Palo Alto Networks · Primly Community

Palo Alto Networks data engineer interview: pipelines, SQL, and one genuinely hard distributed systems question

analyst_ana · 4 replies

Did the PANW DE loop for a role on their cloud telemetry platform team. This was a senior DE position in Santa Clara, late 2025, so 2026 readers should expect similar structure.

Five rounds total: recruiter, coding screen, then a 4-round onsite.

Phone coding screen Leetcode-style SQL: given a table of security alerts, write a query to identify devices that triggered more than 3 distinct alert types within a 1-hour rolling window. It's a window function + GROUP BY problem. Took me 25 minutes, which they said was about average.

Onsite: Data pipeline design Design a streaming ingestion pipeline for firewall log data. ~100GB/day across thousands of enterprise endpoints. They asked about: Kafka vs Kinesis trade-offs, schema evolution (how do you handle a new log field without breaking downstream jobs), exactly-once semantics, and how you'd handle backpressure. This is where the security context matters. They process petabytes of telemetry and they want someone who's actually designed at that scale.

Onsite: SQL + transformation logic Two questions. One aggregation (median per group without a MEDIAN function), one deduplication problem (find the canonical record when you have duplicate device check-ins within a 30-second window). Straightforward if you've done data quality work before.

Onsite: Distributed systems This one surprised me. They asked: you have a real-time threat detection job reading from Kafka. The job crashes. When it restarts, how do you ensure you don't reprocess events that already triggered alerts AND don't miss any? We got into consumer group offsets, idempotent writes, and exactly-once processing. It's not a typical DE interview question; it felt closer to SRE territory. I think they care because a duplicate alert can create real operational noise.

Onsite: Behavioral Classic: tell me about a pipeline you owned that went down in production. How you detected it, how you communicated, what you changed. They want blameless post-mortem thinking.

Offer came in around $195k total, base $148k. 4-year vest. Pipeline took 6 weeks.

4 replies

infra_ines

That exactly-once Kafka question is rough. Did they want you to code anything or was it a design/verbal discussion?

de_derek

Purely verbal design. But they pushed back on everything. When I said 'transactional writes' they asked exactly what transaction boundary I meant. Be ready to defend each layer.

backend_bekah

The schema evolution question is something I mess up constantly in interviews because I talk about Avro and just assume they know what I mean. Did they want you to go into specifics or was keeping it conceptual fine?

sec_sasha

Makes total sense that the telemetry team cares about duplicate alert suppression. A noisy SIEM is one of the biggest ops headaches in security. Good signal that they interview for it.