I applied for the position of Senior Security Engineer (Application) through LinkedIn. The interview process consisted of four rounds. The first round was a one-way video interview with three to four behavior-related questions. The second round was a home assignment in which I was given a vulnerable lab to complete within seven days and send a detailed report. I took this task seriously and finished it in six hours, submitting the report promptly. The third round was a technical discussion, and the fourth round was with the CTO. Interestingly, during the third round, I was interviewed by two VPs with a developer background who informed me that they only had one engineer in the application security team. In my career, I have conducted more than 50 interviews, but I doubt any candidate has ever felt that I had wasted their time during the interview process, as I did after undergoing this interview. I was asked one question by each of them. One guy asked me how JWT works. I explained it well, even outlining the different ways JWT tokens can be vulnerable and how to exploit them. However, being from a development background and in a managerial position, I believe that my explanations went over the interviewers' heads. I think they might have expected me to answer more theoretical aspects of JWT. Later, I came across an old interview review on Glassdoor for the same position in which the candidate mentioned the question he was asked in the interview was about the use of JWT for authentication and authorization. I think the interviewer might have only read the theory about JWT and did not make an effort to learn more about application security before conducting interviews with professionals. The other guy asked me one or two questions about my knowledge of SSDLC, and my interview was completed within 20 minutes. After working so hard on the lab and spending my time, it was disappointing to be rejected by people who asked how JWT works to a candidate with 7-8 years of experience. I suggest that they hire technical experts to conduct technical interviews. In the end, I am happy that I do not work with such a crowd. 😃

I applied for the position of Senior Security Engineer (Application) through LinkedIn. The interview process consisted of four rounds. The first round was a one-way video interview with three to four behavior-related questions. The second round was a home assignment in which I was given a vulnerable lab to complete within seven days and send a detailed report. I took this task seriously and finished it in six hours, submitting the report promptly. The third round was a technical discussion, and the fourth round was with the CTO. Interestingly, during the third round, I was interviewed by two VPs with a developer background who informed me that they only had one engineer in the application security team. In my career, I have conducted more than 50 interviews, but I doubt any candidate has ever felt that I had wasted their time during the interview process, as I did after undergoing this interview. I was asked one question by each of them. One guy asked me how JWT works. I explained it well, even outlining the different ways JWT tokens can be vulnerable and how to exploit them. However, being from a development background and in a managerial position, I believe that my explanations went over the interviewers' heads. I think they might have expected me to answer more theoretical aspects of JWT. Later, I came across an old interview review on Glassdoor for the same position in which the candidate mentioned the question he was asked in the interview was about the use of JWT for authentication and authorization. I think the interviewer might have only read the theory about JWT and did not make an effort to learn more about application security before conducting interviews with professionals. The other guy asked me one or two questions about my knowledge of SSDLC, and my interview was completed within 20 minutes. After working so hard on the lab and spending my time, it was disappointing to be rejected by people who asked how JWT works to a candidate with 7-8 years of experience. I suggest that they hire technical experts to conduct technical interviews. In the end, I am happy that I do not work with such a crowd. 😃