Frameworks and trends

Topic 12 for Walmart Campus Grad Cybersecurity Intern prep. JD signal: "Research and document latest trends in cyber threats, zero-day vulnerabilities, AI in cybersecurity." Most figures independently verified against primary sources (2025–2026); CISA 2025 SBOM elements are a public-comment draft and Walmart India headcount targets are secondary/reported — hedge those two in interview.

1. Why Walmart Asks This

Use this table as an interview index. Each row points to a section below where the WHAT, demands, Walmart link, intern tasks and model answers are spelled out. If asked why frameworks matter, pick one row and walk it end to end rather than listing names.

2. Concepts (full Section 12 coverage)

2.1 The four frameworks — one table to memorise

PCI-DSS Requirement 10 (deep dive — expect this): log all access to system components and cardholder data; daily review of security events (10.4.1) using automated mechanisms (10.4.1.1, mandatory since 31 Mar 2025); logs capture who/what/where/when/outcome, tamper-protected, retained ≥ 12 months (10.5.1; recent 3 months immediately available). Other 31 Mar 2025 future-dated Req 10 items: 10.4.2.1 (risk-analysis review frequency), 10.7.2/10.7.3 (detect/alert on security-control failures). Req 12.10.1 = incident response. This is why Walmart staffs 24×7 SOC log monitoring.

How the four fit together. NIST CSF states outcomes to manage. ISO 27001 runs that management as a repeatable, certifiable system. CIS lists which technical actions to do first when time is short. PCI-DSS states what you must do wherever card data lives. One control can satisfy all four: centralised logging is CSF DE.CM, ISO A.8.15, CIS Control 8 and PCI Req 10; MFA is CSF PR.AA, ISO A.8.5, CIS 6.3–6.4 and PCI 8.4.2/8.5.

NIST CSF 2.0 in one breath. CSF 2.0 is a voluntary risk taxonomy, not a checklist. WHAT it is: six Functions with Categories and Subcategories underneath. WHAT it demands in practice: a current profile and a target profile, gap assessment, and evidence such as risk registers and control test results. WHY it matters to Walmart: one language must cover stores, e-commerce, cloud and thousands of vendors, with GV.SC for supply-chain risk. HOW an intern touches it: map a SOC process to DE.CM or RS.MA, or draft a target profile for a new service. INTERVIEW sketch: "Govern added strategy, roles, policy, oversight and GV.SC, so security has an owner and budget before the technical loop starts."

ISO 27001:2022 in one breath. WHAT it is: a certifiable management system for information security. WHAT it demands: scope an ISMS under Clauses 4–10, assess risk, select Annex A controls, and justify each choice in the Statement of Applicability. Evidence is internal audits, management reviews and a three-year external certification cycle. WHY it matters to Walmart: procurement often asks suppliers to show ISO-aligned controls or a certificate. HOW an intern touches it: collect evidence for A.8.15 logging or A.8.5 authentication, or tidy an SoA justification. INTERVIEW sketch: "ISO certifies the management system, not perfect security. Outcomes still depend on implementation."

CIS v8.1 in one breath. WHAT it is: a prioritised action list of 18 Controls and 153 Safeguards. WHAT it demands: do IG1 first (56 Safeguards), each with an owner and frequency — inventory, baselines, patching, least privilege, backups, logging. WHY it matters to Walmart: it gives a defensible 90-day order for a new acquisition or store system. HOW an intern touches it: run an IG1 gap check or verify backup restores. INTERVIEW sketch: "IG1 stops the most common non-targeted attacks at low cost; IG2 adds depth for regulated data."

PCI-DSS v4.0.1 in one breath. WHAT it is: a contractual, prescriptive standard for cardholder data. WHAT it demands: all 12 requirements in the cardholder data environment, validated by ROC or SAQ with configs, scans, pen tests, logs and signed policies. WHY it matters to Walmart: every checkout — store POS, Walmart.com, Sam's Club fuel — is in scope. HOW an intern touches it: check that a logging pipeline captures Req 10 fields, or that MFA meets Req 8. INTERVIEW sketch: "CSF describes outcomes you choose; PCI prescribes controls you must prove to an assessor."

