Big-4 Consulting · Cybersecurity Consulting

EY Cybersecurity Interview Pack

EY's Cybersecurity practice runs a values-led interview loop ('EY Way') with strong sector-vertical specialisation. Expect industry-specific cases.

// hiring focus
- Cyber Strategy & Risk - Identity & Access - Data Protection & Privacy - OT / IoT Security - Architecture & Engineering
EY structures cyber engagements around sector verticals (FS, Health, Energy, Gov) and the global delivery network. Interviews skew towards sector-specific case work and the EY behavioural framework ('Building a better working world'). Experienced-hire interviews at Manager+ involve a sector partner who probes commercial pipeline understanding — 'which 3 clients in this sector would buy this service from us, and why?'
// hiring loop
- Recruiter screen - EY 'Engage' assessments - First round: case + competency (60-75m) - Partner round: sector partner + cyber partner (60-90m) - Offer
// interviewer style + signals
Vertical-first. A health-sector candidate will face health-flavoured cases (HIPAA / DSP Toolkit / NHS Cyber Assessment Framework). FS candidates face DORA + PRA. Be ready to name 3 named clients in your target sector and a credible offering for each.
// recent themes & hot topics
NHS DSPT + Cyber Assessment Framework, sector-specific AI assurance, OT cyber for energy + utilities (NIS2), cyber due diligence for transactions, post-CrowdStrike third-party resilience, identity-first security.

Sample interview questions

  1. 01

    How would you build a cyber assurance offering for NHS Trusts?

    Show strong-answer outline

    Lead with regulatory driver (DSPT, CAF v3.2, NIS2), then offering (gap assessment, remediation, IR retainer), then differentiation (NHS sector team, cleared resources), then commercial (framework + call-off).

  2. 02

    A FS client failed their last PRA cyber stress test. Walk me through your 12-week remediation plan.

    Show strong-answer outline

    Week 1-2: root-cause + governance, Week 3-6: prioritised remediation per finding, Week 7-10: re-test + tabletop, Week 11-12: regulator update + sustainable BAU handover.

  3. 03

    Pitch our OT cyber service to an energy major's CISO.

    Show strong-answer outline

    Driver (NIS2, OFGEM cyber baseline), offering (Purdue assessment, IDS, segmentation, IR), differentiation (cleared engineers, sector references), commercial (framework + multi-year).

  4. 04

    How do you ensure a global delivery model doesn't degrade client experience?

    Show strong-answer outline

    Onshore engagement lead, named delivery anchors offshore, daily standup discipline, client-side stand-up rep, monthly partner review, contractual SLA on response time.

  5. 05

    Tell me about a time you built a new service offering.

    Show strong-answer outline

    STAR with market signal, build, first three sales, P&L outcome.

Frequently asked questions

Which sector should I apply to?›

Pick the one with your strongest CV evidence. Cross-sector moves are possible at Senior Manager+ but rare at Manager.

Is EY's loop shorter than Deloitte's?›

Comparable — 4-6 weeks end-to-end for Manager hires.

Run the EY loop as a graded mock

Premium members get the full round structure, signals, and AI-graded practice.

Start free