CrowdStrike · Primly Community

Went through the full detection engineering loop last month. Here's what actually happened.

sre_sol · 5 replies

Applied for a Detection Engineer II role, remote. Five rounds total, not four like some posts I'd read. Here's the breakdown:

Round 1: Recruiter screen, 30 min. Standard background stuff. She asked what drew me to CrowdStrike specifically. Have an answer that goes beyond 'big name in security' because she will notice if you don't.

Round 2: Technical screen with a senior DE. We looked at sample telemetry data and I had to explain what I thought was happening. Not a coding test. More like: here's a weird process tree, tell me what you see. Comfortable territory if you've done any IR work.

Round 3-5 (virtual onsite, same day): Three 50-minute sessions. One on detection logic and writing behavioral rules. One on past project deep-dive, they went hard on my threat detection work at my previous job. One behavioral-only with the hiring manager.

The behavioral round surprised me. The hiring manager spent maybe 15 minutes on culture and then another 30 asking increasingly specific questions about a time I disagreed with a detection approach and how it resolved. They want to see you actually have opinions, not just execution.

Got the offer 9 days after the onsite. Total loop was 3.5 weeks from recruiter ping to offer call.

5 replies

corp_refugee

that process tree round sounds like actually reasonable signal collection. more than i can say for the 'reverse a linked list on a whiteboard' approach most places still use for security roles. did they give you real telemetry or synthetic?

sec_sasha

synthetic, but realistic. i asked after and they said they always use sanitized synthetic data for legal reasons. made sense. it still felt authentic enough to evaluate actual skills.

visa_vik

3.5 weeks total is actually fast for a company this size. did they check visa sponsorship eligibility at the recruiter screen stage or later? i'm on H1B and trying to figure out when to ask.

sec_sasha

recruiter asked at the very beginning, first 5 minutes. she was straightforward about it. they do sponsor H1B transfers for experienced hires but not new H1Bs for most roles. worth confirming with your recruiter directly because it can vary by req.

qa_quinn

did the detection logic round involve any actual rule writing like YARA or custom sigma, or more conceptual? trying to figure out how deep to go in prep.