In this guide
Junior cyber security interviews in the UK usually test four things: networking and security fundamentals, how you'd handle a realistic alert, whether you've touched the tools, and how you behave under pressure. Prepare a clear answer for each type below and you'll be ready for most first-round interviews, whether the role is junior SOC analyst, security analyst or IT support with a security focus.
Interviewers aren't expecting you to know everything. They're checking how you think.
What fundamentals will they ask about?
These come up in almost every junior interview. Answer briefly and correctly, then stop talking.
"What is the CIA triad?" Confidentiality, integrity, availability. Give a one-line example of each: encryption protects confidentiality, hashing checks integrity, backups and redundancy protect availability.
"What's the difference between TCP and UDP?" TCP sets up a connection and confirms delivery. UDP doesn't, which makes it faster and suited to things like DNS lookups and streaming.
"Which ports should I know?" At minimum: 22 (SSH), 25 (SMTP), 53 (DNS), 80 (HTTP), 443 (HTTPS), 3389 (RDP). Be ready to say why exposed RDP is a common risk.
"What's the difference between an IDS and an IPS?" An intrusion detection system alerts. An intrusion prevention system can block.
"What's the difference between encryption and hashing?" Encryption is reversible with the right key, so it protects data you need to read later. Hashing is one-way, so it's used to check that a file or password hasn't changed. Mentioning that passwords should be stored hashed and salted shows you understand the practical side.
"Explain a false positive." An alert that fires on harmless activity. Then add why it matters: too many false positives cause alert fatigue, and real attacks get missed.
If any of these make you hesitate, revise networking before anything else. It's the foundation of most analyst work.
What scenario questions should you expect?
This is where interviews are won or lost. They'll describe a situation and ask what you'd do. There's rarely one right answer. They want a calm, ordered process.
"A user reports a suspicious email. What do you do?" Don't open attachments or links. Check the sender address and headers, look at where the links really point, check any URLs or file hashes against threat intelligence, search for the same email in other inboxes, and escalate or block based on what you find. Mention writing it up.
"You see repeated failed logins on one account. What next?" Check the source (one IP or many, internal or external), the time pattern, whether any login eventually succeeded, and whether the account is privileged. On Windows, knowing that event ID 4625 is a failed logon and 4624 a successful one is a nice touch.
"A laptop looks infected. Walk me through it." Isolate it from the network (most EDR tools can do this remotely), preserve evidence, don't just wipe it, identify what ran and how it got there, check whether other machines show the same signs, and follow the incident process.
"You're on a night shift and an alert says files are being renamed rapidly on a file server. What do you do?" That pattern can point to ransomware. Say you'd confirm quickly (which account, which host, how many files), follow the incident playbook, escalate straight away to the on-call lead rather than investigating alone for an hour, and help contain it by isolating the affected machine if your procedures allow. Speed and escalation matter more than a perfect diagnosis here.
A useful habit: say your steps out loud in order, and say when you'd escalate. Junior analysts who know when to ask for help are valued.
Will they ask about tools?
Usually, yes. On IT Jobs Watch, SIEM was mentioned in 30.2% of the 149 permanent UK SOC analyst ads in the six months to November 2026, Splunk in 19.5% and incident response in 22.1%. Expect questions like "Have you used a SIEM?" or "How would you search for this in Splunk?"
If you haven't used one at work, don't bluff. Say what you've done in your own lab: "I set up Splunk's free trial, sent Windows event logs to it, and wrote searches to find failed logins by user and source IP." That's a strong answer from a junior candidate.
Some employers add a short practical test: reviewing a set of logs, analysing a phishing email or answering written scenario questions. Practise by working through free log samples and timing yourself. Show your reasoning in writing, even if you're unsure of the final answer.
Our SOC analyst guide lists the tools most teams use.
What behavioural questions come up?
Security work involves shifts, pressure and mistakes, so expect questions like:
- Tell me about a time you made a mistake. What did you do?
- Describe a time you had to follow a strict process.
- How do you stay calm when something goes wrong?
- How do you keep up with new threats?
Use the STAR shape (situation, task, action, result) and keep each answer under two minutes. Your examples don't need to be from IT. A retail incident, a complaint escalation or a data error at work all count if you show judgement and honesty.
For the "keeping up" question, name real sources you read or listen to. Interviewers can tell when you've made it up.
How do you get the interview if your CV has no experience?
This is the harder part for most people. The government's 2026 cyber skills report found only 16% of core cyber postings in 2025 targeted people with under a year's experience, so your CV has to work hard.
A few rules for a cyber security CV with no experience:
- Open with two lines on the role you're targeting and what you bring.
- Put a "Projects" section above your work history. Describe each lab with the tools used and what you found.
- List certifications (Security+, Network+) clearly near the top.
- Rewrite old job bullets to show procedure, incidents handled and care with data.
- Keep it to two pages and cut the generic "passionate about cyber" lines.
Then apply to a mix of junior security and IT support roles. Our entry-level cyber security jobs guide lists titles worth searching for.
What should you ask them?
Always have three questions ready. Good ones for a junior security role:
- What does a normal shift look like for someone in this role?
- Which SIEM and EDR tools do you use?
- How are new analysts trained in the first three months?
The last one matters. A role with no training plan will be a hard place to learn.
How Experiencely can help
Interviewers keep asking the same thing in different ways: what have you actually done? Our cyber security programme gives you an answer. It includes training and five CompTIA certifications (A+, Network+, Security+, CySA+ and PenTest+), exam vouchers included, plus a live security project. You're placed within 48 hours and work about an hour a day for three months, fully remote. It costs £2,495, and if you're not hired within 60 days of finishing, you get your money back (conditions apply).
Frequently asked questions
What questions are asked in a junior cyber security interview?
Expect a mix of fundamentals (the CIA triad, common ports, TCP versus UDP), scenario questions (what would you do with a suspected phishing email or an infected laptop), tool questions about SIEMs such as Splunk or Sentinel, and behavioural questions about pressure, mistakes and working on shifts.
How do I prepare for a SOC analyst interview with no experience?
Build one small home lab, such as a free SIEM receiving logs from a test machine, and practise explaining an investigation from start to finish. Revise networking basics and Windows logon events. Prepare three short stories from previous jobs that show calm judgement, clear notes and following a process.
How do I write a cyber security CV with no experience?
Lead with a two-line summary of the role you want, then a projects section above your work history. Describe one or two labs in concrete terms: tools, what you did, what you found. List certifications such as Security+, and rewrite past job bullets to show procedure, incident handling and data care.
What should I ask at the end of a cyber security interview?
Ask what a normal shift looks like, which SIEM and EDR tools the team uses, how alerts are escalated, and what training a new analyst gets in the first three months. Good questions show you understand the work and help you judge whether the role will teach you anything.
Sources
Figures are taken from the sources below. Salary ranges are indicative and individual offers vary. Last checked 9 November 2026.