Marshall Wace Cyber Security Analyst Interview Questions

Skip to content Skip to footer

Notifications

Marshall Wace

Interviews

Cyber Security Analyst Interview

Mar 23, 2026

Anonymous Interview Candidate

No offer

Negative experience

Average interview

Application

I applied through a recruiter. I interviewed at Marshall Wace (London, England) in Mar 2026

Interview

4 Stages - COLOSSAL WASTE OF TIME 1st - 1 Hour - General discussion about role, and some general questions about your background. 2nd - 1 Hour - More technical discussion about SOC 3rd - 1 Hour - "Pair" Programming task 4th - 3 Hours - On Site 3 stage interview, 1st with 2 members of Security team, 2nd with CISO, and 3rd exit interview with Hiring/HR. Process took ~1 month. IMPORTANT TO NOTE: I was informed I was the first person to go through the entire interview process and that they were hiring 2 people for this position. Received good feedback from every interview and still rejected, with the following feedback: "Struggled with "Pair programming task" and was underwhelming in CompSci fundamentals." Keep in mind, the 3rd stage was the task I struggled with according to them and they invited me for 4th one. The task they said I struggled with (from 3rd Stage) required you to share you full screen to ensure no cheating, and they ask you to not use LLMs (even though they do it ofter as part of their job, self-admitted), but you are allowed to Google things, and read docs etc. It consisted of connecting to a VMWare session with mismanaged access controls, where I had to wait for them to troubleshoot it for 10 minutes, including not only me being given access to the VM, but also them having to manually tinker around with the File System to place the task in a folder I could actually use. Furthermore, their VM meant that you cannot use shortcuts like "F2" for global renaming for variables or functions, so you have to manually do this. This is a result of the VM being through a browser and the browser window getting focused when you use the F-keys. Another problem was that the cursor was black in the IDE (VSCode) which made it incredibly difficult to see so you either have to waste time changin to Light Mode or waste time navigating environment. The tasks were written badly, included formatting mistakes in the MD file which resulted in me asking questions about the task for clarity. You cannot copy and paste between the VM environment and your own machine, making regex validation slower. Doing this through their VM was incredibly slow as the VM browser took ages to load. As a result, the time allotted was diminished due to these oversights. I was (on the same day) invited for a 4th stage interview in 3 days time, in person, requiring me - on short notice - to travel to London and meet them on site for 3 hours. During the 4th Stage interview, the CISO was giving me incredibly positive feedback such as "You've done brilliantly in the interview process, I am incredibly impressed. The questions you've asked have been amazing. I liked this answer so much because you mentioned..." and so on. After this she explained how she felt really lucky in her career and how I should add her on LinkedIn because she wanted to help out, no matter the result of the interview (red flag). I did add her, only for her to ignore my request. I did my final interview on a Friday and was told to expect a result by the end of the day if lucky, but most likely on the following Monday, and if not then, then definitely by the end of the next week. Monday rolled around and no response. I received the rejection on Tuesday. Not only was this rejection delayed, they didn't even have the courtesy to do it directly and email me, opting to go through my recruiter (which is honestly incredibly unprofessional). Their reasons for rejecting me were primarily around my performance in the 3rd stage interview, which prompted me to question why they didn't reject me after it, and invited me to a 4th stage. Then they took their time "considering" me instead of rejecting me sooner due to the feedback given. Why would they need 3 working days to reject me when they had already made up their mind? I had to explicitly request my feedback in writing from my recruiter, and even then it was vague and not specific. They're either looking for a unicorn, or someone's family/friend has applied for the position. Don't waste your time.

Interview questions [1]

Question 1

2nd Interview: SQL Injection related questions. If there was an alert on a SIEM system, what would you do? If you received a phishing report, how would you investigate it? If a ransomware alert triggered, what would you do? "Can you explain a challenging situation in which you encountered a problem or futher challenges, and how you overcame them. What lessons did you learn from it?" 3rd Interview: Python "Pair" Programming task consisted of them giving you a .json file with logs. Split into 2 programming tasks, and 2 discussion tasks: Task 1 (largest): - Write function to read in .json event and deserialize into dictionary to be returned with given fields. - a singular .json event consisted of a 4 fields, with one of them being "Message". - Some fields you could use to map onto the dictionary key, value pairs they asked you to easily, others you had to use string matching and regex to get from "Message" field. - Some requested dictionary key, value pairs could not be obtained from event, such as "src-ip" when it was a security policy change. They requested you to "normalize" these in the dictionary as "None". Task 2: Write functionality to automate the reading of the entire .json file, not just a singular event. - Basically, just write a for loop to loop over the .json array of events with the function you just wrote and return an array of processed dictionaries. Task 3 and 4: Consisted of some questions and a discussion (paraphrased): Ask you to discuss what additional information would be valuable if this was going to be a real telemetry system eventually. They ask you what potential risks and vulnerabilities you should look out for, some examples include using a rolling window in pandas to check for potential brute force attacks (5 failed attempts in 60 second window), check for credential stuffing (bunch of failed attempts (such as 400 response) into a success (201 response)), differentiate between attempts from public vs private IP Addresses (use ipaddress Python library for example). Some other general questions about the system. 4th Stage - In preson 3 hour with 3 different people (or more) Part 1 - 2 members of security team They ask you about your CV, experience, previous projects/tasks you've done. "What interests you about cybersecurity, why do you want to go into it?" "What is your favourite vulnerability" - One of the interviewers (JM) likes Buffer Overflows, will ask you to explain how buffer overflows work if you answer that. They ask you more technical questions about cybersecurity, including regarding SIEM systems and alerts, and how you would react in specific scenarios like that. They will ask you what tools you would use to find out if binaries are malicious (usually reverse engineering tools such as strings on linux, or Ada and Ghidra, can mention Symbolic Analysis too). They will ask you for ways vulnerabilities can be discovered (mention Static Analysis and Dynamic Analysis tools (SAST/DAST)). They asked me about Docker and vaguely touched upon Kubernetes. They want you to ask questions. Part 2 - Interview with CISO They ask you what is a project you really enjoyed but felt like you learned a lot. They may ask you about a specific project from your CV. They will ask you what you would do in specific scenarios such as a phishing report, ransomware alert, etc. Mention lessons learned meeting afterwards to avoid future situations like this (not to place blame), talk about network segmentation, tools used, OSINT, how you would investigate, determine it isn't a false positive etc. They will ask you questions regarding your interest in Cybersec as well. They will expect questions from you.

Answer question

Marshall Wace interviews Marshall Wace Cyber Security Analyst interviews Marshall Wace interview

Cyber Security Analyst Interview

Mar 23, 2026

Anonymous Interview Candidate

No offer

Negative experience

Average interview

Application

I applied through a recruiter. I interviewed at Marshall Wace (London, England) in Mar 2026

Interview

Interview questions [1]

Question 1

Answer question

Marshall Wace

Cyber Security Analyst Interview

Want the inside scoop on your own company?

Bowls

Followed companies

Job searches

Cyber Security Analyst Interview