Marius Poskus

Marius PoskusOct 1, 2026

Most junior candidates don't fail the technical question. They fail the one that comes right after it. "Walk me through why you configured it that way." I see it in interviews all the time. Someone explains their home lab clearly. They've built a SIEM, written detection rules, set up a firewall. The first answer is solid. Then I ask why they chose that rule threshold, or what would break if they changed one setting, and the confidence disappears. That second question is where most interviews are actually decided. The first one tells me you know what you built. The follow-up tells me whether you understand it. And it's getting harder to fake. A good first answer has never been easier to produce. You can follow a tutorial, copy a configuration, or have an AI tool explain a concept in seconds. The follow-up is where none of that helps, because it asks about your decisions, not the topic. The good news is that this is very learnable. Here's how I'd prepare. For every decision in your project, write down why. Why this tool, why this setting, why this threshold. Put it in your README as a short decisions section. If you can't explain a choice, that's the part of the project you don't own yet. Ask yourself "why" three times. Why did I set the alert to fire after five failed logins? Because that catches brute force. Why five, not three? Because three created too many false positives. Why does that matter? Because an analyst who's buried in noise misses the real alert. Three layers deep is usually where an interviewer stops. Prepare for "what would break if." Pick two settings in your project and work out what happens if they're changed or removed. That question comes up constantly, and it's the clearest test of real understanding. And be ready to say "I don't know, but here's how I'd find out." I'd much rather hear that than watch someone bluff. The bluff always falls apart on the next question. When I'm hiring at entry level, I'm not looking for someone who knows everything. I'm looking for someone who understands what they've already done, and can reason through what they haven't. What's the hardest follow-up question you've been asked in an interview? SOC(k)s are fire courtesy of Intruder #cybersecurity #ciso #breakintotech #breakintocyber #ready #junior #technology #interview #learning #leadership

Marius PoskusOct 6, 2026

The most underrated skill in cybersecurity isn't technical. It's writing. I've interviewed juniors who built an impressive home lab, then froze when I asked them to write a two-line incident note for their manager. That gap matters more than most people realise. A huge part of this job is written. Ticket notes that the next analyst can pick up at 3am. Incident summaries for people who weren't in the room. Risk write-ups that a director has to act on. A one-paragraph explanation for a manager who doesn't know what a SIEM is and doesn't want to. You can find the most important thing in the logs. If you can't explain it clearly, it often doesn't get acted on. Here's the difference I mean. A note I see often: "Saw suspicious activity on host WS-114, multiple failed auths, possible brute force, investigating further, will update." What I actually want: "Someone tried to guess the password for a finance user's account 40 times this morning, then got in. The account is now locked and the password reset. No data appears to have been accessed. Next step: confirming how the password was obtained. Update by 2pm." Same incident. One tells a manager what's happening, what's been done, and what's next. The other makes them ask three follow-up questions before they can do anything. The good news is that this is one of the easiest skills to practise, and almost nobody does. Every time you finish a lab exercise, write the note your manager would need: what happened, what you did, what happens next, in under 100 words. Write a one-paragraph explanation of a risk for someone non-technical. Put both in your GitHub next to the technical work. When I'm hiring, a candidate who can do the work and explain it clearly stands out immediately. It tells me I can put them in front of a stakeholder, not just a terminal. When did you last practise writing about your work, rather than just doing it? SOC(k) hit hard courtesy of Fortinet #cybersecurity #ciso #skills #breakintotech #breakintocyber #hiring #recruitment #technology #soc #grc #cloudsecurity #homelab

Marius PoskusOct 5, 2026

You build projects or home lab, but still not getting anywhere? The main reason might be because you built the wrong things, in my latest youtube video, i explain how to pick the right projects from 2 job descriptions side by side, walking step by step and then turn that into a Github portfolio that makes hiring managers stop in their tracks Link in the comments to the video #cybersecurity #ciso #portfolio #homelab #projects #grc #skills #breakintotech #breakintocyber #riskmanagement #vendorrisk #riskassessment #guide #mentor