Walk into the interview already prepared.

Fresher (0–3 years): Junior DevSecOps Engineer

1. Where would you add security checks in a CI/CD pipeline?
2. A scan reports 300 vulnerabilities. What do you do?
3. How do you build a secure container image?
4. What does SAST analyse?
5. What does SCA (software composition analysis) find?
6. Which tool scans container images for known vulnerabilities?
7. What does "shift left" mean?
8. Where should API keys used by a pipeline be stored?
9. What is an SBOM?

Mid-level (3–8 years): DevSecOps Engineer

1. Design a secure software supply chain.
2. How do you get developers to adopt security tools?
3. How do you secure Kubernetes deployments in the pipeline?
4. What does policy as code (e.g. OPA, Kyverno) let you do?
5. How do you prove an image was built by your pipeline?
6. Which framework describes supply-chain integrity levels for builds?
7. DAST is best run against…
8. A CI runner is shared by all projects with broad cloud admin rights. Biggest risk?
9. What is the purpose of a security gate threshold?

Experienced (8–15 years): DevSecOps Lead / AppSec Architect

1. How would you build a DevSecOps program in a 300-developer company?
2. Respond to a compromised dependency in your build (supply-chain attack).
3. Balance security and delivery speed. How?
4. Best measure of a DevSecOps program's success?
5. Reduce the risk of compromised third-party CI actions/plugins.
6. Reachability analysis helps…
7. Threat modelling is most valuable…
8. Runtime protection for containers detects…
9. Secrets sprawl across hundreds of repos. Best long-term fix?