Technical depth
Check command of NIST AI RMF, ISO/IEC 42001 and EU AI Act obligations, plus fairness metrics (demographic parity, equalised odds), model cards and LLM red-teaming methods.
Evidence to listen for
- Command of the specific attack surface, tooling, and controls the role covers
- Understands how the underlying system works, not just how the tool reports on it
- Can explain an attack or control chain end to end
- Distinguishes what they found themselves from what a scanner flagged
Five-point scoring guide
Tool operator only; no understanding of the systems underneath.
Runs tooling but cannot explain findings or how the attack works.
Solid working knowledge; depth thins outside familiar tooling.
Strong command of the domain; explains attack and control chains clearly.
Maps specific obligations to control designs, names fairness metrics they chose and why, and distinguishes high-risk from limited-risk classifications confidently.