I applied for a security analyst position where the job posting said "0-3 years experience". During the recruiter interview, he said there was a single opening in an office of 11 people, and it was to fill the position of an experienced analyst who was leaving. I asked why the job posting was explictly junior if they were replacing someone experienced. He revealed that 2 weeks prior, the same posting had advertised a senior position. He said they had found a couple of qualified candidates but could not meet their salary requirements, so they were "playing with the job posting". After the recruiter interview, I was sent a link to 3 "crackme" binaries, all for different architectures. Completing these requires significant prior experience and tooling. Advice to recruiters: be honest about the requirements in your job postings.

1 campus interview, 2 on site interviews, and 1 final interview with CTO. Campus interview was just getting to know some of the engineers and see if I was interested. The two on site interviews where more intense. Very technical and was finished off with an exam. One exam was software based. Was given a piece of code dealing with security, and had to find a bug with which it can be broken. Second exam was more challenging. Was given a schematic of a hardware setup, and had to find a way to break a boot loader. No security experience is necessary, but just a sharp mind to figure it out.