What actually-useful questions should someone ask when hiring a cybersecurity professional?

I don't trust any cybersecurity person who doesn't even have a cursory understanding of what nmap is. It's one of the most basic tools for looking for holes in network security, and if they don't even know what its for (port scanning and fingerprinting), I'd be fairly concerned. I've seen too many 'security experts' that just paste reports from a COTS scanner into word documents and they don't have the slightest clue what they mean.

But here's a key one that should be a softball with some robust answers: What is the difference between Authentication and Authorization?

Authentication is the login. Authorization is whether you should be allowed to log in and what permissions you should have.

Some questions about best practices for each would be wise.

The single greatest threat to any organization is a successful phishing attack. People are by far the weakest link in security architecture. No amount of system design will overcome somebody handing over the keys to someone who asks. I'd want to probe at them and see if they deliver a similiar conclusion.

I am going to guess that you aren't hiring into a vacuum. Meaning that the company already has technical people on their payroll. Sysadmins, developers, etc. While they aren't security experts, their knowledge does overlap in quite a few areas. More so than yours as a manager. So even if you are provided with good questions to ask here, you very likely still lack the experience needed to validate the answers.

So my advice would be to involve a few people from technical roles. Either in an active role where they also ask questions or in a more passive role where they sit in to validate the answers.

This post actually serves as a concrete example. Specifically the way you introduced it, because "a technical cybersecurity job" is about as broad as it gets. So you are also going to get very broad and general suggestions here or very specific advice based on the assumptions people made. If the job description people respond to is as a non-specific as well you likely are going to be dealing with a similar issue. In fact, it increases the changes of attracting people who are smooth talkers (I guess social engineering is security related...) but lack on the technical side.

So, to even take a step back, I'd also first work on making the job requirements more specific. Ideally, by involving various technical people already on the company payroll.

• Are you looking for someone responsible for overall security in IT related processes?
• Are you looking for someone actively looking for vulnerabilities in your IT infrastructure?

Both are cybersecurity experts, but require different kinds of people.

Of course it depends on seniority and the role. But in my experience as a pentester, I always appreciated when places asked about the under-considered creativity of candidates. For example, a question like "What's one of your favorite hacks or stories to share from an assessment you've done?" That allows someone to talk about something interesting, whether it's creative or just technically challenging. A candidate that doesn't have a good answer for that would be a tough sell for a senior level pentester in a good firm, IME.

But bare minimum should be some familiarity with common tools, enough to be able to speak to them like someone who uses them regularly. "What are some of your most used extensions in Burp Suite?" is somewhat common for someone who purports to know web, and if they don't have an answer, they should at least be able to talk intelligently about why not.

More generally you could ask questions about their favorite topics in infosec, how they learn about new happenings, that sort of thing.

I like to pose a general problem and have the candidate walk me through how they evaluate it. The question depends on what the role is for but it should target a core skill for their role.
SOC/Incident Response: Walk me through an investigation if we get an alert for endpoint malware.
Appsec: Threat model an architecture
Solutions Architect: Secure or build a reference design

A lot of security comes down to well known fundamentals. Good engineers have experience/expertise in the tradeoffs required to solve problems. The basic questions like AuthN/Z should be covered in prescreening, expensive interviews should be spend understanding how the candidate solves problems and their experience working in orgs like yours. I would also ask how they would handle communication with leadership, and negotiating with external teams.