"An incident can happen at any time without warning, so being ready is critically important. I strongly believe that every company should have a plan B for attacks that take place without warning. Once a hacker gains access to a system, there are two main directives that they pursue. Doing reconnaissance, and exploring to understand the system. Their next steps are to find assets (Data), and how to access them, all while acting in a stealth mode in the system. This is where I would be able to detect their movements and track activity."

"The trick is having a strong detection system that finds an attacker early in the process to thwart or minimize data theft or other significant damage. In order to find an active attacker, there are two challenges that must be addressed and solved:

1) You need to change your approach on what you look for and how you identify them
2) Look at full network activity, rather than limited packet routing

I find that the whole mindset has to change because identifying an active attacker through the typical process of pre-defined signatures, entry behaviors, and other signs isn't the most efficient way of protecting your systems. These hackers are meticulous, and follow a step-by-step campaign to gain entry."

You can answer this question by explaining to the manager that organizations need to change their mindset about how detection is addressed. This will give you points in the interview. Cyber experts should be able to articulate the procedures involved in tracking an intruder and where most companies fail with their detection systems. Tell the manager how much you enjoy your work and how proud you are of setting up and maintaining environments with 0% intrusions due to your security strategy and vision.