If you want to know what Armadin tests for, start with who is doing the testing. CEO Kevin Mandia founded Mandiant, the incident-response firm whose breach reports set the industry standard for “show the evidence, then make the claim.” The co-founders carry the same DNA: chief offensive security officer Evan Peña ran red-team engagements for years, CTO Travis Lanham comes from the platform side, and chief architect David Slater owns how the system is put together. Those three roughly map to the three interviewer pools you will meet: offensive-security depth, backend platform, and ML that makes autonomous agents behave.
The product shapes the bar. Armadin deploys agents that act like attackers against a live environment, finding an exposed credential, pivoting through a misconfigured IAM role, and stitching a chain from the perimeter to the cloud control plane. In one reported exercise its agents ran on the order of a thousand attacks and chained 38 validated attack paths into 238 findings. And every agent action passes through a control layer governed by a safety model trained on feedback from human security experts. That one sentence tells you more about the interview than any job post: they need people who can reason about exploitation, about the ML that approves or blocks an agent’s next move, and about the backend that runs thousands of long-lived agent sessions without losing an audit trail.
The round structure you should expect
No public Glassdoor record exists yet, which is normal for a company this young. What follows is inferred from comparable security-AI startups at the Series B stage and from the founders’ track record. Use it to plan, and confirm specifics with your recruiter.
| Round (inferred, not a confirmed Armadin loop) | Who runs it | What it screens for |
|---|---|---|
| Recruiter screen (30 min) | Recruiter | Motivation, security vs. ML vs. backend track fit, comp expectations, work authorization for government-adjacent work |
| Technical / coding (60 min) | Engineer | Practical coding: parsing, graph traversal over attack paths, API and data-structure work. Less LeetCode-puzzle, more “build the thing” |
| Domain depth (60 min) | Security or ML lead | Offensive security reasoning for security roles; agent evaluation and the safety/reward model for ML roles |
| System design (60 min) | Senior engineer | Designing an agentic attack platform: orchestration, sandboxing, idempotency, audit and replay |
| Founder / values (45 min) | Founder or exec | Judgment under ambiguity, evidence-based communication, how you handle a dangerous capability responsibly |
Five rounds is the typical shape for a funded security startup that is hiring fast but still protective of culture. Expect the loop to compress if you are senior and referred, and to add a take-home or pairing session if the coding screen is borderline. Our AI-native startup interview guides show the same five-beat pattern across plenty of similarly staged teams.
The security domain round
For an offensive-security or security-research role, the domain round is where Peña’s world shows up. These are not trivia questions about CVE numbers. They want to hear you think like an attacker who has to prove exploitability, not just flag a theoretical risk, because the product’s whole value is validated kill chains rather than a scanner’s wall of maybes.
Based on how comparable teams interview, expect scenarios like these:
- “You’ve got a low-severity SSRF on an internal service and a slightly over-permissioned IAM role. Walk me from there to the cloud control plane.”
- “How would you validate that an attack path is actually exploitable without disrupting a customer’s production workload?”
- “An agent reports a finding. What makes you trust it, and what would make you throw it out?”
- “Chain three findings that are individually ‘low’ into something a CISO loses sleep over.”
Have one chain ready to narrate end to end. Say the SSRF lets you hit the cloud metadata endpoint and pull the temporary credentials for the IAM role on that host. The role is over-permissioned, so it can read a storage bucket holding Terraform state, and that state file stores secrets in plaintext, so it hands you a long-lived access key for a second role that CI uses to create IAM policies. You authenticate as that CI role and grant yourself control-plane admin. No single step is alarming; the chain is a full compromise. The evidence you’d attach: the exact SSRF request and the credential response, the IAM policy JSON showing the excess permission, and a read-only call proving control-plane reach, all without mutating the customer’s environment.
The strong answer treats severity as emergent: individual findings are boring, the chain is the product. Talk about blast radius, about proving impact with the least intrusive step, and about false-positive cost. Someone from Mandiant’s lineage will respect an answer that ends with “and here’s the evidence I’d attach.”
The ML round: evaluating agents and the safety model
If you are interviewing for an ML or research role, the center of gravity is the agent itself and the safety model that governs it. The company describes that model as trained on feedback from human security experts, which is a reward-model setup in all but name. Expect to be asked how you would build and evaluate it.
Realistic prompts:
- “How do you measure whether an autonomous agent is getting better at tool use, not just more verbose?”
- “You have human experts rating agent actions as safe or unsafe. How do you turn that into a model that gates the next action in real time?”
