Technical screening questions
Ask for one example per question and listen for specifics.
- How do you triage a suspicious login? A good answer: Context, source, user history and containment.
- What is a false positive and how do you reduce them? A good answer: Tuning and feedback.
- How do you handle a phishing report? A good answer: Analyze headers and links, scope and remediate.
- What do you include in an incident ticket? A good answer: Timeline, evidence, impact and actions.
- When do you escalate? A good answer: Defined severity thresholds.
Quick screening questions
Use these when you have only a few minutes.
- Walk me through triaging a phishing alert.
- How do you reduce false positives?
- When do you escalate an incident?
What separates the levels
Match the level to the requirement before you submit.
- Tier 1: triages alerts using runbooks.
- Tier 2: investigates and contains.
- Tier 3: hunts threats and improves detections.
Red flags
Any of these is a reason to probe further.
- Tools listed, no triage example.
- Cannot describe an incident.
- Certification only.
Tools you should hear mentioned
A SOC analyst with real experience usually names several of these without prompting.
- Splunk, Sentinel or QRadar
- EDR tools
- Ticketing
- MITRE ATT&CK
- Threat intelligence
- Playbooks
Run the call well
Ask for the last project first, then dig into the second or third question. Take notes on versions, team size and outcomes, and record them with the submission so the vendor’s later technical interview does not surprise you.
Frequently asked questions
How long should a SOC analyst screening call take?
Fifteen to twenty minutes is enough to cover the project, three technical questions and availability, rate and work authorization.
Do recruiters need to know the technology?
Working vocabulary is enough. Use the sourcing guide for the role and listen for specifics instead of judging technical depth yourself.