Cybersecurity Interview questions

OT / ICS Security Engineer interview questions

These OT Security Engineer interview questions come from our vetting, where 3.4% of applicants pass 5 gates. You get 20 questions with answer hints, a task, red flags and a scorecard.

Updated: October 2026Remote Pro Ai · Cybersecurity20 questions

Build my squad

How we assess

Every applicant goes through 5 gates: application, an AI-assisted screen, a live technical assessment scored by a practice lead, a client-fit interview, and reference and credential checks. The questions below come from the live assessment. We score answers on reasoning and trade-offs, not on recalling definitions.

20 technical questions with model-answer hints

Questions 1–⁠10 (role-specific)

  1. Explain the Purdue model and where it breaks down today.

    Model-answer hint

    levels 0–⁠5 with an industrial DMZ; cloud and IIoT connections bypass the hierarchy.

  2. How do you define zones and conduits under IEC 62443?

    Model-answer hint

    group assets by function and risk, define allowed flows, assign target security levels.

  3. Why is active scanning risky in OT, and what do you use instead?

    Model-answer hint

    fragile devices can fault; prefer passive monitoring and vendor-approved queries.

  4. How do you secure vendor remote access to a plant?

    Model-answer hint

    DMZ jump hosts, MFA, session recording, time-bound approval, no direct inbound paths.

  5. What does a Modbus attack look like on the wire?

    Model-answer hint

    unauthorised writes or function codes with no authentication; detect against baseline.

  6. How do you protect a PLC that cannot be patched or taken offline?

    Model-answer hint

    risk assessment, compensating controls, outage-window planning, vendor guidance.

  7. How does OT incident response differ from IT?

    Model-answer hint

    safety first, operations authority, no blind shutdowns, forensic limits on controllers.

  8. How do you build an asset inventory in a brownfield plant?

    Model-answer hint

    passive discovery, engineering drawings, site walks, reconciliation.

  9. How should IT and OT security operations work together?

    Model-answer hint

    shared visibility, OT playbooks, escalation to plant engineers, clear decision rights.

  10. What lessons do you draw from past attacks on industrial and safety systems?

    Model-answer hint

    segmentation, safety-system isolation, monitoring engineering workstations, credential hygiene.

Questions 11–⁠20 (Cybersecurity core)

  1. Map a control you implemented to NCA ECC-2:2024 or ISO 27001.

    Model-answer hint

    control reference, implementation, evidence produced, how effectiveness was tested.

  2. Walk through a ransomware intrusion using MITRE ATT&CK.

    Model-answer hint

    initial access to impact, with a detection or control at each stage.

  3. How do you prioritise 5,000 open vulnerabilities?

    Model-answer hint

    known exploitation, asset criticality, exposure, compensating controls, SLA tiers.

  4. Which logs do you need to investigate a compromised cloud identity?

    Model-answer hint

    sign-in, token issuance, control-plane audit, resource access and network flow logs.

  5. Explain zero trust to a CFO in 2 minutes.

    Model-answer hint

    no trust by network location; verify identity, device and context per request; frame as business risk.

  6. How do you write a detection that is useful, not noisy?

    Model-answer hint

    clear hypothesis, right data source, baseline tuning, emulation testing, documented triage steps.

  7. What do you do in the first hour of a suspected breach?

    Model-answer hint

    preserve evidence, contain, follow the playbook, start the regulatory clock, control communications.

  8. How do you protect secrets across CI/CD, cloud and laptops?

    Model-answer hint

    central vault, short-lived credentials, OIDC federation, secret scanning, rotation.

  9. How does SAMA CSF differ from ISO 27001 in practice?

    Model-answer hint

    sector regulator and maturity scoring versus a certifiable management system; large control overlap.

  10. Describe a security fix you won despite pushback.

    Model-answer hint

    quantified risk, business framing, agreed compromise, verified closure.

Interviewer tip: Ask for a real example after every answer. Strong candidates describe what they built, what broke and what they changed.

Practical task

Using a simplified network diagram of a gas processing plant, propose an IEC 62443 zone-and-conduit model, a passive-monitoring placement plan and the top 5 remote-access controls, with a phased rollout that avoids production downtime.

How to run it Share the brief 24 hours ahead or run it live. Ask the candidate to talk through trade-offs as they work; reasoning matters more than a finished artefact.

Red flags our practice leads watch for

  • Suggests active scanning of live control networks without hesitation.
  • Treats OT exactly like IT and ignores safety and availability priorities.
  • Has never worked with plant engineers or management-of-change.
  • Cannot name common industrial protocols or their weaknesses.
  • Universal flag: Vague answers that never reach a concrete system, number or decision the candidate personally owned.

The scorecard we use

Score each dimension 1–⁠4 (1 = no evidence, 2 = partial, 3 = solid, 4 = exceptional):

DimensionWeightWhat a 4 looks like
Technical depth, production judgement and security40%Explains how and why, designs for failure and sensitive data, and knows each tool’s limits
Practical task and problem solving30%Delivers a working solution with tests and documented decisions
Communication and documentation20%Explains clearly to technical and non-technical audiences, in English or Arabic
References and regional context10%References confirm the claimed scope; knows the frameworks and data-residency rules that apply

Pass bar: weighted average of 3.0 out of 4 or higher, with no dimension below 2. The practice lead approves the final result.

Skip the interview loop

Every specialist on our shortlist has already passed this assessment. Working in 4 working days.

Frequently asked questions

Yes. The questions, hints, practical task and scorecard are free to use. They work best when every interviewer scores the same dimensions independently and compares notes afterwards. Ask for a concrete example after each answer, because recalled definitions say little about how someone performs on a live system.

They come from the same live technical assessment, but practice leads rotate and adapt questions so candidates cannot rehearse them. What stays fixed is the scope being tested, the practical task format and the scorecard, which is why the published version is safe to share.

Plan for a technical conversation covering 8 to 10 of the questions, plus the practical task either live or as a short take-home. Use the remaining questions as follow-ups. If you would rather skip the loop, Remote Pro Ai shortlists already-assessed specialists within 48 hours.

Our pass bar is a weighted average of 3.0 out of 4 or higher across the 4 dimensions, with no dimension below 2. Production judgement and security, scored inside the 40% technical dimension, often separate strong candidates from those who interview well but struggle once they own a live system.

The task mirrors the first week of real work in this role and never uses client data. It runs live or as a short take-home of a few hours, and the candidate then explains the trade-offs behind each decision. Reasoning and production habits count for more than a polished final artefact.