Security Architect interview questions, with worked answers

How to use these questions

Many rounds hand you a diagram and ask what worries you. Start with what the system protects and who would attack it, then go through identity, network, data and logging. Rank what you find by harm, and say what you would fix first and what you would accept for now.

What a security architect is expected to know

• The craft: security architectureDesign how a system or a company is protected, from identity and networks to data and logging., from reference designs to project reviews.
• The foundations: identity and access managementDesign who and what may reach each system, with least privilege, strong sign-in and regular reviews., networksRead and design networks, firewalls and segments well enough to judge what an attacker can reach. and encryption.
• The modern estate: cloud securitySecure cloud accounts, networks and services by design, with guardrails teams cannot switch off by mistake. and zero trustPlan a step-by-step move to zero trust, where every request is checked, wherever it comes from..
• The method: threat modellingRun threat modelling sessions that find the real risks of a design before it is built. and a management system such as ISO 27001Know what an ISO 27001 management system asks of the architecture and its evidence..

Tools are named in ads side by side and none is a must: Microsoft Entra ID and Okta for identity, HashiCorp Vault and the cloud providers' key services for secrets, OWASP Threat Dragon, IriusRisk or the Microsoft Threat Modeling Tool for threat models. Interviewers care about the design behind them more than about the product.

Threats, identity and the network

How do you build a threat model for a new system?

What they check: finding the real risks before the build.

Short answer: "A threat model is a structured look at what could go wrong with a design: what we protect, who might attack it, how, and what we do about each threat. I draw the data flows with the team, mark where trust changes, go through the threats at each boundary with a simple checklist, and agree the fixes with owners."

The full answer: Do it early and keep it short; an hour with the team before the build finds more than a long report after it.

A weak answer: "The penetration test finds the problems." Follow-up: "The team has no time for a workshop." Say what you do instead.

What does zero trust mean to you in a real design?

What they check: a buzzword turned into decisions.

Short answer: "Zero trust means no request is trusted because of where it comes from, such as the office network; each one is checked on who or what is asking, the state of the device and what is being reached. In practice: strong sign-in for everyone, access per application instead of to the whole network, and logging of every decision."

The full answer: It is a direction, not a product; plan it in steps, starting with the most valuable applications.

A weak answer: "We bought a zero trust product." Follow-up: "An old application cannot do modern sign-in." Say how you include it.

How do you design identity and access for staff, customers and machines?

What they check: identityDesign who and what may reach each system, with least privilege, strong sign-in and regular reviews., where most attacks start.

Short answer: "One identity per person or service, strong sign-in, and least privilege, which means each account gets only the access its work needs, for as long as it needs it. Admin rights are granted for a task and expire; machine identities get their own accounts and keys; access is reviewed with the owners."

The full answer: Customers need a different design from staff: easy sign-in, protection against account takeover, and their own privacy rules.

A weak answer: "Everyone in IT has admin rights." Follow-up: "A service account has had the same password for six years." Say what you do.

How would you segment a network that grew flat over the years?

What they check: limiting how far an attacker gets.

Short answer: "Segmentation means splitting a network into zones so that a break-in in one part does not reach the rest. I map which systems talk to which, put the most valuable ones in zones of their own, allow only the flows that are needed, and do it step by step, watching before blocking."

The full answer: Start in a monitoring mode; it shows the flows nobody documented before you break them.

A weak answer: "We put a firewall at the edge." Follow-up: "A production line stops when you block a flow." Say how you avoid that.

How do you decide what to encrypt, and who holds the keys?

What they check: encryption that really protects.

Short answer: "Data in transit always; data at rest by default, with extra protection for the most sensitive data. Key management is how keys are created, stored, rotated, used and destroyed; I keep keys in a managed key service or hardware module, separate from the data, with access for as few people and services as possible."

The full answer: Encryption is only as strong as the control over its keys; most failures are keys in the wrong place.

A weak answer: "The cloud encrypts everything anyway." Follow-up: "A regulator asks who can read the customer data." Say how you answer.

Where do secrets live in your designs, and how are they rotated?

What they check: a common, avoidable weakness.

Short answer: "Passwords, tokens and keys live in a secrets store such as HashiCorp Vault or a cloud provider's secret service, never in code or configuration files. Applications fetch them at run time with their own identity, and the store rotates them on a schedule and after any suspicion."

The full answer: Scan code repositories for secrets as well; the old ones are often still valid.

A weak answer: "The developers keep them safe." Follow-up: "A key was pushed to a public repository." Say what happens in the next hour.

Designs, risks and partners

What does secure by design mean in a project you join late?

What they check: making progress when the ideal moment has passed.

Short answer: "Secure by design means security decisions are part of the design from the start, so the safe choice is the default. When I join late, I run a short threat model, fix what is still cheap to change, and turn the rest into a plan with dates, so the next release is better than this one."

The full answer: Ask to be invited earlier next time by being useful this time.

A weak answer: "I stop the release." Follow-up: "Go-live is in two weeks." Say what must be fixed before.

