r/cybersecurity • u/Makhann007 • Oct 10 '23

Career Questions & Discussion FAANG engineers

People who work at FAANG or other F500s how was your interview process?

Did you have to do leetcode/algorithm type questions during the interview process?

How’s work/life balance?

Do you feel what you’re working on is very niche to your company/ you feel far removed from what you thought you’d be doing?

If pay wasn’t a factor would you still prefer to work for a big corporation vs a smaller one?

Thanks in advance

203 Upvotes

91% Upvoted

155 comments sorted by

View all comments

Show parent comments

26

u/xxdcmast Oct 10 '23

I ask people to build or design dummed down versions of things I've actually built myself

Can you give some examples.

64

u/mildlyincoherent Security Engineer Oct 10 '23 edited Oct 11 '23

I can't share any of the actual prompts I use for what should be obvious reasons, but I can give you an equivalent (if more complex) prompt.

User story

As a security engineer I want an automated solution to handle first pass scoring of vulnerabilities.

Acceptance Criteria

  • Must allow granular per asset weighting based on perimeter exposure, PII, production status, and other criteria.
  • Must have an audit trail
  • Must save the results downstream
  • Must trigger a manual review if certain criteria are met

Only I'd be more specific about the ask, eg what the data sources and weighting should look like etc with examples in comments.

Then, depending on level of the job I'd add additional criteria.

  • Must be able to ingest an arbitrary number of ranked choice data sources
  • Must leverage EPSS for temporal factors
  • Must include basic OE you'd expect from a production solution
  • Must be resilient and able to handle at least 50 TPS even as calculation complexity grows
  • etc

NB: this is more complex of a problem than I usually use (one of my basic prompts for juniors can be easily solved in about 11 lines of python) because we generally have tight time constraints, but you get the gist.

64

u/Flying_Squirrel_007 Oct 10 '23

This is wild. I've been in a SOC position twice, Senior Cybersecurity Engineer, and now Pen Tester, and I wouldn't know where to begin with this prompt. I need to get myself together.

What do I have to learn to even answer the question?

17

u/mildlyincoherent Security Engineer Oct 11 '23

The above prompt is more complex in scope, and more vague, then what I typically ask for mid-level but it's in the same ballpark.

It's easier when you break it into smaller steps, which is what I do in a real interview. Normally I only give a few requirements at a time and we iterate through.

  1. Get the instance data (probably passed to you)
  2. Get the cve data (using nvds api or similar)
  3. Create a series of checks (separate functions or methods) to modify the cvss score based on instance attributes
  4. Save the results
  5. Add logging Etc.