Skip to content

Expert · Careers and certifications · topic 43 of 43 · 35 min

Interviews, CVs and honest salary expectations

Explanation

SOC interviews test fundamentals (networking, ports, Windows Event IDs, the CIA triad, hashing versus encryption, incident response phases), a practical scenario like a phishing email or a brute-force alert, and how clearly you explain your own lab work. In India, freshers in SOC roles typically earn roughly ₹3–8 LPA, depending a lot on city, company and skills.

What interviewers look for

For entry roles, interviewers do not expect you to know everything. They check three things: do you have solid basics, can you think through a problem calmly, and can you explain clearly? Honest "I do not know, but here is how I would find out" beats a confident wrong answer.

Questions you should be ready for

QuestionWhat a good answer covers
What is the CIA triad?Confidentiality, integrity, availability, with one example each
Explain the TCP three-way handshake.SYN, SYN-ACK, ACK; how scans and SYN floods show up
Which ports are 22, 53, 443, 445 and 3389?SSH, DNS, HTTPS, SMB, RDP, and why 445 and 3389 should not face the internet
What do Event IDs 4624 and 4625 mean?Successful and failed logon; logon types 2, 3 and 10
Hashing versus encryption?Hashing is one-way (integrity, passwords with salt); encryption is two-way with a key (confidentiality)
What is a SIEM? Which have you used?Collect, normalise, correlate, alert; name the one in your lab
Walk me through how you would handle a reported phishing email.Headers, SPF/DKIM/DMARC, links and attachments safely, who else received it, purge, block, reset clickers
What are the phases of incident response?NIST: preparation; detection and analysis; containment, eradication and recovery; post-incident activity
True positive vs false positive?Definitions plus how you would tune a noisy rule
What is MITRE ATT&CK?Tactics as goals, techniques as methods, an example ID
What do you do if you do not know the answer at 3 am?Follow the playbook, escalate with evidence, never guess silently

Scenario answers: think aloud

For scenario questions, structure matters more than the perfect answer. Say what you would check first and why, what evidence would change your mind, and when you would escalate. For behaviour questions ("tell me about a time you…"), use STAR: Situation, Task, Action, Result.

output
Q: You see 500 failed logons (4625) for many users from one internal IP, then one success.
A: First, I identify the source IP: which machine and owner. Second, I check the logon type
   and Sub Status: many "user does not exist" suggests spraying. Third, I look at the account
   that succeeded: what did it do next (4672, 4720, 4732, new processes)? If it looks malicious,
   I escalate as high severity with the evidence and recommend isolating the source machine
   and disabling the account, following the playbook.
A calm, structured scenario answer.

Your CV

  • One page for freshers. Plain format that applicant tracking systems can read.
  • A skills line with real tools you have used (Wireshark, Wazuh, Sysmon, Python, KQL basics).
  • Projects section with links to your write-ups and GitHub.
  • Certifications with the exact name and exam code where relevant (for example "CompTIA Security+ (SY0-701)").
  • No exaggeration: anything on your CV can become an interview question.

Honest salary expectations in India

Salaries vary a lot by city (Bengaluru, Hyderabad, Pune, NCR and Mumbai usually pay more), company type (product companies and GCCs usually pay more than smaller service firms), shift allowances, and your skills. Rough ranges, as a guide only:

Role and experienceTypical annual CTC (approximate)
SOC analyst L1, fresher₹3–8 LPA (many offers around ₹4–6 LPA)
SOC L2 / incident responder, 2–5 years₹7–18 LPA
Security engineer / cloud security, 3–6 years₹12–30 LPA
Senior roles, architects, managersHigher, very wide range

LPA means lakh per annum. CTC (cost to company) includes items you do not receive monthly in hand, such as provident fund contributions and variable pay. Ask for the in-hand amount and shift allowance in writing.

Avoiding job scams

  • No genuine employer asks you to pay for an interview, training, a laptop or a "security deposit".
  • Check the company domain of the recruiter's email and look up the company independently.
  • Be careful with "work from home, earn ₹50,000 a week" offers; many are task scams.

