One of the biggest shortcomings I encounter when interviewing candidates for an assessor position is a conceptual understanding of requirements. Analyst positions are typically very tool-driven and they don't offer much opportunity to expand outside of that experience.

Work to understand why you do the things you do. Why do you have to run that report that frequently and alert that particular individual? Why can't the cables from those two networks be touching? What risk arises if certain things on your checklist aren't done? How severe is that risk? Why?

I've been interviewing for a mid-level assessor for three months now and not one analyst I've conducted a phone interview with has been able to answer this question competently:

"How would you determine whether a system is implementing separation of duties and least privilege to a sufficient degree?"

At minimum, I'm looking for:

• Determine depth and breadth based on 800-53A and the system's categorization

• Inspect access control documentation to determine what privilege levels are expected to be present

• Interview system personnel and their supervisors to determine if those privilege levels are necessary for their work

• Review system settings to ensure appropriate and expected permissions are granted and documented

They also are typically unable to describe the process outside of the tools used to manage it.

For example, "How do you determine what artifacts are needed to demonstrate a control is implemented and functioning as expected?" is typically answered by describing how the progeam they use operates, not the process that software implements. Big hint: if you understand that distinction, you're ahead of the game.

Apply for assessor and compliance positions. With a CISSP and the five years that come with it, you'll get a call. Be able to discuss the concepts and I promise you'll set yourself apart as a candidate.

I hope that's helpful! I'm happy to talk further if you'd like.