RMFInsider

The recruiter phone screen is not an interview. It is a filter with four jobs: confirm that the resume describes a real person, confirm that you are eligible for the work (citizenship, clearance status, work authorization, location), confirm that your salary expectation fits the rate the company already bid, and find out whether you can talk about security work for two minutes without reading from a page. That is it. You do not win the job on this call, but you lose it on this call, and the two ways people lose it are answering the salary question badly and being unable to describe their own resume out loud. Twenty minutes, four checkboxes. Prepare for those four things and you will pass consistently.

Why the screen exists at all

Recruiters work a requisition with a rate band, a clearance requirement and a location, and they are measured on the volume of qualified candidates they hand to a hiring manager. A candidate thirty thousand dollars above the band, or who needs a clearance the contract cannot sponsor, wastes a manager’s hour. The screen protects that hour.

The recruiter is therefore not trying to trap you. They want you to pass, because passing candidates are their output. Give them clean answers on eligibility and pay and they will advocate for you internally, including telling you what the hiring manager cares about. Recruiters are an underused source of inside information in a job search.

The logistics that quietly disqualify people

Every item below has removed a real candidate from a real process. None involve skill.

• No voicemail set up, or a mailbox that is full. A recruiter with eleven candidates does not call a twelfth time.
• An unprofessional or unclear outgoing message. Record one that states your name plainly.
• Taking the call while driving. The recruiter can hear it, the call quality is poor, and you cannot take notes or look at the posting.
• A bad connection you keep apologizing for. Ask to switch to a landline or reschedule rather than losing half the answers.
• No quiet room. A screen conducted from a grocery store parking lot with a baby in the back seat reads as poor planning, fairly or not.
• Not having the job posting open. Half the questions are about the posting.
• Not knowing which company is calling. If you have applied to forty reqs, keep a one-line tracker with company, contract if known, and posting title.
• No calendar availability offered in reply. Give two or three concrete windows in your first response.

Set the outgoing voicemail today, before you send another application. It is the cheapest fix in a job search and the one I see skipped constantly.

The two-sentence opener

The screen almost always begins with a version of walk me through your background. This is not an invitation to narrate your life. Answer in two sentences plus one hook, roughly thirty seconds, and then stop talking.

A working shape: sentence one states where you are now and what you do, sentence two states the relevant credential and the direction you are moving, and the hook names the work in the posting. For a career changer: I spent six years in IT support at a hospital, handling account provisioning and endpoint issues for about four hundred users. I earned Security Plus in March and I have been doing RMF documentation work in a home lab since then, writing control implementation statements and a system security plan. The reason I applied to this one is the ISSO support piece, because that documentation work is what I want to do full time.

That answer establishes real work history, names a credential with a date, and shows you read the posting. Then it ends, which leaves the recruiter room to ask what they actually care about instead of waiting out a four-minute monologue.

The nine questions that come up nearly every time

Answers below are models, not scripts. Say them in your own words, keep each under forty seconds, and never pad.

• Walk me through your background. Two sentences plus a hook, as above. End it deliberately.
• Why are you looking to leave? Neutral and forward-looking. I have taken the help desk role as far as it goes here, and the security work I want is on a different team that has no openings. Never criticize a current employer on a screen.
• What are you looking for in your next role? Name the work, not the perks. I want to be doing RMF and compliance work daily, ideally supporting an ISSO, with room to move toward ISSO myself in two or three years.
• What is your salary expectation? See the next section. Do not answer with a single number before you know the band.
• Are you a US citizen, and do you hold a security clearance? Answer factually and precisely, in one sentence, with dates. Precision here is covered below.
• What certifications do you hold, and are they current? Name them with the year earned and the expiration. I hold Security Plus, earned March 2026, good through March 2029. If you are studying for one, say you are scheduled and give the date, not that you are planning to.
• This role is on site in Honolulu five days a week. Does that work? Answer yes or no. Do not negotiate remote work on a screen for a cleared role that requires a SCIF, because the answer is not the recruiter’s to give.
• Tell me about your hands-on experience with one thing from the posting. Pick the truest example you have, describe what you did in three steps, and say plainly where your experience stops. I have applied STIGs in a lab using STIG Viewer and Evaluate STIG against a Windows Server build, and I have not done it at scale in production yet.
• What is your availability, and when could you start? Give a real notice period and, if a clearance is involved, say you understand the start date may depend on processing. Two weeks notice, and I understand badging and read-on may set the actual date.

