Strategy question

OpenAI does not want to build another SIEM or autonomous SOC. How would you identify and prioritize the first 1-2 defensive workflows to build for, given the goal of raising attacker cost and reducing analyst toil? Walk through the criteria you would use, the evidence you would gather from practitioners, and how you would compare opportunities like detection engineering, threat investigation, security validation, and incident response.

Practice this question out loud. An AI interviewer asks it, follows up like a real interviewer would, and scores your answer. Type or speak.

What this question tests

Strategic prioritization discipline: picking a narrow, defensible starting point instead of an unbounded security product.

Propose criteria: workflows with high analyst toil, high volume of repetitive manual work, clear ground truth for evaluating AI output quality, and low blast radius if the AI is wrong.
Rank the four named options against those criteria: detection engineering and threat investigation tend to have clearer ground truth and lower immediate blast radius than incident response, where a wrong action can cause real damage.
Propose gathering evidence directly from practitioners: shadowing analysts to quantify time spent per workflow, and structured interviews asking where they most want help versus where they fear automation.
Weigh raising attacker cost versus reducing analyst toil as sometimes competing goals, and pick the workflow where both align, likely detection engineering, since faster detection content directly raises attacker cost and directly reduces manual toil.
Define success: a measurable reduction in time-to-detection-content-creation and analyst hours saved per week on the chosen workflow, validated with the same practitioners interviewed upfront.

Builds explicit criteria before ranking the four options, rather than picking one based on instinct or general AI hype.
Distinguishes blast radius correctly, noting incident response carries higher risk if the AI is wrong than detection engineering or investigation support.
Proposes direct practitioner evidence gathering, shadowing and interviews, as the validation method rather than assuming internal judgment is sufficient.
Picks a workflow where raising attacker cost and reducing toil both clearly align, showing the two goals were actually reconciled, not just listed.

Proposing to build broadly across all four workflows at once instead of committing to one or two with clear criteria.
Ignoring blast radius and picking incident response first, the highest-risk option if the AI gets something wrong.

How would you measure attacker cost in a way that is not just a proxy assumption?
What would make you add a second workflow, and how would you sequence it?