I asked the interviewer how I should address her. Her face and tone changed immediately.

She had clearly taken offense – not a good start.

She then asked me about a recent threat I'd worked on. After describing a recent and typical example of a certain threat, she replied, "How is that [TTP]?"

This was surprising, since I'd explained it in very accessible language. Nevertheless, I explained the threat in another way, using very plain English. She stared at me blankly then moved on.

She asked how I'd detect a specific type of threat. I referred to a certain event type logged by EDR. She questioned whether such an event type exists!

I recapped three leading EDRs that log that event type. She quickly moved on.

Her tone and demeanor throughout the interview were abysmal. Despite being overqualified for her questions, I wasn't surprised she didn't put me through.

What is surprising is that Citadel would employ someone with so little intelligence or expertise.

Tell me about a recent threat you've worked on.