Asked to talk about my approach to developing and maintaining an organization's information security policies and procedures. Asked to discuss my experience of working alongside DPO and Legal Team in previous roles. Such as policy writing, breach and security incidents handling experience. Asked to explain how I would conduct vulnerability assessments and penetration testing to identify and mitigate security risks. Show examples of having done this previously. Asked to explain core aspects of UK GDPR and encouraged to explain how I would and have previously ensured a company's compliance. Also asked about ISO27001 but not in great depth. Asked to explain a few security frameworks I had used or were aware of. I was given some examples of variety of security situations and was expected to explain at length how I address each situation, questions such as:- - a discovery of a major software vulnerability - dealing with an insider threat situation - maintaining security while the company transitions to new software or SaaS service - sensitive data leaked by employee
