Did the PANW DE loop for a role on their cloud telemetry platform team. This was a senior DE position in Santa Clara, late 2025, so 2026 readers should expect similar structure.
Five rounds total: recruiter, coding screen, then a 4-round onsite.
Phone coding screen Leetcode-style SQL: given a table of security alerts, write a query to identify devices that triggered more than 3 distinct alert types within a 1-hour rolling window. It's a window function + GROUP BY problem. Took me 25 minutes, which they said was about average.
Onsite: Data pipeline design Design a streaming ingestion pipeline for firewall log data. ~100GB/day across thousands of enterprise endpoints. They asked about: Kafka vs Kinesis trade-offs, schema evolution (how do you handle a new log field without breaking downstream jobs), exactly-once semantics, and how you'd handle backpressure. This is where the security context matters. They process petabytes of telemetry and they want someone who's actually designed at that scale.
Onsite: SQL + transformation logic Two questions. One aggregation (median per group without a MEDIAN function), one deduplication problem (find the canonical record when you have duplicate device check-ins within a 30-second window). Straightforward if you've done data quality work before.
Onsite: Distributed systems This one surprised me. They asked: you have a real-time threat detection job reading from Kafka. The job crashes. When it restarts, how do you ensure you don't reprocess events that already triggered alerts AND don't miss any? We got into consumer group offsets, idempotent writes, and exactly-once processing. It's not a typical DE interview question; it felt closer to SRE territory. I think they care because a duplicate alert can create real operational noise.
Onsite: Behavioral Classic: tell me about a pipeline you owned that went down in production. How you detected it, how you communicated, what you changed. They want blameless post-mortem thinking.
Offer came in around $195k total, base $148k. 4-year vest. Pipeline took 6 weeks.