I've sat on a lot of cyber and IT interviews over the last few years. Some of them I've run myself, some of them I've been the second or third person in the room. Either way, after a while you start to pick up on patterns.

The thing that surprised me was that the patterns are not really technical.

I went in expecting the candidates who answered the technical questions cleanly would be the ones I'd want to hire. And don't get me wrong, the technical stuff matters. You need a baseline to do the job. But the candidates that actually ended up being the strongest hires almost always shared a different set of traits that had basically nothing to do with whether they could tell me cold how DNS resolution works or what TCP port LDAPS runs on.

I wanted to put this one out there because if you're prepping for a cyber interview right now, I think you're probably over-indexing on the wrong stuff. You're rereading the OWASP Top 10 and trying to memorize ports. That stuff is fine to know. It's not what's going to get you the offer.

Here's what actually does. And before I get going, these patterns are not specific to cyber. They show up in pretty much every IT interview I've been a part of, whether it was help desk, sys admin, network engineer, or SOC analyst. So if you're not aiming at cyber specifically this still applies to you.

1. They Communicated Clearly Without Overexplaining

This one I started picking up on really fast.

The candidates that ended up being good hires gave tight answers. You asked them a question, they gave you a real answer in 30 seconds to a minute, and they stopped. If you wanted more they were happy to go deeper. But they didn't fill silence with extra words just to feel like they were saying enough.

The candidates I had noted some things on went different way. They'd take a simple question and turn it into a 4 min monologue. Halfway through I'd forget what I asked to be honest (sometimes). By the time they wrapped up I usually wasn't sure what their actual answer was but time in our window had already been chewed up.

In cyber and IT this matters way more than people realize. Most of what you do on the job is communication. Ticket updates, incident reports, exec briefings, cross team handoffs to engineering. If you can't be concise in a 30 min or so intro interview, you're not going to be concise in a Sev 1 bridge at 2 AM, and that's the kind of thing that ends up being a real problem on a team.

If you're prepping for interviews, the move here is pretty simple. Practice answering questions out loud and time yourself. If your answer is going past a minute and a half, you're probably overexplaining. Pick the two or three things that actually matter and cut the rest. Of course if they want more detail in your answers that's possible too but I typically would recommend asking how deep they'd like you to go if you feel yourself trailing off.

2. They Owned What They Didn't Know

This was the one that probably stood out to me the most.

The candidates I ended up hiring quite often had a moment of almost I'd say humility in the interview where they hit a question they didn't know the answer to. And the way they handled it was usually pretty similar. They said "I haven't worked with that yet" or "I'm not sure about that one specifically, but here's how I'd start trying to figure it out." Then they moved on. No panic. Remember we work in IT / Cyber, there's a million things. Not too worried about what you do know or memorized, more so what you don't know and having a glimpse of how'd you work with it.

The candidates that didn't get the offer almost always did the opposite. They tried to BS through it. They'd take a question they had no clue on and try to talk their way around it. Sometimes they'd land in the right area. More often they'd say something completely wrong and then look at me waiting for me to nod. It's tough in the moment sometimes but just remember that you're not interviewing for an acting role to memorize lines, we're going to see things we need to look further into nearly every day in this field.

Here's the deal. Cyber and IT are too deep for anyone to know all of it. I don't know all of it. Nobody on my team knows all of it. What I really need from somebody I'm hiring is that they can recognize the edge of what they know and not try to pretend it doesn't exist. Because the candidate who BSes me in an interview is the one who's going to BS the team during a real incident, and that's how minor alerts snowball, or projects get kicked down the road/

If you're prepping for interviews, just practice saying "I haven't done that yet but here's how I'd approach it." That sentence alone more often than not owns brownie points from the interviews I've been in.

Before the interview, the resume has to clear the bar. Free Resume Red Flags Checklist here if you'd like to check it out. I believe it just asks for an email otherwise it's free (can not figure out how to just make it downloadable) : JBird Resume Red Flags

3. They Asked Smart Questions Back

There's always a moment at the end of an interview where I ask "do you have any questions for me?" And it's a real signal.

The candidates with no questions, or who ask the basic ones they could have pulled off the company's careers page, almost never end up being the strongest hires. I'm not saying they're bad people. I'm saying the trend is real and I've watched it play out over and over. Trust me I myself used to ask questions that are literally probably on Glassdoor because I always didn't put too much weight here.

The candidates who ask good questions stand out fast. What does the on call rotation actually look like? How does the team handle a Sev 1 outside of business hours? What does success look like in this role at the six month mark? Is there a path for somebody who wants to grow into engineering, or does this seat tend to stay in detection? Who would I be sitting closest to on the team? What could someone who takes this role accomplish in the first year that would make your team feel like you hit it out of the park with the hire?

