AppSec Engineer — Screening Call

What this session covers

• OWASP
• Secure defaults
• Reviews
• Automation
• Collaboration

Questions you'll face

1. 1. Threat-model a customer-facing web application that stores identity documents. Where do you start and what do you prioritise?

   ~3 min

   Checks structured threat modelling over checklist recitation.

2. 2. An alert fires: a service account authenticated from an unusual location and enumerated storage buckets. Walk me through your response.

   ~3 min

   Detection and response instinct with evidence preservation.

3. 3. How do you make secure defaults easy for engineering teams rather than a review gate they route around?

   ~3 min

   Tests the paved-road mindset security seniors need.

4. 4. Explain the practical difference between a detection you can trust at 3am and one you cannot.

   ~3 min

   Assesses detection engineering maturity and alert fatigue awareness.

How the time is spent

1. 1

   Warm-up & context · 3 min

   Interviewer intro, your background, how the session runs.

2. 2

   Core questions · 15 min

   Role-specific questions with live follow-ups based on your answers.

3. 3

   Deep dive · 5 min

   One topic explored to the edge of your experience.

4. 4

   Your questions & wrap · 3 min

   Close the loop and hand over to feedback generation.