Technical depth
Check depth on WCAG 2.2 AA success criteria, ARIA authoring practices, and hands-on testing with NVDA, JAWS, VoiceOver, TalkBack, plus keyboard-only and zoom reflow checks.
Evidence to listen for
- Command of the specific attack surface, tooling, and controls the role covers
- Understands how the underlying system works, not just how the tool reports on it
- Can explain an attack or control chain end to end
- Distinguishes what they found themselves from what a scanner flagged
Five-point scoring guide
Tool operator only; no understanding of the systems underneath.
Runs tooling but cannot explain findings or how the attack works.
Solid working knowledge; depth thins outside familiar tooling.
Strong command of the domain; explains attack and control chains clearly.
Cites specific success criteria by number, explains ARIA name/role/value failures, and describes real differences between NVDA and VoiceOver behaviour.