Three fully worked scenario responses, from the first 60 seconds to the last curveball, so you walk into the live round having already run it.
Part of the CISO Interview Template Pack · cisoprep.com
These are practice walkthroughs built for rehearsal, not transcripts of real interviews or incidents. Work each scenario three times: read it, say the opening out loud with a timer, then have someone throw the curveballs at you mid-answer. Internalize the openings almost verbatim; improvise inside the frame after that. One rule governs all three: the panel is not grading your answer, it is grading what it would feel like to sit next to you when the thing actually happens.
The third variant puts the CEO in the first sentence; take the hint about what they want to hear first.
"Before I touch containment, three things happen in the first fifteen minutes. First, I name an incident commander, and it is not me. My IR lead runs the technical bridge; my job tonight is decisions and communication, and if I'm on keyboard, nobody is doing that job. Second, general counsel gets on the phone now, so the investigation runs under privilege from minute zero, and I notify our cyber insurance carrier tonight, because their panel constrains which forensics firm we can even engage. Third, I start the clocks: a decision log from this moment, because everything will be reconstructed later, and a look at notification obligations, since some of those windows may already be running. Then the cadence: CEO briefed within the hour, executive updates every two hours, nobody outside the comms plan speaks externally. With that structure standing, here's what my IC is executing on containment."
Why this works. Four signals in one minute. Incident command before tooling says you know which chair you're interviewing for. Privilege before forensics tells the lawyer on the panel you've run a legal-driven response, and the insurance detail says you've lived a claim. The disclosure clock says you know a breach is a regulatory event from minute one. And a stated cadence says you know silence upward is what gets CISOs fired.
Hour 0-1: command and privilege. The opening above, then exactly two or three clarifying questions:
If the panel declines to answer: "I'll assume public SaaS, attacker still active. Flag me if that's wrong."
Hour 1-4: containment at altitude. Narrate what the IC executes, in one breath: isolate segments, kill the spread vector, preserve evidence before wiping anything, verify backups offline before trusting them, establish blast radius including identity, because owned domain controllers change the whole recovery plan. Decision you own: "I take systems offline proactively ahead of the spread and inform the CEO. I don't ask permission, because waiting costs more than the outage."
Hour 4-12: the business track. Where most candidates go quiet and lose the round. CFO on financial exposure and insurance mechanics, GC on notification analysis and law enforcement, comms on a holding statement drafted before anyone asks. State the boundary: "Technical containment is mine. Money, disclosure, and external words go to the CEO and GC, with my recommendation attached."
Hour 12-24: recovery posture and the first honest status. Restore order comes from the business, not IT convenience: crown-jewel tiering, or a triage of one tonight. End of day one: a written status with what we know, what we don't, and the next three decisions coming at the executive team. That last phrase is the most senior sentence you can say.
Draw three swim lanes, Technical, Legal/Regulatory, Communication, with a time axis marked 1h, 4h, 12h, 24h. The IC's name goes on the technical lane, yours spans all three. Draw a vertical line at each decision point that crosses lanes (ransom demand, disclosure call, proactive shutdown). The picture argues without words: the CISO's job is the vertical lines, not the top lane.
"The backups are encrypted too." Do not improvise a miracle. Shape: this changes the recovery math, so it changes who's in the room. Rebuild-from-scratch goes on the table next to the ransom option, the CFO prices the outage per day, and the ransom conversation is now live. You updated the plan out loud instead of defending it, which is the actual test.
"The CEO wants to pay the ransom." Never give a personal verdict. Shape: payment is a business decision the CEO can make; your job is to make it informed. Bring recovery time with and without the key, the sanctions screen from GC (paying a sanctioned entity is a federal problem that outranks the outage), the carrier's position, and the note that a decryptor does nothing about exfiltrated data. "My job was the briefing, not the veto."
"A journalist emailed asking about an outage." Shape: handled at hour four, which is why the holding statement exists. Comms sends it, nobody confirms specifics, and GC hears within the hour that public attention may accelerate the disclosure decision.
| Dimension | What a 1 sounds like | What a 5 sounds like |
|---|---|---|
| Structure | Technical tasks in whatever order they arrived | Named tracks, a time axis, decision points flagged before the panel injects them |
| Business framing | Encryption percentages and tool names | Revenue exposure, disclosure obligations, recovery cost per day |
| Decision ownership | "It depends," "we'd follow the process" | "That call is mine, made" versus "that goes to the CEO with my recommendation" |
| Communication discipline | CEO mentioned once, reactively | Cadence set in minute one: CEO in the hour, execs every two hours, one external voice |
| Composure | A pause, or a defense of the old plan | "That changes X, so the plan is now Y," at the same tempo as everything else |
All three are the same test: do you cut by risk or by politics, and are you an executive peer or a department defending turf. Expect a finance leader in the room, and assume they are the real audience.
