Every floor · The machinery

Cyber Security Analyst

Defends the bank and its customers against people who are actively trying to take money or data.

BY MICHAEL SHANG · SIXTEEN YEARS IN COMMERCIAL BANKING · UPDATED 2026-10-11

// 01 — WHAT A CYBER SECURITY ANALYST DOES

Monitoring, detection, response and the unglamorous half — access, patching, third parties and the controls that stop an incident being a headline. The adversary here is funded and persistent, and the regulator expects the bank to be able to prove what it did and when.

// 02 — WHO ARRIVES HERE

Security, networking and infrastructure backgrounds, technology graduates, and people from defence and intelligence.

// 03 — WHAT THE INTERVIEW ASKS

These are the shapes the round takes, not a question bank — banks phrase them differently and the wording is never the point.

01You see this alert. What are your first three steps?
02How would you attack us?
03How do you decide what to patch first?
04Explain an incident to an executive in two minutes.
05How do you secure something you do not control, like a vendor?
06What is the difference between compliant and secure?

What the panel is listening for. Prioritisation under incomplete information, and whether you can communicate urgency without losing accuracy.

The finance, technology and operations quiz has no question for this seat yet. Its five were asked for the software engineer, financial accountant, operations analyst, procurement manager and people partner seats, in the same block, and the temperament they score is the one this panel scores too.

Take the quiz →

// 04 — ONE QUESTION, WORKED

QHow do you decide what to patch first?

A strong answer ranks by exploitability and exposure together rather than by a severity score alone: whether it is being exploited in the wild, whether the system is internet-facing, what it touches — the systems that move money and hold customer data first — and what compensating controls already sit in front of it. It knows the answer changes with the day's threat, says how the decision is recorded and communicated, and what it would do if the fix cannot be applied: isolate, monitor, or accept in writing.

A weak one patches in order of the vendor's severity rating and calls that a policy.

The seat is judged on prioritisation under incomplete information, and on communicating urgency to an executive with two minutes without losing accuracy. The overlap with lending is small, and it is honest to say so; what transfers is the question every credit file ends on — what happens if this stops — and the habit of ranking exposures by the answer.

START HERE · How banks work

THE IN-TRAY · ONE MINUTE