Security Engineer interview question

How do you secure a Kubernetes workload end to end?

What interviewers are really testing

• Layered thinking: image, runtime, network, secrets
• Least-privilege defaults
• Supply chain awareness

A strong answer framework

1. Scan images in CI; admit only signed, trusted images
2. Run non-root, read-only rootfs, drop capabilities
3. Least-privilege RBAC; no wildcard roles; per-workload service accounts
4. Default-deny network policies; allow only required flows
5. Secrets via vault with short-lived credentials; audit API logs

Follow-ups you should be ready for

• How do you handle secrets rotation?
• What breaks first with default-deny networking?

More real Security Engineer interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?