Estimation, Security & Soft Skills
An analyst is not hired for UML and SQL alone. Interviews test four skills that do not reduce to notations: name a date that will not fall apart, specify security so it is not rewritten after an audit, walk calmly through a stakeholder conflict, and explain why only half the backlog ships rather than all of it. This is the analyst's craft on top of the diagrams — and it is exactly where candidates most often flounder.
Each of the four layers below is its own interview conversation with its own traps. Estimation checks whether you understand the difference between a story point and an hour and why an early number is a range, not a single date. Security checks whether you know that a JWT cannot be "un-issued" by deleting it server-side and how authentication differs from authorization. Behavioral questions catch the answer "I've never had a conflict." Prioritization catches the attempt to mark everything Must have. Below we cover the model behind each skill and name the typical failures.
Topic map
- Estimation — sizing scope, effort, and capacity: story points versus hours, three-point estimation, planning poker, the cone of uncertainty, and honesty over padding.
- Security — what an analyst must put into requirements: authentication versus authorization, encryption and hashing, OAuth2 and JWT, protecting PII, and least privilege.
- Behavioral — the soft-skills interview: STAR structure, conflict and stakeholder disagreement, handling ambiguity, owning a mistake, and leadership without authority.
- Prioritization — ranking frameworks: MoSCoW, RICE, Kano, weighted scoring, cost of delay, and the ability to say no.
Common traps
| Mistake | Consequence |
|---|---|
| Giving a single date instead of a range early on | A promise the cone of uncertainty will almost certainly break |
| Confusing a story point with a person-hour | Estimates swing by who works; velocity stops forecasting |
| Thinking a JWT can be revoked by a server-side delete | A stolen token lives until expiry; you need a denylist or token version |
| Confusing authentication with authorization | Requirements mix "who you are" with "what you may do" — an access hole |
| Answering "I've never had a conflict" to a behavioral question | The interviewer hears evasion, not maturity |
| Marking every requirement as Must have | Prioritization vanishes; scope is cut by an arbitrary rule under deadline |
Interview relevance
These four topics test judgment, not memory: whether you can work under uncertainty rather than only draw diagrams. A candidate who answers a timeline question with "the cone of uncertainty is wide now, so I'll give an order-of-magnitude range and firm it up after discovery" immediately gets ahead of one who names a single date off the cuff.
Typical checks:
- How a story point differs from an hour and why an early estimate is a range.
- The difference between authentication and authorization, and why a JWT cannot be revoked server-side.
- A real conflict story told in STAR — situation, task, action, result.
- How to rank a backlog when "everything matters" and how to justify a no.
Common wrong answer: "I estimate precisely and always hit my dates." In an interview that reads as inexperience: a mature analyst talks about an estimate as a range with explicit assumptions, explains past slips honestly, and re-forecasts from actual velocity instead of defending the original number.