By the tiswa editorial team, from the official sources listed at the end of this guide. How we write our guides
An interviewer at an information security firm asked a student: “Tell me about the hardest flaw you found.” The student answered with a list of seven tools. The interviewer asked about none of them. Instead she asked: “And why was it a flaw?” The student went quiet. This is an example, but it happens often. Tools get named, and understanding is what gets tested.
How do you get a cybersecurity internship with a project?
Choose a project that meets three conditions: you carried it out yourself, it ran in an environment you own or an open training platform, and you can explain why what you found was a problem. Do not choose the biggest. Choose the one whose weak points you know, because that is the one that survives questions.
If you have no project yet, start with cybersecurity co-op training, which has safe examples and a two-page report method, then come back here to practise the telling.
How do you tell the project in two minutes?
- Start with the question
“I wanted to know whether an ordinary user could see another user’s data in a training app.” One sentence, then move on.
- Say what you did, in order
Name the tool in one word, then explain the idea: I changed the identifier in the request and saw that the server never checked who owned it.
- State what you found and its effect
Explain the impact in plain language: any user could read someone else’s data. Then rate the severity if you know how.
- Close with the fix
The server checks that the request belongs to the account holder. That sentence says you lean toward defence.
Practise aloud with a timer. Two minutes passes faster than you expect, and it holds no more than four sentences per beat.
What cybersecurity internship interview questions follow the project?
Follow-ups test understanding, not memory. Prepare for three kinds. The first is about the concept: what is this flaw and why does it happen? The OWASP list of the most serious web application risks helps you place what you found in a category the market recognises.1 The second is about severity: how bad is it and why? The Common Vulnerability Scoring System from FIRST offers a standard way to rate severity, so read its guide and apply it to your own example.2
The third is about conduct: what would you do if you found a flaw in a real system? The right answer is to report it to the owner through the official channel, and not to publish or probe further. This question reveals your discipline, and many employers judge you by it more than by any technical question.
| Interviewer question (example) | What it measures | How to answer |
|---|---|---|
| Why was this a flaw? | Understanding of the cause, not the tool | Tie it to a known category and say what the system should have checked |
| How would you rate its severity? | Thinking about impact | Say who is affected and what is exposed, and use a standard scoring method |
| What if your step had failed? | Handling failure | Describe a real failed attempt and what you changed after it |
| What would you do on finding a flaw in a live system? | Ethical discipline | Report to the owner formally and do not publish |
What do you say when you do not know the answer?
Say you do not know, then explain how you would find out. “I do not know that category, but I would read the platform’s documentation and try it in my lab.” That pleases an interviewer more than a confident wrong guess. The field is wide and nobody covers all of it, and employers look for people who learn quickly.
The NICE Framework helps you see which roles an interviewer might have in mind and name the work you want to do.3 Read the National Cybersecurity Authority’s site to learn the language of local organisations.4
What sinks you in the interview?
First, talking about a system you do not own, even if you say you were only experimenting. Second, naming tools with no explanation. Third, overstating your role in a group project; the interviewer asks details that reveal who wrote the code. Fourth, talking about attacks in a boastful voice. Speak like someone who closes holes, not someone who opens them.
Alongside the project, have a tidy CV; see the student CV guide, and for questions that come up in any interview read job interview questions. If you have not picked a track inside the major, the cybersecurity roadmap helps you choose.
After the interview send a short thank-you note that mentions one point from the conversation. If you use AI to prepare, read AI for cybersecurity students and never paste real data into it.
