software dataowasp top 10sast dastsecure codingthreat modeling
Complete evaluation framework
What to assess and how to score it
Review the evidence signals before interviewing. Then use the anchored descriptions—not instinct alone—to choose the score that best matches each answer.
01
Evaluation factor
Technical proficiency
35% weight
Check fluency in secure coding for their stack: parameterised queries, output encoding, OAuth2/OIDC flows, key handling via KMS or Vault, and fixes for OWASP Top 10 classes.
Evidence to listen for
Command of the languages, frameworks, and data tools the role actually uses
Understands correctness, performance, and failure modes, not just syntax
Has opinions on testing and can justify them
Reads and reasons about code they did not write
Five-point scoring guide
1
Poor
Cannot work independently; fundamentals are missing.
2
Needs Improvement
Weak fundamentals; output needs heavy review.
3
Satisfactory
Competent for the role; needs guidance on complex or unfamiliar work.
4
Very Good
Strong practitioner; handles hard problems with little guidance.
5
Excellent
Names specific vulnerability classes they have remediated in code, with the exact library, framework control, or crypto primitive used.
02
Evaluation factor
Systems and trade-offs
25% weight
Probe threat modelling on a real feature: STRIDE or attack trees, trust boundaries drawn, and where they accepted friction such as mTLS, tokenisation, or stricter session expiry.
Evidence to listen for
Reasons about scale, latency, cost, and failure before writing code
Names the trade-off they chose and what they gave up
Understands the data lifecycle end to end
Anticipates what breaks at ten times the volume
Five-point scoring guide
1
Poor
No thinking beyond the immediate task; no awareness of scale or failure.
2
Needs Improvement
Limited architectural awareness; struggles with design decisions.
3
Satisfactory
Works within an existing design; makes sound local decisions.
4
Very Good
Designs for scale and maintainability; articulates trade-offs clearly.
5
Excellent
Walks through a design decision balancing latency, developer velocity, and blast radius, explaining what attack they deliberately designed out.
03
Evaluation factor
Evidence and rigour
25% weight
Assess how they verify security claims: SAST/DAST tuning, dependency scanning and SBOM handling, fuzzing, unit tests for authz logic, and triage of false positives.
Evidence to listen for
Validates results rather than trusting output
Knows how their work is measured and what a bad result looks like
Can describe a time their own analysis or model was wrong and how they caught it
Careful about data quality, leakage, and silent failure
Five-point scoring guide
1
Poor
Ships unvalidated work; no notion of how correctness is checked.
2
Needs Improvement
Validates superficially; misses obvious quality or leakage issues.
3
Satisfactory
Reasonable checks in place; rigour drops under time pressure.
4
Very Good
Validates thoroughly; can name a real error they caught in their own work.
5
Excellent
Cites measured outcomes such as reduced critical findings, pipeline gate pass rates, or CVEs caught before release, not tool names alone.
04
Evaluation factor
Collaboration and communication
15% weight
Look for how they land fixes with feature teams: writing secure code review guidance, pairing on remediation, and pushing back on a risky pull request without stalling the release.
Evidence to listen for
Explains technical work to non-technical stakeholders
Gives and takes code or peer review constructively
Documents enough that the work survives their absence
Aligns with team process rather than working around it
Five-point scoring guide
1
Poor
Cannot work in a team; resistant to feedback.
2
Needs Improvement
Communication issues create rework; lone-wolf tendencies.
3
Satisfactory
Adequate team member; documentation and review participation are light.
4
Very Good
Communicates well; reliable reviewer and collaborator.
5
Excellent
Describes convincing reluctant engineers with a proof of concept exploit or reusable secure component rather than a policy citation.
Put this rubric to work
Score every candidate against the same standard
Add these weighted factors to Hirevire and let AI evaluate recorded answers against your rubric.
