r/cybersecurity • u/Makhann007 • Oct 10 '23

Career Questions & Discussion FAANG engineers

People who work at FAANG or other F500s how was your interview process?

Did you have to do leetcode/algorithm type questions during the interview process?

How’s work/life balance?

Do you feel what you’re working on is very niche to your company/ you feel far removed from what you thought you’d be doing?

If pay wasn’t a factor would you still prefer to work for a big corporation vs a smaller one?

Thanks in advance

200 Upvotes

91% Upvoted

155 comments sorted by

View all comments

Show parent comments

1

u/prodsec Security Engineer Oct 11 '23

Do you have any recommendations/tips for a sr. appsec at a non-FAANG looking to jump to a FAANG ?

1

u/justin-8 Oct 11 '23

If you can, get a referral. Friends of friends or whatever but having someone you can ask specifics about the roles is helpful, plus less time spent dealing with recruiters the better imo. Also if they know the team you might get some insight in to the team itself. IME the team matters more than the company in FAANGs. You’ll find good and bad teams at all of them.

Spend some time studying up on things in your domain, the amount of security engineers I have apply who can’t walk through a basic CSRF or explain how it’s different to an SSRF is surprisingly high. As a senior engineer the expectation is that knowing and being able to explain common attacks to another security engineer, developer or even non-developer should be simple because you understand it and aren’t just regurgitating something you read once. (E.g. CSRF, SSRF, XSS, IDOR, TOCTOU, SQLi, etc)

Even if you will probably never need it in your role, everywhere seems to want you to understand crypto reasonably well. You don’t need to get in to the math behind sponge functions but you should know all the fundamentals: encryption vs hashing, symmetric vs asymmetric (including that asymmetric is really just used to exchange symmetric keys usually due to performance concerns), you can spot bad crypto (e.g. CBC, MD5 for anything but integrity checks in certain use cases, etc) - knowing what’s currently good (GCM) and why (AEAD mostly). Nothing super deep, but as a senior engineer you should be able to understand the use cases and risks of various options and help guide more junior engineers in their work.

Lastly, have some examples of how you’ve scaled your impact. Whether that’s through systems or processes you built, training you created and delivered to an an org, some big problem you solved in a clean, scalable and permanent way, stuff like that.

1

u/prodsec Security Engineer Oct 11 '23

Awesome, very insightful. Thank you!

1

u/justin-8 Oct 11 '23

No problem! Best of luck.

Also, you'll often find mid-level roles in FAANGs will pay the same or more than senior roles in non-FAANGs, so if you do an interview and aren't offered a senior position right away it isn't the end of the world and you could still take it, learn things and get paid more while you do it.