How Onyx Security Interviews Engineers
Onyx Security is an Israeli AI-agent security and governance startup whose platform lets enterprises discover, manage, and govern the AI agents running inside their walls, and monitors an agent’s reasoning at each step to catch malicious or unintended behavior before it does damage. The detail that actually predicts the interview loop is the founders: Maxim Bar Kogan and Gil Elbaz reportedly come out of Unit 8200 and the Israeli Air Force’s operational-technology world, which is why security is not a side round here, it runs through the whole loop. The company raised a reported $113M Series B led by Bessemer in July 2026, at a reported ~$640M valuation.
The company is small and moving fast, which matters for candidates. Loops at this stage are less standardized than at a public company, interviewers are often senior engineers or founders, and the bar is heavily weighted toward "can this person ship secure systems next week" over "can this person recite the optimal DP solution." If you want the broader pattern, it tracks with other AI-native company interview guides: applied over academic, security-aware, opinionated.
Round structure
The shape below is reconstructed from Onyx’s stack and product, the founders’ security background, and how comparable Series-B security startups run their loops, not from a large pool of public candidate reports, which barely exists yet for a company this new. Treat it as a well-grounded prior, not a leaked scorecard. Exact rounds shift by team and seniority, and staff-level candidates tend to get an extra architecture conversation in place of a second coding round.
| Stage | Length | Focus |
|---|---|---|
| Recruiter screen | 30 min | Background, why Onyx, security interest, comp expectations |
| Technical phone screen | 60 min | One applied coding problem, medium difficulty, in a real language and editor |
| Backend / systems round | 60 min | Design a service that ingests and evaluates agent telemetry at scale |
| Security deep dive | 60 min | Threat modeling, authz, agentic-AI attack surface (prompt injection, tool abuse) |
| Coding / debugging | 60 min | Extend or fix a realistic codebase, not a whiteboard puzzle |
| Behavioral / founder chat | 45 min | Ownership, past incidents, judgment under ambiguity, culture |
The technical screen
The first coding round is applied and usually done in a language you actually use, in a shared editor rather than a locked-down assessment tool. Think parsing and transforming a stream of structured events, implementing a rule evaluator over agent actions, or writing a small policy check that decides whether a given tool call should be allowed. It rewards clean, correct code and clear reasoning about edge cases over clever tricks. You rarely need heavy dynamic programming here, but you do need to be fluent: comfortable with hash maps, streams, and the standard library, and quick to spot the off-by-one or the unhandled null. Brushing up on the common coding interview patterns is enough; you are not being screened for competitive-programming range.
Backend and system design
This is where Onyx spends real time, because the product is a data and control plane sitting in front of thousands of agent invocations. A representative prompt: design the pipeline that captures every step of an agent’s reasoning and tool use, evaluates it against policy in near real time, and can block or flag an action before it executes. Now make it not fall over when one customer sends ten million events an hour.
Good answers get specific about the parts that actually break. How do you keep evaluation latency low enough to sit inline without wrecking the agent’s response time? What is buffered versus dropped under load, and how do you make that a deliberate choice rather than an accident? Where does state live, and how do you replay an agent’s trace after an incident? Interviewers push on backpressure, idempotency, and the read-versus-write tradeoffs of storing high-cardinality telemetry. If you have built anything resembling a rate limiter or an event-processing service, lean on it. Backends here skew toward Go and Python, so being able to talk concretely about Go concurrency or async Python helps. Broader system design practice pays off directly.
The security deep dive
This round separates Onyx from a generic backend loop, and it is where the Unit 8200 DNA is most obvious. Expect to threat-model a system out loud. Given an enterprise deploying a customer-support agent with access to a CRM, a payments API, and internal docs, where are the holes? The strongest candidates immediately reach for the agent-specific failure modes: prompt injection smuggled through a retrieved document, a tool call that exfiltrates data, an agent that escalates its own privileges by chaining benign-looking actions, over-broad OAuth scopes, and the confused-deputy problem when the agent acts on a user’s behalf.
You should be solid on the fundamentals underneath all of that: the difference between authentication and authorization, how to scope tokens and rotate secrets, least privilege, and why input validation for an LLM-driven system is genuinely harder than for a form field. You do not need to have shipped agent security before, since the category is new enough that almost nobody has, but you do need to reason about it from first principles and not wave your hands. If security is not your home turf, the adjacent Vanta interview guide is a useful primer on how a security-and-compliance company frames these questions, and the wider shift toward agentic systems is covered in the AI-era interview guide.