2.1.1 PCI-DSS 4.0 scoping walkthrough — a card checkout flow

Take one online card payment. The customer enters PAN on Walmart.com, the browser posts to a payment API, that service calls a processor, and order and fraud systems store only a token. Scoping means tracing that PAN flow and listing every system that touches it or can affect its security. In-scope systems include the web front end, payment API, token vault, logging pipeline, auth service and any admin jump host. Shared services such as identity, email and EDR stay in scope if they can reach the cardholder data environment. Only what is properly segmented and proven out by segmentation testing falls out of scope. Evidence is a network diagram, data-flow diagram, inventory and Req 12.5.2 scope confirmation. Intern task: redraw the data-flow diagram after a code change and flag any new system that entered scope.

2.1.2 NIST CSF 2.0 function in practice — Detect in the SOC

Detect asks whether you would see an attack in progress. Categories include continuous monitoring (DE.CM) and adverse-event analysis (DE.AE). In practice that means log sources feeding a SIEM, use cases that fire alerts, triage runbooks and tuning based on false positives. Evidence is alert counts, mean time to detect and review records. Example: credential stuffing against customer accounts fires a DE.CM rule, the analyst enriches with IP reputation under DE.AE-02, and a tuning ticket cuts duplicates. Intern task: review one noisy detection for a week, label true versus false positives, and propose one threshold change. INTERVIEW sketch: "I picked DE.CM-01, measured the baseline, tuned one rule, and showed less noise without missing true positives."

2.2 HIPAA / GDPR basics

HIPAA in one breath. WHAT it is: US law protecting protected health information held by covered entities and business associates. WHAT it demands in practice: administrative, physical and technical safeguards, access controls, audit controls, workforce training, business-associate agreements, and breach notification — individuals without unreasonable delay within 60 days, HHS notice, and media notice when 500+ residents of a state are affected. WHY it matters to Walmart: pharmacy, vision centres and health clinics handle PHI alongside retail data, so one incident can trigger both HIPAA and PCI work. HOW an intern touches it: check that a pharmacy app logs access correctly, or help draft a business-associate inventory. INTERVIEW sketch: "HIPAA breach clock is 60 days to individuals, plus HHS and media tiers at 500. The clock starts at awareness, so IR and legal run in parallel."

GDPR in one breath. WHAT it is: EU law covering any processing of EU residents' personal data, wherever the company sits. WHAT it demands: lawful basis, data minimisation, subject rights (access, rectification, erasure, restriction, portability, objection), security under Art. 32, records of processing, and breach notice to the authority within 72 hours of awareness plus notice to individuals without undue delay if high risk. WHY it matters to Walmart: global e-commerce, EU customers and legacy UK operations bring GDPR scope even for a US retailer. HOW an intern touches it: map where EU customer data flows, or test a data-subject erasure request end to end. INTERVIEW sketch: "GDPR is 72 hours to the authority, then individuals if high risk. Fines reach 20M euros or 4% of turnover, so evidence of process matters."

2.3 Certifications — what each covers and how to position yourself

Positioning the CTF + InfoSec signal: never list certs you lack. Instead: (1) CTFs are hands-on validation of what OSCP/CEH test on paper; (2) InfoSec specialisation covers Security+ theory (crypto, IAM, IR, GRC); (3) name a roadmap — Security+ first, then CEH or OSCP per track, AI cert later. "Preferred, not mandatory" = show trajectory + demonstrated skill.

