Explain auth, key rotation, secrets, and incident response

You are interviewing for a security-focused engineering role. Discuss how you would design and operate the following in a production microservices environment: 1. **Service-to-service authentication** - How services identify each other (mTLS, tokens), how trust is established, and how authorization is enforced. 2. **Key rotation** - What should be rotated (signing keys, mTLS certs, API keys), rotation frequency, and how to avoid downtime. 3. **Secret management** - Where secrets live, how they are accessed by workloads, how to prevent secret leakage, and how to audit access. 4. **Security incident response (technical)** - Given a suspected credential leak or unauthorized access, how do you detect, scope, contain, eradicate, and recover? What telemetry and controls do you rely on? Focus on concrete design choices, operational workflows, and common pitfalls.