Went from HR screen to 1 hour phone screen to on-site screen. The first two stages seemed good, and then the on-site. The on-site was 4 hours of same-origin policy. There were two breaks from this - one break was meeting with the hiring manager who was not incredibly engaging, or able to clearly elucidate technical security goals, and the other was the remote 'grey hat' who was there before the hiring manager had started.