2.3.1 Cert study plan with honest effort estimates

This plan assumes a final-year student with coursework and CTF time. Hours are study plus labs, not exam fees or training courses. Security+ SY0-701 needs about 100–150 hours over 8–12 weeks: read one domain per week, do 300–500 practice questions, and lab password, PKI and log basics. Sit 701 if already studying, since 701 runs until 11 Jun 2027 and V8 SY0-801 is still tentative around Nov 2026. CEH v13 needs about 120–180 hours over 10–14 weeks: 20 modules plus 221 labs are too many to finish fully, so cover the five phases and tool classes and lab Nmap, Burp, Metasploit and cloud basics. OSCP (PEN-200) needs about 300–500 hours over 4–6 months with 60–90 lab machines rooted: enumerate methodically, practise Active Directory chains, and write full reports for every box. AI certs come later. AI-102 or Google Professional ML Engineer needs 80–120 hours if you already build ML projects. ISACA AAISM needs active CISM or CISSP first, so treat it as a two-year goal. ISC2 professional AI cert is still in development with a pilot around late 2026, so do not claim it. Intern link: name Security+ as first, tie CTFs to CEH/OSCP method, and tie LLM-security projects to future AI-security certs. INTERVIEW sketch for "which cert and why": "Security+ first for baseline vocabulary and blue-team entry, OSCP next for red-team depth if I go offensive, AI-security after prerequisites because building models and securing them are different skills."

2.4 Threat pattern: Log4j, supply chain, ransomware, zero-day playbook

Log4Shell pattern (CVE-2021-44228, Dec 2021, CVSS 10.0). WHAT it is in one breath: a remote-code-execution flaw in a ubiquitous Java logging library via JNDI lookup. WHAT it demands in practice: not just one patch but an inventory of every place the library hides, including transitive copies pulled in by other packages, followed by patching, config mitigation and log sweeps for exploitation. WHY it matters to Walmart: thousands of Java services and vendor integrations mean a single library can sit in many estates at once. CISA noted that orgs with SBOMs responded relatively straightforwardly while others did slow manual searches. HOW an intern touches it: run dependency scans, reconcile findings with the asset inventory, and track patch closure. INTERVIEW sketch: "The lesson is transitive-dependency blindness. You cannot patch what you cannot inventory."

SBOM fix. WHAT it is in one breath: a machine-readable ingredient list of software components and their dependency relationships. WHAT it demands in practice: generate SBOMs in SPDX or CycloneDX (SWID is legacy), store them per release, cover transitive dependencies, and use them during incident response. Policy context: EO 14028 §4(e)(vii) requires SBOMs for federal software, §10(j) drove the NTIA 2021 Minimum Elements, and CISA's draft 2025 Minimum Elements (Aug 2025, comment closed 3 Oct 2025) proposes Component Hash, License, Tool Name and Generation Context plus explicit transitive coverage. WHY it matters to Walmart: third-party risk under PCI Req 12.8/12.9 for TPSPs and CSF GV.SC. HOW an intern touches it: generate an SBOM for one service, diff it across releases, and flag unknown or unpatched components. INTERVIEW sketch: "SBOM turns Log4j-style hunts from manual search into a query."

Ransomware 2025 retail playbook. WHAT it is in one breath: social-engineering-led intrusion plus double extortion (data theft plus encryption). WHAT it demands in practice: help-desk verification controls, MFA resistant to fatigue, tested immutable backups, a written IR plan under PCI 12.10, and legal, PR and law-enforcement coordination. The 2025 retail cases show the shape: Scattered Spider, English-speaking and help-desk-impersonation heavy, with DragonForce, RansomHub and Qilin affiliates; M&S contactless and online ordering disrupted 25 Apr–10 Jun (46 days) with Harrods as a separate linked incident and 4 arrests on 10 Jul 2025. WHY it matters to Walmart: large store and e-commerce estates plus many support staff create many help-desk paths. HOW an intern touches it: test help-desk verification, verify backup restores, and keep the IR contact list current. INTERVIEW sketch: "Isolate and preserve in order of volatility, activate the IR plan, restore from tested backups, no payment decision without executives and counsel, then leak-site monitoring and root-cause uplift."

Zero-day playbook. WHAT it is in one breath: a repeatable response for exploitation before a patch exists. WHAT it demands in practice: exposure inventory, vendor mitigation or patch per CISA KEV SLA, hunting for IOCs and TTPs with integrity checkers and web-shell sweeps, assumed compromise if exploited pre-patch, credential and key rotation, documented reporting under PCI Req 12.10 and the GDPR 72-hour clock where relevant, then new detections and a retro log sweep. WHY it matters to Walmart: the retailer runs the same VPN, firewall and collaboration edge that attackers now favour. HOW an intern touches it: own the exposure list for one product family and track KEV deadlines daily during an event. INTERVIEW sketch: "Inventory, mitigate, hunt, assume breach if needed, rotate, document, detect."

2025 zero-day stats (GTIG "2025 Zero-Days in Review", Mar 2026): 90 zero-days exploited in the wild in 2025 (78 in 2024; record 100 in 2023), stabilising in the 60–100 band; 43 (48%) hit enterprise software/appliances — all-time-high share; OS zero-days 39 (44%); browsers below 10%; 9 attributed to financially motivated groups (two linked to ransomware deployment); 10 to PRC-nexus espionage. Mandiant M-Trends: exploitation is the #1 initial access vector in IR work. Talking point: "threats shifted from browsers to enterprise edge devices — exactly the VPN/firewall estate a retailer runs."

2.5 CVE citation technique (how to discuss a CVE in 5 moves)

1. ID + one-line impact ("CVE-2025-0282 — a stack buffer overflow in Ivanti Connect Secure giving unauthenticated RCE")
2. Attack story ("exploited in the wild from mid-Dec 2024 by UNC5221 — suspected Chinese espionage — who fingerprinted versions, disabled SELinux and dropped web shells/malware")
3. Detection/response facts ("found via the vendor's Integrity Checker Tool; CISA added it to KEV with a Jan 15 2025 deadline for federal agencies")
4. Transfer to Walmart ("we run edge VPN appliances too — so my playbook is inventory → patch/KEV SLA → integrity checks → credential rotation")
5. One insight ("edge devices are the new zero-day frontier — GTIG saw enterprise-targeted zero-days hit a 48% share in 2025").

Three CVEs you can quote (all verified):

2.6 AI in SOC — UEBA / SOAR / LLM triage

UEBA in one breath. WHAT it is: machine-learning baselines of user and entity behaviour that flag anomalies such as impossible travel or odd data access. WHAT it demands in practice: clean identity data, tuned thresholds, and a process for behavioural drift so the team is not buried in false positives. WHY it matters to Walmart: stolen creds and insider misuse blend into huge volumes of normal store and corporate logins. HOW an intern touches it: label UEBA alerts as true or false positives for two weeks and document which data sources were missing. INTERVIEW sketch: "UEBA catches what signatures miss, but needs identity hygiene and explainability work."

SOAR in one breath. WHAT it is: playbook automation that enriches alerts, contains hosts, and opens tickets the same way every time. WHAT it demands: versioned playbooks, approval gates for risky actions, and maintenance when APIs change. Bad automation can cause outages at speed. WHY it matters to Walmart: Tier-1 volume across stores and cloud needs consistent, auditable response. HOW an intern touches it: document one playbook, add enrichment steps, and keep containment human-approved. INTERVIEW sketch: "Automate enrichment first, keep containment gated, and track time saved."

LLM triage and copilots in one breath. WHAT they are: assistants such as Microsoft Security Copilot with its Security Alert Triage Agent, which sorts real attacks from false positives with step-by-step reasoning across Defender XDR and Sentinel. WHAT they demand: grounded citations, prompt-injection defences for ingested tickets and logs, privacy controls for log data, and human-in-the-loop for containment. WHY they matter to Walmart: summarisation scales analyst capacity during retail peaks. HOW an intern touches it: draft grounded summaries, check every cited IOC, and log each AI action for review. INTERVIEW sketch: "Start with summarisation and enrichment, measure hallucination rate like a detection metric, and red-team the copilot."

