I applied online. I was contacted within an hour by a Technical Recruiter, and arranged a call in which the interview process was described.
The process is composed of the following:
- A home task
- Technical Interview with two Application Security Engineers
- Interview with CISO/Project Manager
- Interview with HR/Cultural Interview
Despite applying for the Application Security Engineer position, I was eventually put into the process for the SecOps position. I was fine with that, but I believe due to miscommunication on both ends, I was given the impression that I can qualify and later make up my mind, for both the positions.
The home task is a PCAP analysis and a report needs to be conducted, describing its contents based on the instructions. According to the technical recruiter, this should be taking the candidate a couple of hours, however it took me a day, since I wanted to be to a certain level detailed with my analysis and use Latex, since this is supposed to be a formal report. You have in total approximately two days for the task.
The outcome of the home task was positive and I proceeded to the technical interview, in which the following were to be addressed by the interviewers:
1. Interviewee's experience; with a suggestion to get into technical details.
2. 10' home task review
3. 2, 3 scenario based/technical exercises related to automation and scripting
4. Interviewee's questions
And this is the part that made me feel sad and disappointed about the whole process:
1. I described what I am currently doing in my current role and went into technical details, as suggested, with what I also doing with the rest of my time - got no response or comment on those.
2. I was expecting some feedback on the home task, but I got only one question about my approach. No feedback on my approach either.
3. No task related to automation/scripting. I was asked to do a code review in which personally I would like to have some more freedom and flexibility to work with, but instead I was getting hints, which, of course, made me feel anxious and stressed. However, in the end, I remember getting a comment like: "You've done well with this, let's continue". Further questions were things like: UNIX traceroute vs Windows tracert,to the level of protocol, Docker nodes and images, attacks on the SSL, general security related questions, open-ended questions etc.
4. I asked about two things that I am interested in; whether pentesting or low-level (like reverse engineering/malware analysis) tasks are part of the role. The answer was negative to both of those, which, however, was not an issue, as working in FinTech is also a goal of mine and I wanted to focus on that.
Two days later I received the classic rejection email with a call following up with a more detailed feedback. The feedback in short mentioned that my knowledge has a lot of holes in comparison to my experience. I was expected to be able to do very well on the code review and I have a broad knowledge, but due to the fact that the team is small, they want someone with in-depth knowledge.
In short, I am not eligible due to my knowledge gaps and I am not matching the role as more experience was expected on my end; which is summed up to a classic statement of a rejection letter with no actual feedback being provided - you are just not matching the role.
It should be clear by now that there are A LOT of contradictions on the various stages of the interview:
- The code review was the most essential part, but I was not informed until the interview about it.
- The technical questions should mainly be about automation/scripting, but none of them were.
- I did not do well on the code review, but I got a comment that I did do well.
- I need to have in-depth knowledge but I was asked for various and different things.
- I need to have the experience for this role, even though this is nowhere quite clear.
- I've applied for an Application Security Engineer role, but I was expected to be equally a DevSecOps, an Incident Responder and a Solutions Architect.
In brief, I can suggest Revolut to be quite more clear with what they are expecting from their candidates and provide some structural feedback that can actually be helpful. What you are saying in your feedback does not match with what the skills of the potential candidate should be. At least be clear and not waste both the candidates' and your time.