u/Xolanke

Google released HEIR (Homomorphic Encryption Intermediate Representation), an open-source compiler toolchain that can convert pre-trained AI models, ones that normally operate on unencrypted data, to instead operate on encrypted inputs. The server runs your model on encrypted data. Never decrypts. Never sees what it's computing on. Your data stays private. (at least it seems so).

Honestly Google surprised me with this one guys

As a graduate, I searched for a job for almost 2 years. And I just attended 3 face-to-face interviews (not including the AI chatbot interviews). I thought something was wrong with me. That I couldn't get a job.

Well that was not the case. One of my friends told me that the interview is just a mask show. You wear the mask and what they expect from you is far from what they want.

Then I realized that I needed to prepare for the Interviews, not the positions.

Then I created a prep book for myself from different sources on the internet. I followed every step and FINALLY i got the job.

It is a Junior Cybersecurity Analyst job but you gotta start from somewhere.

If you want the prep book or other prep books I prepared for other job fields, please comment or dm me

So I finally landed my first pentest role after OSCP. Honestly took way longer than it should have. Not because I wasn't technical enough, but because I had zero idea how offensive security interviews actually worked (I am a career changer btw).

Sharing everything I learned. Hope it saves at least one person here from the same frustration.

The questions that genuinely caught me off guard:

"Walk me through your methodology for a black-box web app start to finish."

I almost said "I run Nmap first" and stopped myself. They don't want to hear about tools. They want to hear that you have a process. Passive recon before you touch anything( crtsh, Shodan, Wayback Machine, Google dorks). Build your target profile first. Then enumerate. Then test manually before you even think about automation. Methodology over tools, every time.

"What's the first thing you do after getting a shell on a Windows box?"

Not "open Meterpreter." Situational awareness. whoami /all. systeminfo. netstat -ano. tasklist. You need to know your privilege level, the network around you, and what security tooling is running before you breathe wrong. This answer alone apparently filters out a huge chunk of candidates.

"Walk me through Kerberoasting. Why does it actually work?"

Don't just say "you request tickets and crack them offline." They want the WHY — any authenticated domain user can request a TGS for any SPN. The ticket is encrypted with the service account's password hash. Weak password = cracked offline with hashcat, zero lockout risk. The mechanism matters more than the tool name.

"What are Metasploit's limitations?"

This is a trap and most people walk straight into it. "It gets caught by AV" is not the answer they want. The real answer: default payloads are heavily signatured, staged payloads need network callbacks that firewalls often block, and running modules you don't understand is a genuine liability on a real engagement. Know the edges of your tools.

The thing that actually got me the offer (or at least what I think):

I brought a redacted lab report. Not a cert. Not a list of HTB machines. An actual professionally written pentest report from a lab environment with CVSS scores, reproduction steps, and executive summary. Nobody else did that probably because they looked hella shocked.

I can answer your questions (if you have any) in the comments or through dm