Balanced soundbite: "AI in the SOC is a triage accelerator, not a decision-maker. I'd start with summarisation and enrichment, keep containment human-approved, and measure hallucination rate like any detection metric." Bonus: Walmart's AI Security & Safety charter names hallucination, misuse and adversarial behaviour as the risks to engineer against.

2.7 Walmart research pack (verified talking points)

Scale and builder. WHAT it is: Fortune 1 and the world's largest retailer by revenue, with Walmart Global Tech building supply-chain optimisation, merchandising, payments, search, pricing and fulfilment. The Cashi digital wallet for Walmart Mexico, built from scratch in India, is a public example of payments work done by the India teams. WHY it matters for security: every new checkout or fulfilment feature adds card data, personal data and integrations that need controls from day one. HOW an intern touches it: map one new feature to PCI scope and CSF categories before launch. INTERVIEW sketch: "Retail scale means small control gaps repeat millions of times."

India tech footprint. WHAT it is: Walmart Global Tech India across Bengaluru, Chennai and Gurugram, described by CTO Suresh Kumar in 2023 as the tech backbone and larger than the US centres at about 11,500 people in 2023. Multi-year expansion includes a Chennai GCC around 465k sq ft (about 4,500 seats) and a Bengaluru GCC around 950k sq ft in 2024–25 leases, with a reported target near 17,000 in India by 2027 — treat the target as secondary and hedge it. Chennai hosts AI Security and Safety Engineering roles inside Information Security. WHY it matters: intern work is likely to sit with these India teams. HOW an intern touches it: join an India-based security squad for logging, detection or third-party risk. INTERVIEW sketch: "I know the Chennai AI Safety roles cover hallucination, misuse and adversarial testing, which matches my LLM-security projects." This last point is a public-research inference, not an internal fact.

AI leadership and guardrails. WHAT it is: computer-vision store tools such as the IRAS scanner on scrubbers and the VizPick AR locator, conversational AI "Converse", and a unified Agentic AI framework announced at Converge 2025 with a responsible-innovation agenda. Guardrails include Digital Trust Principles and human-in-the-loop for agent actions, plus an IIT-Madras research partnership. WHAT it demands: safety testing for hallucination, misuse and adversarial behaviour alongside capability work. WHY it matters: agentic checkout and support tools widen prompt-injection and data-leakage surface. HOW an intern touches it: write abuse-case tests for one assistant feature and document failure modes. INTERVIEW sketch: "Speed needs guardrails. I would test the agent like an attacker and log every action."

Supply-chain innovation and its control cost. WHAT it is: automated distribution centres and Alphabot, AI demand forecasting, drone delivery, and Sam's Club scan-and-go, documented on tech.walmart.com. WHAT it demands: GV.SC and SBOM controls must scale as fast as new hardware, software and vendors are added. WHY it matters: each innovation adds suppliers and data flows that need inventory and risk review. HOW an intern touches it: keep the supplier or component inventory current for one system. INTERVIEW sketch: "Innovation speed is why I link every launch to GV.SC and SBOM updates."

Career path, intern versus campus full-time. WHAT it is: the intern term is a scoped project such as mapping a logging pipeline to PCI Req 10 gaps, learning the stack, and shipping one measurable win toward a return offer. Campus full-time means owning a control or service such as detection engineering or third-party risk, driving cross-team projects, joining on-call rotations, and answering for KPIs like MTTD, MTTR, patch SLAs and audit findings closed. HOW to use it: ask about conversion expectations and which KPI your project will move. INTERVIEW sketch: "For an intern project I would pick one Req 10 gap, fix it, and show before-and-after evidence."

3. Q&A (12+)

Q1. NIST CSF 2.0 functions and what changed? Six: Govern, Identify, Protect, Detect, Respond, Recover (published 26 Feb 2024). The big change: Govern (risk strategy, roles, policy, oversight, supply-chain risk GV.SC) — a full lifecycle, not just a technical loop. My intern work would land in Detect/Respond.

