The plan for moving abroad started to take shape during the Erasmus. I tried several internships and full-time positions by companies and universities. I will try to list everything :D, assuming it will be useful for someone. I leave the success story about ETH to the end of the post.

Research facilities

Average decision time for PhD or other position in this section was three to four months.

1. CERN Summer student programme. The application requirements are quite extensive - prepare for a lot of writing (motivations, skills, experience… The full application is here.
   • Interviews: none, just application form
   • Result: passed to the second round, then rejected as Reserve Candidate. Marta got there, and there were only two positions for Czechs.
   • Lesson learned: It is necessary to be honest - they did not need a security researcher, and I would probably hate refactoring ROOT.
2. PhD in WASP at Linköping University by Jeff Yan. As suggested by Vashek Matyas, this professor is a very kind person and a good supervisor.
   • Interviews: 2 Skype calls (screening, introducing myself, no testing), 40 emails (I had many questions, Jeff was so kind to respond to everything)
   • Result: interested in me, yet there was a more fitting candidate. I have got offered another interview. But I just went through a difficult situation, so I canceled the application.
   • Lesson learned: know what to want. Get to know the supervisor well, as you will share a lot of work with him.
3. Joint PhD at University of Stavanger and Oslo in smart grid systems. I was accepted after a single Skype call with quite bad performance on both sides and a long period of a void.
   • Interviews: one Skype (introducing myself, simple programming puzzles) without the supervisor
   • Result: accepted probably due to a decline of another candidate
   • Lessons learned: Buzzwords attracts grants, not me (the project included IoT, blockchain, big-data and machine learning). Find out if the supervisor knows why wants all the buzzword techniques. Talk with the supervisor
4. PhD in Resource-aware IoT with Enhanced Intelligence and Security. I loved NTNU during Erasmus, so it was the only place I considered in a very distant area. Yet i would prefer to apply for NTNU Applied Cryptology Lab, which had no offers during the whole year (I wrote directly to all the professors).
   • Interviews: I did not proceed to any
   • Result: Declined without response
   • Lessons learned: Do not start the application email with typo Dead professor Stefan Werner. Applying so far from my research area has a limited chance. Language requirements at NTNU can be passed by stating I was at NTNU for Erasmus.
5. PhD AI in CyberSec at University of Edinburgh
   • Interviews: I did not proceed to any
   • Result: Declined without response
   • Lessons learned: no communication means rejection
6. PhD Scholarship on data analytics for the security of the Internet-of-Things at TU Delft
   • Interviews: none
   • Result: canceled due to funding issues
   • Lessons learned: Ask for updates after one month
7. GoBoiler at Purdue - summer internship at the first IT faculty on the world.
   • Interviews: Voluntary Skype call at FI MU
   • Result: programme canceled due to unforeseen logistical challenges
   • Lessons learned: the US is far more restrictive and the chance to get there is lowered by at least 1/2 due to logistics
8. Privacy Enhancing Technologies at EPFL - one-year internship or PhD. I canceled the application as I have been accepted to ETH.
   • Lessons learned: apply for other positions even after a good interview - Murphy’s law can help you

Industry

Local companies in the Czech Republic have to attract and get computer scientist whatever it takes. Hence, the application process there takes only about a month. Applying abroad means more detailed inspection, yet the process still can take only two months. But applying to Google/FB/Microsoft… takes longer - up to four months.