Common mistakes

  • Memorising definitions without examples.
  • Saying "I would just block the IP" without checking evidence or impact.
  • Talking down about previous employers or teammates.
  • Not preparing questions for the interviewer (ask about shifts, training, and what L1 analysts do in a typical week).

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Interviews, CVs and honest salary expectations · 1/7

Basics · Thinking · Clarity

Interviews test basics, calm thinking, and clear explanation.

Prefer a video by a teacher? Find free videos on “SOC analyst interview questions and answers for freshers” on YouTube ↗

In real life: Two candidates, one question

Asked "How would you handle a reported phishing email?", candidate A says "I would block it." Candidate B explains: get the original with headers, check SPF/DKIM/DMARC, examine links in a sandbox, search who else received or clicked it, purge it, block the domain, reset any entered passwords, and close with a note. Both are freshers; B gets the offer at ₹5.2 LPA plus night-shift allowance, because B showed a process.

Practice (0/3 done)

Task 1 · Question

In an interview you do not know an answer. What is best?

Task 2 · Practice

Write your answers (5–8 lines each) to: "Explain the CIA triad with examples", "What is the difference between 4624 and 4625?", and "Walk me through a phishing investigation". Then say them aloud and time yourself (2 minutes each).

Task 3 · Practice

Write a one-page CV for a SOC L1 role using only true information: summary, skills, projects (with links to your lab write-ups), certifications (exact names), education.

Quick quiz

Question 1

1.What does STAR stand for in behavioural interviews?

Question 2

2.What is a realistic fresher SOC L1 salary range in India?

Question 3

3.CTC means…

Question 4

4.A recruiter asks for a ₹15,000 "laptop deposit" before the offer letter. What is it most likely?

Question 5

5.Which answer to "an alert shows 500 failed logons then a success" is strongest?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

What does STAR stand for in behavioural interviews?

Answer: Situation, Task, Action, Result

STAR structures a story about something you did.

What is a realistic fresher SOC L1 salary range in India?

Answer: Roughly ₹3–8 LPA, varying by city and company

Most fresher SOC offers fall in this broad range.

CTC means…

Answer: Cost to company, which includes items not paid monthly in hand

Ask for the in-hand figure separately.

A recruiter asks for a ₹15,000 "laptop deposit" before the offer letter. What is it most likely?

Answer: A job scam

Genuine employers do not take money from candidates.

Which answer to "an alert shows 500 failed logons then a success" is strongest?

Answer: Identify the source, check logon types and status codes, check what the successful account did, escalate with evidence

A structured, evidence-based process is what interviewers want.

In an interview, you are asked about a tool you have never used. What is the best response?Related

Answer: Say you have not used it, and explain how you would learn it or what similar tool you know

Honesty plus a clear learning approach builds trust; guessing is easy to spot.

From DevOps careers and interviews in India

Which is an honest salary range for freshers in cloud support or associate roles in India?Related

Answer: About ₹3.5–7 LPA, varying by city, company and skills

Fresher pay commonly falls in this range; product companies and some GCCs pay more, and it varies widely.

From Cloud roles, salaries and interviews in India

Which statement about salaries is most honest?Related

Answer: Pay ranges vary widely by city, company type, skills and interviews

Ranges are guides, not promises.

From Careers, salaries in India and your next steps

Which is an honest typical range for a fresher NOC L1 engineer in India?Related

Answer: About ₹2.5–5 LPA

Fresher NOC salaries are usually modest, around ₹2.5–5 LPA, and vary by city and company.

From Networking careers in India and beyond

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next steps

  1. This is the last topic of “Careers and certifications”. The module exam comes next.
  2. Module 10 exam: Careers and certifications · 11 questions · 15 min, without help. 4 topics of this module still to finish first.
  3. 43 topics left in the course before the final exam.

← Previous: Building a home lab and a portfolio