Q2. ISO 27001:2022 Annex A at a high level? 93 controls in 4 themes: Organisational (A.5, 37), People (A.6, 8), Physical (A.7, 14), Technological (A.8, 34) — vs. 114/14 domains in 2013, with 11 new controls (e.g., DLP A.8.12, monitoring A.8.16). Controls are chosen by risk assessment and justified in the SoA. The cert covers the management system (ISMS), not "security perfection."

Q3. What is CIS IG1? "Essential cyber hygiene" — the 56 foundational safeguards (of 153 in v8.1) that stop common, non-targeted attacks: asset inventory, secure config, access control, data protection, email/browser hygiene, malware defence, awareness, logging, backups. If asked "where do we start with a small acquired business?" — IG1.

Q4. Why PCI-DSS at Walmart, and what's in Requirement 10? Cardholder data is core to retail; v4.0.1 (June 2024) is the enforceable baseline, and future-dated requirements (automated log review) became mandatory 31 Mar 2025. Req 10 = log all access to system components and cardholder data: complete, tamper-protected logs (who/what/where/when/outcome), daily review with automated mechanisms, 12-month retention — the backbone of SOC monitoring.

Q5. GDPR vs. HIPAA breach notification? GDPR: supervisory authority within 72 hours of awareness (Art. 33), individuals without undue delay if high risk (Art. 34). HIPAA: individuals ≤ 60 days, HHS and (for 500+ residents) media. Mention the clock starts at awareness — IR and legal run in parallel.

Q6. Tell me about a recent CVE. (use the 5-move technique) CVE-2025-53770 "ToolShell" (+ CVE-2025-53771) — unauthenticated RCE on on-prem SharePoint (53770 = deserialization bypass of Pwn2Own CVE-2025-49704, CVSS 9.8; 53771 = auth-bypass variant of CVE-2025-49706; on-prem only, M365 not affected), exploited from ~18 Jul 2025; attackers stole the MachineKey and dropped web shells; emergency patches + CISA KEV. My playbook: inventory internet-facing SharePoint, patch, rotate MachineKeys, sweep logs for ToolShell patterns. Insight: patch bypasses mean "we patched" isn't closure — verify with detection.

Q7. What is Log4j's lasting lesson? Not the CVSS 10.0 JNDI RCE — the transitive dependency blind spot. You can't patch what you can't inventory, which is why SBOMs (SPDX/CycloneDX) became policy (EO 14028 §4(e)(vii)/§10(j); CISA draft 2025 Minimum Elements). With thousands of Java services and vendors, SBOM + dependency scanning is how Walmart survives the next Log4Shell.

Q8. Walk me through a zero-day playbook. Exploited pre-patch = assume breach: exposure inventory → patch/mitigation per KEV SLA → hunt published IOCs/TTPs + integrity checks → rotate credentials/keys → segment/least-privilege to cap blast radius → documented comms (72h GDPR clock if EU data) → add detections → root-cause retro.

Q9. How would you use AI in a SOC, and what scares you? Layered: UEBA baselines, SOAR for deterministic containment, LLM copilots for summarisation/enrichment (like Security Copilot's triage agent). Risks: hallucinated IOCs, prompt injection via ingested tickets, automation bias, data leakage. Mitigations: human-in-the-loop containment, grounded citations, red-team the LLM, measure hallucination rate, log every AI action.

Q10. How do you stay current? (JD: "research and document latest trends") Sources: GTIG zero-day reviews + M-Trends, CISA KEV/alerts, vendor advisories, BleepingComputer/SecurityWeek, NVD. Method: a CVE notes file in the 5-move format (impact → attack story → detection → playbook → insight) — which is how I can discuss CVE-2025-0282 today. CTFs keep my hands current.

Q11. When is each framework used? CSF = voluntary risk taxonomy for the whole programme; ISO 27001 = certifiable ISMS for governance/procurement trust; PCI-DSS = mandatory, prescriptive, audited controls for cardholder data. They overlap: a logging control is CSF DE.CM, ISO A.8.15 and PCI Req 10 at once; MFA is CSF PR.AA, ISO A.8.5, CIS 6.3–6.4, PCI 8.4.2/8.5 — one control, three-to-four mappings.