"First, I'm not going to argue with the number. The company needs the money, and my job is to find the 20% that buys back the least risk, not to relitigate the cut. Second, here's how I'll decide, because the method matters more than the line items. Tool consolidation and vendor renegotiation come first because they're reversible. Program deferrals come second, each with a named risk that moves into next year. Headcount comes last, and if it comes, I'll tell you exactly what stops being done rather than pretending the same coverage continues with fewer people. Third, every option comes with a consequence in business terms and a residual risk I'll ask this executive team to formally accept. Two questions, then actual cuts."
Why this works. The first sentence disarms the trap: defending the budget. The finance person has heard "we're already underfunded" from every security leader they've met; not saying it is itself a signal. The cut hierarchy (reversible first, headcount last, consequences attached) is a method they can imagine surviving next year's cut too. And "formally accept the residual risk" separates executives from managers: you price risk, you don't absorb it silently.
Minute 1-3: clarifying questions.
Minute 3-10: the cut, in tiers. Proportions, not real figures: "Tier one, roughly half the target: consolidate overlapping tools, renegotiate the two biggest renewals, cut shelfware. Tier two, another third: defer program work that's important but not time-bound, naming the risk each deferral creates. Tier three, if the math forces it: headcount, and here is the specific work that stops." The percentages don't need to be exact; the ranked structure with consequences does.
Minute 10-15: the protect list and the ask. Name one or two asymmetric line items you'll fight for: "The IR retainer stays. It's small money and its absence is catastrophic on the worst day. I'll cut awareness tooling before detection engineering, because one is a checkbox and the other finds the breach." Then the close: "Here's my recommendation. It creates two named residual risks, and I want the executive team to accept those explicitly, on the record, because that acceptance is the company's decision." The CFO is in this continuously; the CEO comes in only for formal risk acceptance and any cut touching a board-level commitment. Say that decide-versus-escalate line out loud.
Draw a two-by-two: cost saved against risk created. Place your cut candidates in the quadrants live, talking while you place them. High savings, low new risk is tier one; low savings, high risk is your protect list, and you circle it. The picture shows the finance leader you think about their money the way they do, and gives the room a shared object to argue with.
"Actually, the CFO wants 30%." Shape: the method holds, the tiers cut deeper, the conversation changes character. "At 20% I can protect the core. At 30% we're choosing between capabilities, so I'd bring the executive team two program-shaped options: which risk category does the company want to own next year?" Escalate the frame, not the fight.
"Your best engineer will quit if you cut their favorite tool." Shape: name the real issue, retention risk, and price it like everything else. Talk to the engineer first; don't pre-surrender the budget to a threat. A critical person is a data point in the risk column, not a veto.
"The board asks whether the company is less safe after this cut." Shape: yes, and here is exactly how much. "We accepted two named risks. Here's the compensating control for each and the trigger that would make me ask to reverse the cut." Never say the cut is free. A CISO who says a 20% cut changed nothing just told the board the budget was 20% padding.
| Dimension | What a 1 sounds like | What a 5 sounds like |
|---|---|---|
| Structure | A grab bag of cuts in random order | Tiers ranked by reversibility, consequences attached to every line |
| Business framing | Tool names and headcount numbers | Dollars saved against risk created, sales cycle impact, cost of the gaps opened |
| Decision ownership | "Whatever the CFO prefers" | "My recommendation is this; the residual risk needs your explicit acceptance" |
| Communication discipline | A security team meeting register | Vocabulary calibrated to the CFO, one protected line item argued in their terms |
| Composure | The 30% curveball produces deflation or bargaining | The method scales without a beat: deeper tiers, reframed choice, same tempo |
The second and third variants hand you the real constraint (limited access, fixed clock) that the first hides. If you get the first, surface those constraints yourself; it scores even better.
