interview nth round (long process, lost track)
"how do you create a logging system, and how would you fully automated it to minimize human intervention?"
>"to create a logging system as such you would need a websocket server running on a port and in a multi-app case, a developer can add logs to each event, all those event logs would be connected to a single websocket port and collected in a database. to further automate it you will use 3 llms atleast, one for making changes to the code, one for review and one for summary, this way you can eliminate human actions to some extent." (i also mentioned siem and soar concepts and tools to further coat it)
"let's say our company created an ai bot which helps users to fetch some information based on their roles, how would you make sure the user cannot fetch any other information which is not required?"
>"to secure ai rag pipelines as such, you would need to focus on pee (policy enforcement engine), pee consists of pep (policy enforcement point) and pdp (policy decision point) which together are added as a layer between the user and the llm, at both the points you insert policies to protect against prompt injection and llm hallucination - this way the input from the user and the output from the llm are both kept in check."
it took me to have knowledge about 3 different domains - webdev, web appsec and ai security.
although these might not also be the best answers.
i recommend my fellow devs to architect their projects from a cybersecurity pov as well. it will add more points to your candidature. although im still waiting for results, but this thing kinda changed the way i used to develop apps.