Q12. Why does Walmart need a cyber intern now? Three converging facts: 2025 proved retail is a prime ransomware target (M&S/Co-op), zero-day exploitation is shifting to enterprise edge gear (48% of 2025 zero-days), and Walmart is deploying Agentic/GenAI globally — expanding the attack surface faster than controls mature. The InfoSec org (incl. Chennai AI Security & Safety) needs engineers who can research threats and translate them into controls.

Q13. OSCP vs. CEH vs. Security+? Depth and stance: Security+ = broad baseline & vocabulary (blue/GRC entry — sit 701 now if studying; V8 SY0-801 planned ~Nov 2026, both overlap to Jun 2027), CEH = broad offensive methodology (knowledge exam; practical optional), OSCP = proving you can compromise and document a network in 23h45m (highest hands-on credibility). My plan: Security+ first, then OSCP for red-team depth — CTFs are my current practical signal.

Q14. What is SBOM and one modern update? Software Bill of Materials — machine-readable inventory of components + dependency relationships ("ingredient label"). CISA's draft 2025 Minimum Elements (Aug 2025; comment closed Oct 2025) proposes new Component Hash, License, Tool Name, Generation Context, explicit transitive-dependency coverage and "known unknowns" disclosure. Formats: SPDX/CycloneDX (SWID legacy).

Q15. Acquired retailer has no framework programme — day 1 to day 90? Scope cardholder-data exposure → CIS IG1 gap assessment (56 safeguards) → draft CSF 2.0 target profile → map controls to Walmart policy/PCI scope → 90-day plan with owners, KEV-SLA patching and logging (Req 10) first.

Q16. Which AI/ML cert would you pursue and why? AI-102 or Google PMLE for model-building (matches TensorFlow/scikit-learn projects), then AI-security (AAISM once CISM/CISSP-eligible; ISC2 AI cert when operational ~2027) — building vs securing are different signals.

4. Revision Table (final-week sprint)

5. Mistakes to Avoid

1. Guessing versions/dates. Say "CSF 2.0, February 2024", "PCI-DSS v4.0.1" — never "the latest NIST framework". If unsure: "I believe it's X; I'd verify against NVD/PCI SSC."
2. Confusing cert facts. Don't claim certs you don't hold; don't say the ISC2 AI cert exists today (in development); don't cite SY0-601 (retired Jul 2024).
3. Framework tourism. Names without Walmart mapping (payments → PCI, vendors → SBOM/GV.SC, SOC → Req 10 + CSF Detect) = memorisation, not engineering.
4. CVE name-dropping. A bare "Log4j was bad" is noise — use the 5-move structure and end with what you would do at Walmart.
5. AI hype or AI doom. Both "AI replaces SOC analysts" and "AI is useless, it hallucinates" fail. Give balanced pros/cons + human-in-the-loop.
6. Outdated zero-day narrative. "Attackers target browsers" is wrong for 2025 — GTIG shows browser exploitation at historic lows; enterprise edge gear is the frontier.
7. Forgetting the clock. GDPR 72h, HIPAA 60d, PCI 12-month log retention are the numbers interviewers remember.
8. No question back. End with: "How does Walmart's SOC use AI copilots, and how do you validate triage accuracy?" or "How do red-team findings map into PCI/NIST remediation SLAs?"

Verified sources: NIST CSWP 29; PCI SSC v4.0.1; ISO 27001:2022 Annex A; CIS v8.1 IG1; HHS Breach Rule; EDPB Art. 33/34; CompTIA SY0-701/SY0-801; EC-Council CEH v13; OffSec OSCP+ notices; GTIG 2025 zero-day review; M-Trends 2025; CISA draft 2025 SBOM Minimum Elements (comment closed Oct 2025); SecurityWeek/BleepingComputer; Walmart Global Tech India press/Reuters/ET (2023–2026). $1B India tech claim removed — no primary source; headcount targets hedged as reported.