Security Engineer mock test

About the role

A security engineer working on application and infrastructure security makes sure the software a company ships, and the systems it runs on, cannot be abused. The work spans code, cloud and pipeline: reviewing designs, finding and fixing vulnerabilities, and building guardrails so that developers do the secure thing by default.

The best people in this role write and read code, explain risk in plain words, and prefer a fix that removes a whole class of bug over a ticket that blocks a release.

What you will do

• Review designs and code for security problems, and run threat models with the engineers who own the service.
• Find, triage and drive the fix of vulnerabilities, ranked by what they could really do to users and data.
• Integrate security tooling into CI/CD: SAST, dependency scanning, secret scanning and image scanning.
• Keep secrets and credentials out of code, images and logs, and manage how they are stored and rotated.
• Harden containers, Kubernetes and cloud accounts: identity and access, network boundaries, least privilege.
• Support incident response with code-level investigation, and handle vulnerability reports and bug bounty findings.

What we look for

• Experience in application security, product security, or software engineering with a strong security focus.
• Working knowledge of the OWASP Top 10 for web and APIs, especially access control and authorisation flaws.
• Ability to read and reason about production code in at least one language, such as Python, Go, TypeScript or Rust.
• Familiarity with how Docker, Kubernetes and cloud IAM are secured, and with CI/CD systems and their secrets.
• Clear writing: findings that an engineer can act on and a manager can understand.

Nice to have

• Software supply chain security: dependency policy, artifact signing, provenance (SLSA, Sigstore).
• Penetration testing or bug bounty experience, or certifications such as OSCP or OSWE.
• Infrastructure as code security with Terraform, and Linux hardening.

About this mock test

One hour on a real Linux machine, in a terminal in your browser. You stop a data leak between users of an application and keep a CI credential out of build logs, then answer short written questions on container and Kubernetes security.

This is practice. There is no job at the end of it. It is the same interview format employers run on EasyEnv, so you can measure yourself against what companies hiring for this role ask for, and see where you need more work.