Technical depth
Check depth on WCAG 2.2 AA success criteria, ARIA authoring practices, and hands-on testing with JAWS, NVDA, VoiceOver plus axe DevTools or ANDI.
Evidence to listen for
- Command of the specific attack surface, tooling, and controls the role covers
- Understands how the underlying system works, not just how the tool reports on it
- Can explain an attack or control chain end to end
- Distinguishes what they found themselves from what a scanner flagged
Five-point scoring guide
Tool operator only; no understanding of the systems underneath.
Runs tooling but cannot explain findings or how the attack works.
Solid working knowledge; depth thins outside familiar tooling.
Strong command of the domain; explains attack and control chains clearly.
Cites specific success criteria by number, explains name/role/value failures, and describes real screen reader behaviour differences across NVDA and VoiceOver.