A team cannot meet a security standard in time. How do you handle the risk exception?

What they check: risk decisions made by the right people.

Short answer: "A risk exception is a recorded decision to accept a gap against a standard for a limited time. I describe the risk in business terms, propose controls that reduce it meanwhile, and have the business owner, not security, sign it with an end date."

The full answer: Review exceptions before they expire; a forgotten exception becomes the standard.

A weak answer: "I approve it to keep the project going." Follow-up: "The same team asks for its third extension." Say what you do.

How do you judge the security of a third party or a SaaS product?

What they check: supply chain risk.

Short answer: "By what it will touch: the data, the access and how hard it would be to leave. For high-risk suppliers I read their certifications and reports, ask specific questions on identity, encryption and incidents, and design our side so their failure hurts us as little as possible, with limited access and our own logging."

The full answer: A certificate on the website answers few questions; ask what it covers.

A weak answer: "They are certified, so it is fine." Follow-up: "The supplier will not answer your questions." Say what you recommend.

Which logging do you design in so incidents can be investigated?

What they check: detection and response built into the design.

Short answer: "Sign-ins, admin actions, access to sensitive data, changes to security settings and network flows at the boundaries, sent to a central place the system's own admins cannot change, with times in sync. I agree with the security analysts what alerts they need, and how long logs are kept under the rules that apply."

The full answer: Test it: ask the incident team to investigate a made-up event using only the logs.

A weak answer: "We log everything." Follow-up: "The logs cost more than the system." Say what you keep.

How do you secure a landing zone in the cloud?

What they check: cloud securitySecure cloud accounts, networks and services by design, with guardrails teams cannot switch off by mistake. by design.

Short answer: "A landing zone is the prepared structure of accounts or subscriptions into which teams deploy. I separate environments, connect identity to the central directory, set guardrails that block risky settings such as public storage, send logs to a central account and keep the network routes under control, the same way on AWS or Azure."

The full answer: Guardrails beat reviews in the cloud: they act on every change, at any hour.

A weak answer: "Each team sets up its own account." Follow-up: "A team needs a public endpoint." Say how it gets one safely.

How do you protect a legacy system that cannot be patched?

What they check: realism about old technology.

Short answer: "I shrink who and what can reach it: its own network segment, access through a controlled gateway, no internet, and close monitoring of what talks to it. I record the risk with the owner and push for a replacement date."

The full answer: Many old systems run machines or payments; protect them around the edges, since changing them is often the bigger risk.

A weak answer: "Turn it off." Follow-up: "It runs the warehouse." Say what you do this month.

Standards, reviews and new technology

How do ISO 27001 and the EU's NIS2 shape your architecture work?

What they check: linking standards and rules to designs.

Short answer: "ISO 27001 is the international standard for running information security as a management system, with risks, controls and evidence; NIS2 is an EU directive that sets security and reporting duties for many sectors, written into each member state's law. Both ask for risk-based controls and evidence; I make the architecture show which control covers which risk."

The full answer: Outside the EU, other rules apply, such as NIST's frameworks in the US or the UK NCSC's guidance; the company's legal team says which bind it.

A weak answer: "Compliance does that." Follow-up: "An auditor asks how you know a control works." Say what evidence you show.

How do you run an architecture review that teams want to come to?

What they check: influence without blocking.

Short answer: "Early, short and useful: a review when the design is still a sketch, a clear list of what must change and what is advice, and patterns they can reuse so the next review is faster. I publish the reference designs so teams can check themselves."

The full answer: Count how many teams come before they have to; that is the measure of a good review.

A weak answer: "Every project needs my sign-off." Follow-up: "A team went live without a review." Say what you do.

How would you secure a system that uses AI or holds sensitive data?

What they check: today's risks.

Short answer: "I treat the AI model as a component that can be fooled: inputs can carry hidden instructions, outputs can leak data, and the model may have more access than it should. I limit what it can reach, filter inputs and outputs, log its actions, keep a person on decisions that matter, and classify the data it sees."

The full answer: Data rules apply to AI as to any system; the data protection officer is part of the review where personal data is used.

A weak answer: "The AI provider handles security." Follow-up: "The chatbot answered with another customer's data." Say what failed.

Senior rounds

As a senior security architect, how would you set the security architecture for a whole company?

What they check: strategy, priorities and people.

Short answer: "I start from the business risks and the current state, write a short reference architecture for identity, network, data, cloud and logging, and turn the gaps into a roadmap the executives fund. I build patterns teams can reuse and coach the architects who review projects."

The full answer: A principal security architect or head of security architecture is judged by risks that went down across the company, not by documents.

A weak answer: "I write the security policy." Follow-up: "The budget covers a third of your roadmap." Say what comes first.

Your CV for these questions

Each job on your CV invites the questions above: which system, which threat, which control and what changed. Give those stories a line each, written so a head of security wants to hear more:

Put your CV beside a security architect job you want with the free score; the area it finds thin is the one to rehearse first, with a design you can draw and attack from memory.