"I'll split this at the close date, because pre-close and post-close are different jobs with different customers. Pre-close, my customer is the deal team, not the target's security posture. I have limited access and a fixed clock, so the output is not a remediation plan; it's material risk that affects price or terms, anything that belongs in reps and warranties, and an honest list of what we couldn't assess. Post-close, my customer becomes the integration, and day one is about identity boundaries and visibility, not remediation. Two workstreams. First, three questions, because the answers change the plan materially."
Why this works. The pre-close/post-close split, stated in the first sentence, is the whole exam in miniature: it shows you know diligence access is negotiated and time-boxed, the thing candidates who've never been inside a deal miss. "My customer is the deal team" tells the corp dev person you were invited to inform the transaction, not audit for its own sake. And "what we couldn't assess" signals honesty under constraint, which a deal team rarely gets from a security leader.
Minutes 1-3: clarifying questions.
Weeks 1-4, pre-close. Sequence what you can actually learn: external attack surface scan (no permission needed, start today), breach and disclosure history, their certification package read adversarially, scoping first, because a clean report that excludes the crown jewels you're buying is the red flag generic diligence misses. Key-person risk: if security is one person with no retention agreement, that goes on the deal team's issue list this week. Deliverable: "A short memo: material risks priced or papered, candidates for reps and warranties or escrow, and the couldn't-assess list. An active or undisclosed incident is not a memo, it's a same-day escalation to GC and the deal lead, because it can reopen price or terms." That is your decide-versus-escalate line.
Close to day 30. Day one is identity and access boundaries: you do not flat-connect the networks, you decide what federates and when. Their environment enters your monitoring before anyone remediates anything. Policy scoping is yours: incident reporting and admin access rules apply immediately; tooling standards get a grace period. A line worth using verbatim: "The first thirty days are visibility and containment of unknowns, not remediation. I can't prioritize fixes in an environment I can't see yet."
Day 30-90. Remediation, sequenced by the risk register, with owners and dates, plus a report back on whether pre-close estimates matched reality. Closing that loop is a move almost nobody makes and everyone remembers.
Draw one timeline with a bold vertical line at Close. Left of it, two rows: "What we can learn" and "What it feeds" (price, terms, reps and warranties, escrow). Right of it, three phases: Day 1 (identity boundaries, visibility), Day 30 (risk register complete), Day 90 (remediation with owners). The bold line does the arguing: two different jobs, and a place to physically point when a curveball tries to blur them.
"You find something bad. The acquisition closes anyway." Shape: your job was to inform the decision, not make it. The company can rationally close over a known problem if price or terms reflect it. Post-close, the finding jumps the day-one queue, its remediation cost attaches to the integration budget before close, and it's recorded as an accepted risk with a named owner. The test is whether you can lose an argument and still execute.
"The target had a breach two years ago and didn't tell us." Shape: same-day escalation, and be precise about why: nondisclosure in diligence is a trust and legal fact, not just a security fact. It can trigger renegotiation, escrow, or reps-and-warranties claims, so GC and the deal lead hear it within the hour, from you. Then the security question: what did they fix, and what else did they hide.
"Their security team quits at close." Shape: this was on your pre-close list as key-person exposure, which is why retention agreements came up in week one. If it happens anyway: their environment goes under your team immediately, an external retainer bridges the gap, and the lost knowledge becomes a named risk with a rediscovery plan.
"The CEO wants the products integrated in 30 days, not your 90." Shape: price the speed, don't resist it. "We can do 30. Here's what it skips, here's the exposure, and here's the minimum I won't compress: identity separation until their admin access is verified. If the business accepts that explicitly, we run the 30-day plan with compensating controls."
| Dimension | What a 1 sounds like | What a 5 sounds like |
|---|---|---|
| Structure | One undifferentiated list of security tasks | A hard split at close, different customers and outputs on each side |
| Business framing | Vulnerabilities and audit findings | Price, terms, reps and warranties, escrow, and what the deal team does with each finding |
| Decision ownership | Waits to be told what the deal team wants | "Day-one boundaries are mine; an undisclosed incident is a same-day escalation to GC" |
| Communication discipline | Same technical register for every audience | Deal-team vocabulary pre-close, integration vocabulary post-close, TSA raised unprompted |
| Composure | "It closes anyway" produces frustration or a lecture | The finding moves to the day-one queue, gets an owner, the plan updates at full tempo |
Score yourself against the fifteen rubric rows the day after you practice, not the same evening. Anything at 3 or below, rewrite in one sentence and say it out loud until it stops sounding rehearsed. Know the openings word for word; trust the structure enough to improvise everything else. That, not coincidentally, is also the job.