A few things happen when a candidate asks questions like that. First, they're telling me they're actually thinking about whether this role is the right fit for them. Not just whether they can pass the interview. Second, they're telling me they have some real experience to draw from, because somebody who's been on a cyber team before knows the on call piece is going to matter to their life. Third, they're showing me they're a peer in the conversation, not just somebody trying to clear a hurdle.

If you're prepping and you don't have three or four real questions ready to ask, you're leaving a lot on the table. Write them down before the call. Have them in front of you. Think of questions that you actually would want to know the answer to not just about the companies culture, they probably have a robotic answer for that one anyways lol.

4. They Had Real Stories, Not Just Recited Concepts

This one's the killer for the over prepared candidate. (Not that being overprepared is a problem, but there is stark difference in being overprepared vs over rehearsed to the point it's almost robotic.)

I can usually tell within about two questions whether somebody actually does the work or whether they've just memorized a bunch of cyber concepts for the interview. Both groups can answer the surface question. The difference shows up the second I ask any kind of follow up.

The candidates with real experience can tell me about a specific time. A specific phishing email they picked apart. A specific incident they handled. A specific tool they got stuck on and what they did to figure it out. A specific home lab they broke and how they fixed it. The details aren't always pretty. Sometimes the story is "I broke my home lab for three days and then realized it was a DNS issue." That's fine. That's a real story that we all know too well unfortunately for the matter.

The candidates without real experience can recite the OWASP Top 10. They can name the MITRE ATT&CK tactics. They can explain what a SIEM is at a high level. But when I ask them to walk me through an actual investigation they did, or an actual phishing email they analyzed, or an actual lab they built, the answer is relatively thin and somewhat like what you would expect to have to memorize for an exam. You can tell pretty quickly.

If you're prepping for interviews, the move here is to build a small bank of two or three real stories you can pull from. They don't have to be glamorous. A phishing email from your spam folder is fine. A TryHackMe room you actually struggled on and finished is fine. A weird thing you noticed in your home network logs is fine. What matters is that they're yours and you can talk through them like a person and not like a flashcard.

5. They Were Curious in a Way You Couldn't Fake

The strongest hires I've made all shared this last trait and it's the hardest one to coach. To be frank it was also one that I hard time clocking when I FIRST started leading the hiring. They were curious about cyber in a way that just showed up.

You ask them what they've been reading. They have an answer. Specific researchers, specific blogs, specific writeups they thought were interesting. You ask them what they've been working on in their free time. They have an answer. A home lab they're building, a Python script they wrote to parse their own DNS logs, a Pi-hole they set up at their parents' house. You ask them what they think about a recent incident in the news. They have an opinion, and it's their opinion, not somebody elses. This stuff is cool. Remember we are not just hiring for the position in the JD but also a co worker. People forget we're spending 40 works a week together in at least some capacity (yes i am aware of hybrid and remote work).

The over prepared candidates can sometimes get close to this in an interview. They've watched the John Hammond videos. They've got the TryHackMe badge. They can name the right names. But the depth isn't there. You ask one follow up question and the answer gets noticeably generic really fast.

You can't really fake curiosity in an interview because curiosity is built up over months of doing weird side projects nobody asked you to do. If you've been doing them, it shows. If you haven't, no amount of cramming the week before the interview is going to get you there. Again this is also for the weird projects you may have found yourself in too deep with at your current role if your'e not coming from a no experience background. Trust me, it sounds ridicolous but I actually do want to hear the borderline obesssive passion projects in your last job.

If you're at the start of this and you don't have that kind of background yet, the move is to start now. Pick one thing that genuinely interests you in cyber, even if it's small, and just start doing it. Pull apart a phishing email a week from your spam folder. Set up a free tier cloud instance and watch what hits it. Pick a security writeup once a week and read it all the way through. Six months from now you'll have real stories to tell in interviews. There's no shortcut here. And if there is, you are in the wrong industry and should look into becoming a full time actor because that means you fooled me.

Wrapping This Up

If you read this whole thing and you're noticing that none of the five things have much to do with how many certs you have or which ones, that's the point.

I'm not saying certs don't matter. The Security+ still gets you past a lot of HR screens. The CySA+ or a cloud cert can move you up the stack. They're real. But once you're sitting in the actual interview chair, the certs on your resume are basically a footnote. The interview is about whether you can communicate, whether you can own what you don't know, whether you're paying attention to the role, whether you have real stories to draw from, and whether the curiosity is actually there.

If you're hiring, what's a trait you've started weighting more than you used to? And if you're job hunting, which of these five do you think is your strongest? Did I miss anything? Please drop a comment because I'm sure I didn't just magically come up with the golden rules for hiring.

More resources for the cyber and IT career path, from resumes to interview prep to SOC analyst toolkits can be found over at JBird Cyber!