How to Interview for OT Incident Response Experience

Ask for the view from their chair

Invite the candidate to choose an incident, investigation or response exercise they can discuss. Ask what their normal role was, how they became involved and what they knew at the beginning. Let them anonymize the organization and remove sensitive technical detail.

Then ask: 'What were you personally responsible for?' Follow with a particular action. If they say the team contained the incident, ask which recommendation they made, what information supported it and who had authority to approve it. This is where a general account becomes usable hiring evidence.

A person who maintained the timeline or coordinated plant communications may have made a substantial contribution. Describe that contribution accurately. A candidate who supported the response should have a fair opportunity to demonstrate readiness for a larger role without being credited with decisions somebody else made.

Use a short scenario to explore the missing pieces

Here is a fictional interview scenario: monitoring flags unfamiliar activity involving an engineering workstation while production is running. The plant reports no visible process disturbance. A vendor has a scheduled support session, but the interviewer has not yet established whether it explains the activity.

Ask the candidate what they would want to know before recommending a response. Let them identify missing information, discuss who they would contact and explain how they would distinguish legitimate activity from something requiring escalation. The quality of their questions is part of the evidence.

Next, tell them the scheduled session cannot yet be confirmed. Ask how they would communicate that uncertainty to the response lead and operations. You are exploring their reasoning and escalation approach. Keep the exercise inside the role's expected authority.

• What could this workstation affect, and who can explain that dependency?
• Which observations would change your recommendation?
• Who needs to approve an action that could affect the process?
• What would you record so the next responder can continue the investigation?

Follow the story through recovery

Do not finish the interview at containment. Ask how the team decided equipment or services were ready to return, what the candidate contributed to that decision and which unresolved issues remained. Then ask what changed afterward. A revised contact list, a better recovery procedure or an identified monitoring gap can show whether lessons reached the people doing the work.

NIST's OT security guidance addresses safety, reliability and performance alongside security. In the interview, use those concerns to explore the candidate's reasoning about the particular system. A response that sounds sensible for an office endpoint may need additional operational coordination in a plant.

Also ask about a recommendation that was challenged. How did the candidate handle the disagreement? Which new fact changed the plan? An experienced responder should be able to discuss the people and constraints surrounding a technical decision.

Leave the panel with evidence it can use

Record the candidate's example, their personal actions and the question that remains open. For instance: 'Explained how they reconstructed a remote session and coordinated with controls engineering. Did not establish experience owning the recovery decision. Ask the operations interviewer to explore that responsibility.' That note gives the next interviewer a useful assignment.

Keep the core questions consistent when comparing candidates for the same job. Follow-up questions can differ because their experience differs. Decide in advance which responsibilities must be demonstrated and which can be developed with support. Otherwise a confident story may receive more weight than the work the position actually needs.

Before ending, give the candidate a chance to clarify one point they feel was missed. A technical interview should produce a clear account of capability, including the limits of the evidence collected during the conversation.