The pattern across all nine is the same: specific, short, bounded by the truth. Recruiters hear vague answers all day, and vague reads as either inexperienced or evasive. For the deeper technical version of this, once you reach the hiring manager, the entry-level cybersecurity interview questions with real answers walk through what a technical panel actually asks.

The salary question when you do not know the range

The recruiter asks for a number because the band is fixed and they need to know whether to continue. You want the band first, because on a contract the band is bounded by the bid rate and there is no prize for guessing low.

Ask for it, once, cleanly: I want to make sure I am in range for the level this is budgeted at. What band was this requisition approved for? As of 2026 a growing set of jurisdictions requires the range to be disclosed, and in Hawaii, California, Colorado, Illinois, New York and Washington it generally has to appear in the posting itself, while several other states require it on request. Read the posting again before the call, because the number may already be there.

If the recruiter will not give a band, give a researched range rather than a point, anchored to the role and the location, and say what it is based on. Based on cleared ISSO support roles in this metro, I have been seeing roughly $85,000 to $105,000 at this level as of 2026, and I am comfortable in that range depending on the clearance requirement and the schedule. That is an answer, not a dodge, and it leaves room. The full mechanics of moving a number after an offer exists are in the guide to negotiating a cybersecurity salary offer, and the short version is that the screen is not where you negotiate. It is where you avoid being screened out.

One thing not to do: naming your current salary as your expectation. Coming from help desk at $52,000, that number becomes the anchor, and it has nothing to do with what the labor category pays.

Stating clearance status precisely

This is where honest candidates create problems by being imprecise, and where a few candidates disqualify themselves outright by rounding up. Recruiters verify eligibility, so an overstatement surfaces immediately and ends the process.

Say the level, the year granted, the investigation type if you know it, and whether you are currently in access. Examples that work: I hold an active TS with SCI eligibility, last investigation 2023, currently in access. I was granted Secret eligibility in 2021 and was in access until March 2024, so I am out of access now. I have an interim Secret, with the Tier 5 submitted in June. I do not hold a clearance and have never been investigated, and I am a US citizen eligible for sponsorship.

Two details worth knowing. Eligibility that has lapsed out of access for a shorter period can sometimes be reinstated rather than reinvestigated, depending on the age of the investigation and continuous vetting enrollment, so give the dates and let the facility security officer make that call rather than guessing on the phone. And never say you are clearance eligible without explaining what you mean, because to a cleared recruiter that phrase means you hold current eligibility, not that you believe you would pass. If you are not sure how the sponsorship path works from where you stand, the walkthrough on landing a first cleared cybersecurity job covers it.

What to ask back, and how to close

Ask two or three questions, no more, and make them process questions. You are gathering intelligence, not auditioning.

• Which contract is this on, and is the position funded right now?
• What does the interview loop look like from here, and who would I be talking to?
• What is the one thing the hiring manager needs this person to do well on day one?
• What band was this requisition approved for?
• What is your timeline for filling it?

Then close in one sentence: this sounds like the work I want, I am interested, what is the best next step. Say it out loud. Screens end all the time with the candidate having never expressed interest, and recruiters pass that along.

The unglamorous truth about passing screens

Passing this call reliably is a preparation problem, not a personality problem. You need a thirty-second opener you have said aloud ten times, a clearance sentence with real dates in it, a salary range you can defend, a quiet room, and a working voicemail. That is the entire list. The reason it feels harder is that everything upstream has to work first, which is why your resume needs to survive the applicant tracking system keyword pass and why a short, specific cover letter that names the contract or the work still gets calls that a generic one does not.

Write your four answers down this week, read them into your phone, and listen back once. It is a genuinely unpleasant five minutes and it will fix more than another study guide will. If you want the whole sequence, resume through screen through panel through offer, built in the order that actually produces cleared interviews, that is what Zero to Hired exists to do.