- “Your agent found a real path but took a risky step to get there. How should the reward signal handle that?”
- “How do you stop an agent from reward-hacking its way to a ‘finding’ that isn’t real?”
Good answers keep capability eval and safety eval separate. You want the agent more effective and the safety model more conservative, and those objectives pull against each other. If you have worked on RLHF, preference data, or eval harnesses for tool-using agents, this is where it pays off. The durable, replayable execution that workflow systems like Temporal are built around is the same vocabulary the agent-orchestration side rewards, so reach for it if it fits.
System design: run thousands of attackers without losing the receipts
The system design round asks you to design a slice of the platform itself. A likely framing: design the orchestration layer that runs many concurrent agent engagements against customer environments, where each engagement is a long-running tree of actions that can take hours and must be fully auditable afterward.
What an interviewer in this space is typically listening for: how you make agent actions idempotent and resumable after a crash, how you sandbox execution so one engagement can’t touch another customer, how you record every action for replay and compliance, and how the safety control layer sits in the request path without becoming the bottleneck. Expect follow-ups on rate limiting against customer infrastructure, on secrets handling, and on what happens when an agent needs human approval mid-run. This is closer to building a distributed workflow engine than a typical CRUD service, and saying so out loud is a point in your favor. For security-tooling companies that sell to regulated buyers, the compliance and audit angle matters as much as the raw throughput, the same tension you see at a company like Vanta.
Founder and values round
Mandia-run companies care about judgment and clear writing. Mandiant built its reputation on reports that laid out evidence before conclusions, and that temperament runs through the hiring bar. Expect a conversation, not a quiz: why offensive security, how you’d handle building a genuinely dangerous capability, a time you were wrong and how you figured it out. Bring real stories with specifics. The STAR method keeps these answers tight. One wrinkle worth preparing: a measured take on the dual-use nature of autonomous attack tooling signals maturity, and hand-waving it signals the opposite.
A practical note on authorization. Armadin counts government and Fortune 500 customers, and In-Q-Tel participated in its funding. Some roles may favor candidates eligible for US-person-only work or future clearance. This isn’t universal, so ask the recruiter directly rather than assuming you’re ruled in or out. And because Armadin is brand new, it has no visa-sponsorship track record yet and no DOL or PERM filings to check, so whether it sponsors is a question to raise on the first call, not something you can infer.
Compensation: what’s realistic, and how to verify
Armadin doesn’t publish salary bands, and anyone quoting you an exact Armadin number is guessing. What’s grounded is the market. A Series B security or AI startup in the Bay Area at a $2.5B-plus valuation competes with big tech for the same senior engineers, so cash tends to sit in the upper half of the startup range with equity as the real lever.
As a rough calibration from that market, not leaked Armadin bands: a mid-level engineer (L4 equivalent) tends to land around $170K to $210K base with a meaningful early-stage grant on a four-year vest; a senior engineer (L5 equivalent) around $210K to $270K with a larger grant and refresh conversations after year one; and a staff or specialist hire in offensive security or ML research from roughly $270K to $340K and up, where the rare-skill premium pushes the top end higher.
Verify three ways: check total comp against levels.fyi for comparable-stage companies, watch for Armadin’s H-1B and PERM filings once they appear in Department of Labor disclosure data (those list real base-salary figures by title), and ask the recruiter for the band on the first call. At a $2.5B valuation the gap between your 409A strike price and the preferred-share price matters, so ask about the latest 409A and the preferred price per share before you value the equity. When the offer lands, our notes on salary negotiation cover how to move cash and equity together instead of fixating on base.
How to prep in the two weeks before
Pick your track and go deep rather than wide. Security candidates should be able to narrate a full perimeter-to-cloud chain from memory and argue about proving impact safely. ML candidates should be fluent in agent evaluation and reward modeling, with a clear story about keeping a safety model conservative. Backend candidates should treat the system design round as a durable-workflow problem and rehearse the audit, sandboxing, and idempotency angles.
One cross-cutting thing: ask early whether you can use AI coding tools in the technical round. A company building autonomous agents is unlikely to ban them, and knowing the rules changes how you prepare. Our guide to interviewing in the AI era covers using assistants without looking like you’re leaning on them. For a sense of how Armadin’s bar compares to peers, the autonomous-pentesting space has one obvious rival in Horizon3.ai, a more mature company in the same category whose interview process is better documented. If you’re weighing several offers, browse our other company interview guides to see where this one sits.
Practice the behavioral round:
