So: First of all, you should know that I am writing this review with my middle fingers. I applied for a job at Deloitte in cybersecurity which worked out pretty well. After an initial interview with HR, I had an interview with a team manager. Here normal questions were asked and everything went well so far. After that, I went on to take an assessment test, which required normal statistical questions and analyzing graphs. There was also a personality test. All in all, I estimated about four hours for this, although it should be mentioned that there was no time limit. After that I had another interview with the HR, who gave me a positive answer and informed me for the first time that the position in particular, which was advertised as a permanent position, was actually only for interns. When I clearly expressed that this would not be an option for me, I received a call back from the HR, in which I was told that I could continue with the process, but they still had to see if it would directly lead to a permanent position. So far so good. I got to the next round and was allowed to do a case study. After a week of preparation and presentation, I had a one-hour interview with a manager and a senior consultant, in which I presented the case for about 30 minutes and had to answer 15 minutes of questions about the case. Afterwards there were open questions, where I had the chance to ask some. Finally I got the call from HR with a positive answer, also that the manager and senior consultant confirmed that I was suitable for a permanent position. According to the process I was told to have a final interview with the director of the division. In this interview there were no specifications and it was (as I was confirmed on the phone, pro forma). Nevertheless, I prepared myself for general questions and some topics where I had performed not so well in the prefious interviews. Finally I got scheduled the interview, but several times during the interview, I had the feeling that the Director was not really attentive. I heard various messages in the background, his eyes were reading something on the screen, he spoke passively and he was typing alongside. All well and good, it's just that I had the feeling that the interview as superfluous. In general also normal questions like "What are strengths and weaknesses" etc. After the interview I got the call from HR that they had agreed to offer me an internship. After the effort with assessment, case study + presentation, various interviews and a confirmation that it was a permanent consultant position, I feel sad about how it went and unfair from Deloitte. After receiving the offer and reviewing the documents, I declined. In general, I had to reflect that many promises are made that are not kept. In such a company, however, you would expect that the application process follows clear structures and that job postings are also clearly declared for which you are applying.

Ho fatto il processo di selezione per una posizione da Cybersecurity Consultant in Deloitte qualche tempo fa, ed è stato abbastanza strutturato. All’inizio ho semplicemente inviato la candidatura online. Dopo pochi giorni mi ha contattato una recruiter per un primo colloquio conoscitivo. Era abbastanza tranquillo: mi ha chiesto di presentarmi, perché fossi interessato alla cybersecurity e soprattutto perché volessi lavorare in Deloitte. Abbiamo anche parlato un po’ delle mie aspettative e della disponibilità. Il passo successivo è stato il colloquio tecnico, che per me è stato quello più interessante. Non era un interrogatorio super accademico, ma più una conversazione. Mi hanno fatto domande sui concetti base di sicurezza informatica: network security, differenza tra firewall e IDS, vulnerabilità comuni tipo OWASP Top 10. Poi mi hanno dato anche qualche scenario pratico, tipo come avrei gestito un attacco phishing o cosa farei in caso di breach. Lì volevano vedere più il ragionamento che la risposta perfetta. Dopo c’è stata una parte più “consulenziale”, con una specie di case study. Mi hanno descritto una situazione aziendale (tipo un attacco ransomware) e mi hanno chiesto come mi muoverei. Ho cercato di strutturare la risposta, spiegando prima le priorità (contenimento, analisi, comunicazione) e poi le azioni da fare. È stato importante spiegarsi bene, non solo sapere le cose. Infine ho fatto un colloquio con una figura più senior, tipo manager. Era meno tecnico e più focalizzato su di me: come lavoro in team, come gestisco situazioni difficili, e qualche domanda sulle mie esperienze passate. Volevano capire se ero adatto a un contesto di consulenza, quindi anche capacità comunicative e approccio al cliente. Nel complesso, il processo è durato qualche settimana. La cosa che mi ha colpito è che non cercavano solo competenze tecniche pure, ma qualcuno capace di ragionare, comunicare bene e adattarsi a contesti diversi.