I just interviewed a person for a Senior Cloud Engineer position. He has a ton of credentials about security, like SOC2, HIIPA...
My first cloud question is "what would you do if you have a service that is located in a public subnet and is getting accessed through the public IP of the instance". I asked some ownership and leadership questions before this.
He didn't talk about security groups, he didn't mention that he'd check if the instance if open to any attacks, didn't mention that the instance should be migrated to a private subnet. When I explicitly told him to please fix the network layout, he insisted the public subnet was the correct place for an API service running in EC2. When I told him it should go in the private subnet he said that clients would need to connect to the instance via the NAT. That's not how an AWS NAT works, omg.
I rejected this person, not solely based on this, but this was a very bad start to the interview. Am I wrong to think this is a big deal? This is the sort of stuff I learned on my first week reading about the Cloud and this guy has 12+ years of experience working with all the cloud providers and doesn't know it? It was such a big red flag.
Any opinions? I just want to make sure I'm not being a dick, maybe someone can defend this guy and make me see why this is acceptable.