Technical depth
Probe command of the frameworks they claim, and whether they understand the control intent or only the checklist.
Evidence to listen for
- Command of the specific attack surface, tooling, and controls the role covers
- Understands how the underlying system works, not just how the tool reports on it
- Can explain an attack or control chain end to end
- Distinguishes what they found themselves from what a scanner flagged
Five-point scoring guide
Tool operator only; no understanding of the systems underneath.
Runs tooling but cannot explain findings or how the attack works.
Solid working knowledge; depth thins outside familiar tooling.
Strong command of the domain; explains attack and control chains clearly.
Knows the control intent behind the frameworks, not just the checklist, and can map one framework to another.