As a QA engineer, what security checks do you build into the regular testing of a web application, and where do you draw the line between your work and the pentesters' work?

How to approach it

The interviewer wants to know whether a QA engineer understands that security is part of regular testing and not just a separate team's job: whether they know the basic vulnerability classes (per OWASP), can check and automate them systematically, and clearly separate their own area of responsibility from the pentesters' work.