Cracking the Tech Mahindra Cyber Security Analyst Interview
Tech Mahindra's Security practice manages the security operations for global giants. The Cyber Security Analyst role (often based in a Security Operations Center or SOC) is critical. The interview process is highly technical, testing your knowledge of network protocols, threat hunting, and incident response.
Phase 1: Networking and Security Fundamentals
You cannot secure a network if you do not understand how it works.
- Network Protocols: Expect deep questions on the OSI model, TCP/IP handshake, DNS, and HTTP/HTTPS. "Explain how a DNS Spoofing attack works and how you would detect it."
- Cryptography: You must understand the difference between symmetric and asymmetric encryption, hashing algorithms (SHA-256), and how digital certificates (SSL/TLS) function.
- Vulnerabilities: "What is the difference between Cross-Site Scripting (XSS) and SQL Injection? How do you mitigate them?" (Be familiar with the OWASP Top 10).
Phase 2: SOC Operations and SIEM Tools
Tech Mahindra relies heavily on centralized monitoring.
- SIEM Mastery: You will be asked about your experience with Security Information and Event Management (SIEM) tools like Splunk, IBM QRadar, or Azure Sentinel. "How do you write a query in Splunk to detect multiple failed login attempts followed by a successful login?"
- Incident Response: "Walk me through the steps you take when a SIEM alert indicates a potential ransomware infection on a user's workstation." They want to hear about Isolation, Containment, Eradication, and Recovery.
- Threat Intelligence: How do you stay updated on the latest Zero-Day vulnerabilities? Mentioning frameworks like MITRE ATT&CK or reading threat feeds is highly recommended.
Phase 3: Scenario-Based and Managerial Round
Tech Mahindra needs analysts who can handle high-pressure situations.
- The Scenario: "It is 2 AM, and you detect data exfiltration to a known malicious IP address from a critical database server. What is your immediate course of action?"
- Shift Work: SOC operations run 24/7. The HR or Manager will explicitly ask if you are comfortable working in rotating shifts (including night shifts). Answering "No" is usually an immediate disqualifier.
Top 3 Technical Questions to Prepare
- Explain the difference between a False Positive and a False Negative in an IDS (Intrusion Detection System). Which is worse for a business?
- Walk me through the lifecycle of a typical Incident Response plan (NIST framework).
- How would you detect a lateral movement attack within a corporate network?