Behavioral and the founder conversation
At a company this size you will likely talk to a founder or an early engineer, and the conversation is less scripted than a big-company behavioral loop. They are probing for ownership and judgment: a time you found a security problem nobody asked you to look for, an incident you drove to resolution, a call you made with incomplete information and how it turned out. Vague answers die here. Bring specifics: what broke, what you did, what you would do differently. Structuring your stories with the STAR method keeps them tight without sounding rehearsed.
Is this a security role or an ML role?
It is a security-and-backend role, not an ML role, and being clear on that saves you from prepping the wrong thing. A backend-leaning hire needs working security instincts more than a certification: you should be able to threat-model a service, reason about authz and secrets, and recognize the agent-specific attack surface, but you are not expected to have run a red team. A security-specialist hire is held to a deeper bar on exactly those topics and less on raw systems throughput. As for ML and LLM depth, it is a bonus, not a gate. You should understand how agents work well enough to see where they break (prompt injection, tool-call abuse, what a reasoning trace even is), but nobody is going to ask you to derive attention or train a model. If your instinct on being shown a working system is to ask how it fails, you are calibrated for this loop.
What they actually screen for
Three things, roughly in order. First, can you build reliable backend systems under real load, because the product is infrastructure. Second, do you think like a defender by default, noticing the attack surface without being prompted. Third, do you have the range to operate in a young category where the "right" answer is often unknown and you have to reason toward it. Pure algorithm horsepower is table stakes at most, not the differentiator. A candidate who is a strong coder but cannot spot that a retrieved document is an injection vector will struggle; a solid engineer with real security instincts will do well.
Compensation: ranges, not made-up numbers
Onyx does not publish comp bands, and I am not going to invent them. What I can tell you is how to bracket it. For a well-funded, post–Series B security or infrastructure startup hiring senior engineers in the US, total cash compensation for senior backend and security roles commonly lands in a broad band that overlaps large-cap tech base salaries, with equity making up a meaningful and higher-variance slice on top. Israel-based roles are benchmarked to the local market and run lower in absolute dollars than US Bay Area or New York offers. Level, location, and how much of the package is equity versus cash swing the number more than the company name does.
Because it is a private company at a reported ~$640M valuation, the equity portion is the part to scrutinize. Ask for the number of shares (or units) and the current strike or preferred price, the total shares outstanding or a recent 409A, the vesting schedule and cliff, and what happens to unvested equity in an acquisition. A percentage-of-the-company framing is more honest than a headline dollar figure that assumes a future valuation. To pressure-test any offer against public data, cross-reference roles at comparable Series B startups on levels.fyi and run the scenarios through a total comp calculator. When you get to the offer stage, the mechanics in this salary negotiation guide apply cleanly to early-stage equity, where there is usually more room to move on shares than on base.
Work authorization across three countries
Onyx hires across Israel, the US, and Canada, and which office you target changes what sponsorship looks like. Israeli roles generally expect existing local work authorization; US and Canadian roles may or may not sponsor, and a startup under a hundred people often has limited appetite for the cost and timeline of visa sponsorship even when it is technically possible. I would not assume either way. Ask the recruiter in the first screen whether the specific req sponsors, and confirm it against the careers-page listing before you invest in the loop, rather than trusting any blanket policy.
How to prep this week
Weight your time the way the loop is weighted. Start by getting your coding fluent, not peaked: two or three sessions on the common patterns until off-by-ones and null handling are automatic, no more. Then spend the largest block on system design for data-heavy, low-latency pipelines, practicing out loud on the exact shape of the product: ingest a stream of agent actions, evaluate against policy inline, decide what to buffer and what to drop under load. After that, drill the security deep dive: threat-model two or three real systems on paper until reaching for prompt injection, tool-call abuse, and least-privilege is reflexive, and read enough on how agents get attacked (including the tradeoffs of protocols like MCP) to hold a real opinion. Finally, the night before, write out three incident stories in STAR form so the founder chat finds specifics instead of a blank. If you want to see how Onyx stacks up against peers on difficulty, the AI-startup interview difficulty index tracks where these loops sit. The candidates who do best here are not the ones who grind the hardest LeetCode; they are the engineers who, shown a working system, cannot help but ask how it breaks.
Practice the behavioral round:
