Interview scorecard template

Deception Technology Solutions Developer interview scorecard

Evaluate Deception Technology Solutions Developer candidates across 4 weighted areas: technical depth, real incidents and findings, risk judgement, and getting things fixed. Technical depth leads at 35%, so probe hands-on build depth: Cowrie or T-Pot deployments, honeytoken and canary token generation, decoy Active Directory objects, breadcrumb placement, and piping deception alerts into. Use the rubric to compare role-specific evidence consistently.

See AI scoring
security compliancedeception engineeringhoneypotsmitre engagethreat detection
TL;DR
For technical depth, look for evidence the candidate names specific decoy stacks they built, explains breadcrumb realism, token lifecycle, and how alerts reached the SOC queue without noise. For real incidents and findings, look for evidence the candidate recounts named incidents where a decoy fired first, with captured TTPs mapped to MITRE ATT&CK and Engage outcomes. Apply the written 1–5 anchors to every answer, record the evidence behind each rating, and use the factor weights to reach a consistent overall assessment.
Complete evaluation framework

What to assess and how to score it

Review the evidence signals before interviewing. Then use the anchored descriptions—not instinct alone—to choose the score that best matches each answer.

01
Evaluation factor

Technical depth

35% weight

Probe hands-on build depth: Cowrie or T-Pot deployments, honeytoken and canary token generation, decoy Active Directory objects, breadcrumb placement, and piping deception alerts into Splunk or Sentinel.

Evidence to listen for

  • Command of the specific attack surface, tooling, and controls the role covers
  • Understands how the underlying system works, not just how the tool reports on it
  • Can explain an attack or control chain end to end
  • Distinguishes what they found themselves from what a scanner flagged

Five-point scoring guide

1
Poor

Tool operator only; no understanding of the systems underneath.

2
Needs Improvement

Runs tooling but cannot explain findings or how the attack works.

3
Satisfactory

Solid working knowledge; depth thins outside familiar tooling.

4
Very Good

Strong command of the domain; explains attack and control chains clearly.

5
Excellent

Names specific decoy stacks they built, explains breadcrumb realism, token lifecycle, and how alerts reached the SOC queue without noise.

02
Evaluation factor

Real incidents and findings

30% weight

Ask for real engagements: adversaries that touched a decoy, dwell time captured, credentials harvested from a honeytoken, and what the telemetry revealed about tooling and lateral movement.

Evidence to listen for

  • Brings specific incidents, findings, or audits they personally worked
  • States their own role rather than the team's
  • Describes what was actually at risk and what changed afterwards
  • Can talk about a finding that turned out to be wrong

Five-point scoring guide

1
Poor

No hands-on work; knowledge is entirely certification or coursework.

2
Needs Improvement

Limited exposure; cannot describe their contribution to an incident.

3
Satisfactory

Real casework with adequate detail; ownership sometimes vague.

4
Very Good

Specific incidents with clear personal scope and what changed after.

5
Excellent

Recounts named incidents where a decoy fired first, with captured TTPs mapped to MITRE ATT&CK and Engage outcomes.

03
Evaluation factor

Risk judgement

20% weight

Test judgement on placement and containment: where decoys belong in segmented networks, legal and entrapment concerns, avoiding production impact, and the risk of a compromised honeypot pivoting inward.

Evidence to listen for

  • Prioritises by actual exploitability and business impact, not raw severity scores
  • Can argue for accepting a risk as well as fixing it
  • Knows the difference between a finding and a problem
  • Does not cry wolf or wave things through

Five-point scoring guide

1
Poor

Treats every finding as critical, or waves real risk through.

2
Needs Improvement

Follows severity scores mechanically; no business context.

3
Satisfactory

Reasonable prioritisation; less confident arguing for risk acceptance.

4
Very Good

Prioritises by exploitability and impact; can justify accepting a risk.

5
Excellent

Weighs detection value against blast radius, isolates decoy infrastructure deliberately, and rejects deception plans that lack containment or legal review.

04
Evaluation factor

Getting things fixed

15% weight

Assess how their alerts became action: playbooks handed to SOC analysts, tuning false positives out, deprecating stale decoys, and persuading infrastructure owners to host deceptive assets.

Evidence to listen for

  • Writes findings engineers can act on rather than a wall of output
  • Has persuaded a team to fix something they did not want to fix
  • Explains risk to executives in business terms
  • Works with the org rather than policing it

Five-point scoring guide

1
Poor

Adversarial with engineering; findings never get fixed.

2
Needs Improvement

Reports are unactionable; no influence beyond raising tickets.

3
Satisfactory

Adequate reporting; relies on mandate rather than persuasion.

4
Very Good

Actionable findings and a real record of getting fixes shipped.

5
Excellent

Shows documented runbooks, measurable false-positive reduction, and a track record of getting network and identity teams to adopt decoys.

Evidence-led prompts

Interview questions for a Deception Technology Solutions Developer

Use these prompts to surface evidence for the weighted factors above and compare candidates against the same role-specific criteria.

  1. 01

    Can you describe projects where you implemented deception technology?

  2. 02

    Can you give an example of using deception to detect a serious intrusion?

  3. 03

    What experience do you have developing solutions for threat deception?

  4. 04

    Explain your familiarity with honeypots and how you have used them.

  5. 05

    Which deceptive approaches have you found most effective?

See the complete Deception Technology Solutions Developer question set
Put this rubric to work

Score every candidate against the same standard

Add these weighted factors to Hirevire and let AI evaluate recorded answers against your rubric.

Explore AI Scorecards