1. Google - Software developer in Zurich.
   • Interviews: screening call, interests call, algorithms call, two more update calls, and four one-hour onsite algorithms interviews
   • Result: “I received all feedback and unfortunately they won’t be supportive enough to move forward with your application.” How to say it more politely? :D
   • Lessons learned: Basic Algorithms and data structures course is enough for junior position at Google. Small mistakes make significant importance.
   • Note: I had very high expectations about the tasks I will be asked onsite. But then the tasks were about quite basic programming concepts: XML, statement evaluation, (de)serialization.
2. Deloitte consultant - Security analysts. It was an opportunity to gain quickly experience and travel abroad (Denmark/Germany).
   • Interviews: onsite (did not accept Skype, no reimbursement for travel)
   • Result: they would probably accept me, I canceled it
   • Lessons learned: interesting people and open topics seems like a place where to work, but their employees are workaholics
3. Security architect at e4t (automotive contractor of VW) - starting security in embedded electronics company that newer intended to use it.
   • Interviews: two on-site (test (code puzzles in old C), an introduction of company and me), two screening Skype calls
   • Result: they would probably accept me, I canceled it
   • Lessons learned: I do not know how to create a security team in a corporate conservative automotive company.
4. Security architect/analyst at Signicat in Trondheim. One of the companies that did not require Norwegian for working in Norway.
   • Interviews: none
   • Result: rejected due to not sufficient experience
   • Lessons learned: I would have to take searching in Norway more seriously than 1-2 hours to have a serious chance.
5. Security architect at Microsoft. Or at least that was how I interpreted the advertisement, but then I was tested merely tested on business and soft skill.
   • Interviews: did not pass business/soft skill online test
   • Result: rejected without comments
   • Lessons learned: I can see what I want in the job description, but the author might mean it differently

ETH

ETH was just another attempt, but I felt like I was aiming too high. I was not good enough to apply there.

I responded to permanently opened position by mail on December 7, 2017. The response for a Skype interview in mid-March surprised me a lot. The first interview took 90 minutes of discussion about my research, Master thesis and courses I passed at FI MU. The questions on courses were detailed, and I often did not know. Notably, I performed poorly on questions on formal verifications and theoretical cryptography.

Yes, again the feeling I was not good enough for ETH.

After three weeks and some appealing, I was sent material for project in Computer-Aided Modelling and Reasoning with a task to comprehend it, present 30 minutes talk on it, and finish proofs that were left for the reader. It took it as a challenge, I had never studied something like this, and for two weeks, I did not deeply understand the core idea. Just after two mockups, I understood the topic a day before the final presentation. The interview took another 90 minutes - the talk was 31 minutes, then my questions and notes and then a lot of their questions testing how well did I comprehend the text. And they were satisfied! It encouraged me to continue to pursue the research in a slightly different area on ETH.

I was suggested to continue the application for a new project they were starting at InfSec. I read a paper and project specification, had a few emails and a skype talk, and I did not feel interested enough in it. The project was entirely on formal methods without motivation for computer security. So I wrote feedback on the paper, but declined the project and asked for other topics by InfSec group.

A few days later, I arrived in Zurich for Google interview. After 5 hours of examination at Google, I was suggested to take a rest. However, I did not listen to it and visited ETH instead. I talked to several of current colleagues, including group head David Basin. He tested me a bit (again not very successfully for me) and explained to me the last step of the application process - I will be invited for a whole day to give a guest talk on my research and to meet with several people in the group.

As a practice of the talk, I had three mockup runs, fine-tuning both presented slides and the soft-skills. I studied more formal methods for questions I failed in past calls. And it worked somehow well - it was really difficult for me to evaluate myself that day.

I was accepted on June 24, starting in September.

The guest talks presence is mandatory for group members, so I experienced one application from the other side already. The guy might probably have been smarter than I am, but he did not practice that much for the talk. I do not know the result, but with an inability to answer quite basic questions and complete violation of granted time, it seems probable he failed.

Lessons learned (of all the search)

Expect you will fail, the process of searching PhD/job abroad takes long! The process took me on average around 15 hours per week so that you can work full-time by that. But some weeks it was almost 40 hours (preparation for the interviews at ETH/Google).

The result of an application is given by ~70-90% by your performance. The rest is given by altitude of the interviewee, weather, random number generator, quantum state of the universe. Some failures are just bad luck, increase the number of application to generate advance by the statistics law of big numbers.

I have got this book about failures from sister for birthday - days after I gave the successful talk at ETH, before knowing the result. Our failures might be considered successes for less successful people.