Ethical Hacker Community Forums

Hello everyone, last week or so I saw a local advertisement for a job opening as an Information Security Specialist. The job description included knowledge of TCP/IP, Security Monitoring/Analysis, Pentesting, Computer Forensic, configuring and administering Firewall/NIDS and etc. The company that posted the ad is a well known financial corporation where I live and well... I decided to submit my resume and see what it has to offer.

That same week I quickly received a call from the company and a date was schedule for the interview. In my day of the interview I met with the CISO (Chief Information Security Officer) and the following technical were asked:

- Explain TCP/IP and mention its layers.
- Explain layer 2 of the OSI model.
- Explain layer 3 of the OSI model.
- Difference between TCP and UDP.
- Difference between Telnet and SSH.
- How does SSH encrypts the data?
- Explain how fragmentation occurs within a network.
- Define Malware?
- What is a sniffer and what is it used for?
- What is Netcat and what is it used for?
- What is a Buffer Overflow and what is it used for?
- The interviewer drew a diagram on a piece of paper consisting of two machines in a LAN, a Gateway and a Web Server in the Internet hosting a financial site via HTTPS. Explain how an attacker (Machine A) could sniff traffic from victim (Machine B) and is the attacker able to see the encrypted data and how was this accomplished. How can the victim know that he was being attacked by the attacker?

I did pretty good and answered all the questions. He was somewhat impressed. He told me that I was the first to answer all the questions and that I'm the person he was looking for. He went on saying that these questions were easy, however, the candidates he interviewed that day were having difficulty answering them.

Well, now I just have to wait and see if I get the job offer and if the salary and compensation package is better than my current job.

Great post.

Not only is it great to see that there are employers out there checking candidates properly, but it is also good to know what they're asking.

There will always be the braindump type of mentality that will memorize the questions you posted before they go into their next interview, but I think most here will understand that the questions to these basic questions need to be known.

Is it necessary to know everything about a job before you go for it... no. But there should be some good general knowledge going in.

Keep us posted. We're all interested in how this turns out.

Don

Wow, yeah that's really interesting.

Out of curiosity, were you asked about your certifications at all? I've seen either in other posts here, or elsewhere, that sometimes people don't understand the CEH and may question it. Just wondering if the CISO had asked about that or the OSCP at all and what that conversation included.

Good luck with the job and all, hope it works out! Keep us informed :)

Hey thanks...

and yeah, the CISO did recognized all of my certs and especially the OSCP. He mentioned that he uses BackTrack for his pentesting and he knew about Offensive Security 101 course. Other than that he really didn't delve into asking about my certs, he just started blasting technical questions at me. However, it appeared that he does value certs. This was evident in their job posting. It mentioned that they would preferred a candidate with a CISSP cert. I don't have this yet but I'm definitely going to take it in the near future. Hopefully, with the certs I currently hold will make up for the lack of the CISSP.

The CISO was not the only person I was interviewed, I also met with one of their company's HR managers. Now she was really intrigued about my certs and ask a lot of questions about it. Like for example, where have I taken the courses and what the certifications meant. Surprisingly, she was so interested because she has a son that just recently graduated from College majoring in Computer Science. She one way or another acknowledged that having certifications is important for today's IT professional. She than began asking for my advice for her son on how to obtain certifications. I basically gave pointers on local technical schools that offer certification review courses and importantly pointing out to her that the certs I hold pertains to security. I wanted to clarify this so I told her that her son should go after certifications that are based on his interest and focus solely on those that are relevant to the career path he wants to take. She didn't mention to me if her son was into Computer Security. Anyways, the interview with HR went smoothly and I was fortunate to had been interview by someone who was down to earth and had interest in the subject matter.

Well now I just have to wait and see if they send me a job offer. I will definitely keep you guys posted.

Sounds like you have something promising going, congrats! let us know how it turns out.

I recently interviewed for a security opening and for the first time ever I was given a written Perl exam. Some of it was really basic, but there were large sections of code and sytax that I had to analyze and write out what it was doing and also I had to write out code myself. I think I got about an 80% on it, however what was odd, what that nowhere in the Job req did it mention perl.
Kinda of strange, and the panel interviews were just a nonstop technical barrage of really specific questions, not just explain what a firewall is or something lame like that. I was so impressed with their interview, it would be really hard to turn down an offer from them if I got it. Oh well, will wait and see.

Good luck oleDB! I hope everything goes well for you. The job does sound promising.

Well, anyways, today I received a call from the HR manager and she said I was chosen for the job position. She set an appointment to discuss salary and such. Let see how it goes. Got to polish my negotiating skills, lol.

Awesome, congrats!

Don

Thanks!!  ;D

Many Congrats!!!!!!!!!! :)

Thanks again, I'm currently at the negotiating table. Let see what happens.

Good luck mate!

That was a much harder job interview than mine.
Mine was: I walk in.
"How are you doing?"
"Greatttt... So you know about computers?"
"Yes sir I do."
"Greatttt.... So when can you start?"

and I have just moved up from there.

Finally after some negotiating I got the job!! I'm excited and looking forward to work for this company. Their security department is new and a lot of work needs to be done. Let see how it goes.

Congratulations blackzarro!

Good luck with your new position!

Well done.

Sounds like there's an article in there somewhere...  :-\

Don

Awesome! Congrats :)

(First of all, Congrats on the hire)
This post caught my eye because I end up doing most of the technical interviews for my firm.  For the rest of the folks out there that might be interviewing in the near future, make sure to try and get a specific job description in addition to the title of the position.  Most of the people I interview are sent to me by the HR/Recruiters, and all they've been given are a generic job title and description (ie "IT Security Consultant").  The problem is that we are usually trying to fill several positions at once, and since the recruiters don't have the background to understand most of the technical aspects of the job they just throw all of the "security guys" together and send them to us.  We are expected to figure out during the interview what position, if any, the person would fall into.  So, as a bit of advice, try to find out before hand the specifics of the actual position for which you will be interviewing.  Most of the time the position will fall into one of three slots: auditors, vulnerability assessment, and pen testing.  If you see audit key words (controls, regulations, etc) you'll be expected to speak to stuff like SOX, HIPPA, FISMA, and so on.  If you see general security words (common tools, scanners,etc) then expect to be able to speak to the general OSI model, the scanners, types of exploits, stuff along the lines of the original poster's questions.  If you see anything about doing manual exploits then you'd better be comfortable speaking to application hacking, zero day exploits, client side attacks, and so on.  There is nothing more uncomfortable for the interviewer and person being interviewed than when the person being interviewed is completely in over their head.  Just my two cents...

Hi pseud0,

Not sure which post was your first, but welcome to the EH-Net community! After looking over your short resume posted in the other post, I'm sure you'll have plenty of valuable information to share with other members :)

The post above is a great resource for people looking to get into a security role. As you'll see, there are quite a few people that come here and ask "how do I get into security?"

Again, welcome :)

Bill

Bill,
  I've been a reader of the site for awhile, just never made an account.  Hopefully I'll bring something to the table other than comic relief.

Congrats.

hopefully ill be somewhere up there 10 years down the line

=]

Congrats

just out of curiosity how well did it go????(figures might help us)  :P