account the encryption is running under. I'd keep a timestamped log of everything I saw and did, and avoid rebooting machines so evidence isn't lost.
A senior executive asks you to turn off multi-factor authentication on their account because it's inconvenient. How do you respond?
Why they ask
Security analysts constantly deal with pressure from powerful users. They want firm but polite handling.
How to answer
Don't do it yourself, explain the risk simply, offer an easier MFA method (an authenticator app with number matching, or a security key), and escalate through the proper approval process if they insist.
Show a sample answerHide the sample answer
I'd explain that executive accounts are the most targeted, so MFA matters more for them, not less. Then I'd offer to make it easier, for example setting up the Microsoft Authenticator app or a hardware key so they tap once instead of typing codes. If they still want it off, that's a risk decision for the security manager, so I'd pass it up in writing.
Remote work questions
How you'll work from Nigeria with a team elsewhere: hours, power, internet, communication.
How do you hand over cases at the end of a shift?
Why they ask
In a 24/7 remote SOC across time zones, bad handovers cause missed incidents.
How to answer
Explain the written handover you do: open cases, status, next steps, anything waiting on clients, and a short verbal or video handover for anything serious.
Show a sample answerHide the sample answer
Before my shift ends I update every open case with what I've checked and what's next, then post a handover in the team channel listing open cases by priority. For anything active, like a host we're watching, I do a quick call with the incoming analyst so nothing gets lost between time zones.
How do you secure your own home work setup?
Why they ask
A security analyst working from home is a target. Employers need to know you take it seriously.
How to answer
Mention a dedicated work device, full-disk encryption, a private room, updated router firmware and changed default passwords, the company VPN, no sharing of the device, and MFA everywhere.
Show a sample answerHide the sample answer
I use the work laptop only for work, with full-disk encryption and the company's VPN and EDR. Nobody else at home uses it. My router firmware is updated and the admin password changed, and I have a separate Wi-Fi network for family devices. I work from a private room so no one can see my screen.
Can you work night shifts, and what is your power and internet backup?
Why they ask
SOC coverage depends on analysts being online for their whole shift.
How to answer
Be honest about which shifts you can cover, then give specific backup arrangements.
Show a sample answerHide the sample answer
Yes, I've worked rotating shifts before and I can cover your night-time hours, which line up with UK nights. I have an inverter with batteries and solar, so power cuts don't take me offline, plus a fibre connection and a 4G MiFi on a different network. If both ever failed mid-shift, I'd tell the shift lead immediately so they could cover my queue.
Remote interview tips
Practise talking through a live triage. Many interviews give you logs or an alert and ask you to explain what happened. Think out loud: what you'd check first, what would make it real or a false positive, and when you'd escalate.
Have your lab ready to show. A GitHub repo or blog with your detection queries, a home lab diagram and one or two investigation write-ups gives the interviewer something concrete to discuss.
Ask about shifts and location rules early. Ask which hours you'd cover, how the rota works, and whether any clients restrict who can access their data. It saves you from discovering a blocker at the offer stage.
Expect background checks. Have your NIN, certificates and previous employers' contacts ready. Delays in background checks are a common reason remote security offers stall.
Double-check time zones. Write "9pm GMT / 10pm WAT" style times in your replies, and watch the March and October clock changes when shifts are involved.
Questions people ask
What questions are asked in a SOC analyst interview?
Expect networking basics (TCP handshake, ports, DNS), Windows logs and Active Directory, phishing investigation, alert triage scenarios, SIEM queries in KQL or SPL, MITRE ATT&CK and incident response phases. Many interviews include a practical triage exercise.
Are there practical tests in cybersecurity interviews?
Often, yes. SOC interviews may give you logs, a packet capture or a suspicious email to analyse live or as a take-home. Practising on Blue Team Labs Online or TryHackMe SOC rooms is good preparation.
How should I answer if I don't know a technical question?
Say you don't know, then explain how you'd find out, for example which logs you'd check or what you'd search. Interviewers prefer honesty and a sensible method to a confident wrong answer, which is a bad sign in an analyst.
Do remote security jobs do background checks on Nigerians?
Yes, most do, often through a third-party provider. They may check identity, education, past employment and criminal records, so keep documents and referees ready.
Updated October 2026 by the WorkRemote careers team
Interview questions for roles close to cybersecurity analyst
- IT Support Specialist
An IT support specialist keeps a company's own staff working: resetting passwords, fixing laptops and accounts, setting up new starters and answering help desk tickets. You can do it remotely from Nigeria on service desks, at managed service providers and in remote-first companies, but a large share of IT support still needs someone on site, so read every ad's location line.
- Cloud Engineer
A cloud engineer builds and looks after a company's setup on AWS, Microsoft Azure or Google Cloud: the networks, permissions, servers, databases and storage, and the monthly bill. You can do it remotely from Nigeria, and it's one of the infrastructure roles where a certificate genuinely helps, but you'll still need hands-on projects to get past the technical interview.
- DevOps Engineer
A DevOps engineer builds and runs the machinery that takes code from a developer's laptop to production: CI/CD pipelines, Docker images, Kubernetes clusters and Terraform-managed infrastructure. It is very doable remotely from Nigeria, but it is rarely a first tech job, because employers are handing you access to production.
- Compliance Analyst
A compliance analyst checks that a company follows the rules it is licensed under, which at fintechs and crypto firms mostly means KYC, anti-money laundering, sanctions screening and transaction monitoring. Remote compliance analyst jobs are open to Nigerians, especially at African fintechs and global crypto exchanges, though senior named roles such as a money laundering reporting officer usually have to sit in the licensed country.