With this essay, I hope to share my experience applying for PhD programs. If you are reading this, you are probably an undergraduate student trying to navigate the rather confusing world of PhD applications. I will outline what I learned after applying in two PhD cycles, how I approached them each time, what was the outcome each cycle, and my decision.

With regards to the application process, I will mostly be writing about things that are not obvious, or things that I wished I had known. Namely, that an application has to be pointed at a specific direction, and that you’d need to spend time on the statement of purpose.

Note that each and every individual’s path is unique, and what worked for me will probably not work for others.

Background

In order for you to understand my experiences through PhD applications, it will help if you knew a bit more about my background. I recognize that I come from great privilege of being able to pursue an undergraduate degree outside of my country of nationality, but I made sure that I made the most of it and worked as hard as I could.

I graduated with Highest Distinction from Purdue University majoring in Computer Engineering, so I did pretty well in my classes. However, I definitely spent more time doing other things. I was very involved with a club building an autonomous go-kart (Autonomous Motorsports Purdue), contributed to software supply-chain projects under the guidance of Santiago Torres-Arias (I guess my only research-y experience really), and also worked as an undergraduate teaching assistant and tutor for the School of Engineering. I also spent a lot of time going to Purdue football games and Purdue basketball games, as well as going out with my friends. In my opinion, it’s important to have fun in your studies, it keeps you sane. I would not have been able to work as hard as I did if I did not find the things I did as fun.

Since my first encounter working with Santiago, I have always been interested in doing research as a career. However, I had a few things that kept me from fully considering it. Therefore, I was mostly optimizing to land a job in industry, tailored my experiences and networking for that. I landed two internships with Google and received a full-time offer from them, but decided to give the startup experience a go and joined Keytos. In my last semester at Purdue (Fall 2023) I hastily sent out applications in case I did not like industry, this ended with a dud. In the following year, I was very happy with my situation then, but had itchings to do research and gave it a second go in case I wanted to go back to academia.

The First Approach

Honestly, my first approach was never going to net a positive result. I came in with very limited direction on what I wanted to do, and with whom I wanted to work with. Therefore, my applications were boiler-plate and revisiting the material I submitted then makes me cringe. The biggest red flag I had was definitely my personal statement, it was very generic and did not talk about what I was passionate about, nor did it really convey what I wanted to do with a PhD. I genuinely just wrote one whole statement and swapped out one paragraph without making significant modifications for each school. I would say that my body of work wasn’t what held me back, and instead, it was my lack of passion for research in my personal statement.

Due to my lack of direction, I decided to apply to many schools with little knowledge nor understanding of who I wanted to work with. This also contributed to my decision to do a very boiler-plate-y personal statement for all my applications.

The above was a small exerp on what NOT to do when you apply for PhD programs.

Failure

Back then, I was surprised when I heard back from nobody. Even though I knew I did not put much effort into the application packages, it was dissapointing to not have that second option if I wanted to pursue research. In hindsight, it should not have surprised me, but oh well, that’s how it goes sometimes.

The Second Approach

Earlier in the year, after not hearing back from other schools, I had commited to giving myself one more attempt at applying to PhD programs. The second time around, I had one more year of experience of life under my belt. My time at Keytos, where I was building PKI-as-a-Service products, was very constructive. I learned a lot about how computer security was seen in the real world. I was also very content with the trajectory of Keytos and saw myself staying there long term.

Therefore, I narrowed down my vision for a PhD to something I knew I could only do in academia. I looked for professors and researchers that were doing the type of work that could compell me to leave Keytos, and this got me to look for groups doing working on practical privacy. I ended up with a significantlys maller list of schools and research centers I’d apply to, a fraction of the first time, and also spent significantly more time in my application packages, namely the statements of purpose. Most of my background and recommendation letter-writers stayed the same.

Results

This time, I applied to a total of eight programs, four in the US, and four in Europe. I was invited to interview with four programs and was admitted to all four of them. In all applications, I highlighted my interest in working on privacy, but since most of my background was in software supply-chain security, a lot of the people I talked to or interviewed with, did more work in secure systems. I would also add that all of my interactions with the professors I’ve met throughout my application process were very positive and constructive. I’d go out on a limb and say that mostf aculty are sympathetic to PhD applicants and would like to see everyone succeed.

Here is a list of the eight places I applied to and the response I got from them:

• Berkeley, US - Admitted
• CISPA, DE - Admitted
• EPFL, CH - Rejected
• IMDEA, ES - Never heard back
• Maryland, US - Rejected
• Max-Planck-Institut (MPI), DE - Admitted
• Purdue, US - Admitted
• Stanford, US - Rejected

Decisions

To be frank, this was one of the hardest decisions in my life. I was very happy in my situation at Keytos and did not want to leave. However, the political situation in the US was very worrying, especially as a Mexican. It got to the point where my main desire was to leave the country and I made the decison to do so. This made me rule out all of the schools in the States as I could not see myself pursuing a PhD in a country where the government is so adamant on persecuting latinos and non-citizens. I may write more on this at a later time.

Therefore, the remaining options are the institutes in Germany and working remotely for Keytos. My rationale then was that if I wanted to leave the country, I might as well take a leap of faith and give doing research full-time a solid chance. I told my boss, Igal, about my move and he was very understanding.

The decision between MPI-SP and CISPA was also rather hard. MPI seems from the outside to have more resources for students despite being a smaller institute, while CISPA had more faculty in a wider range of areas. I ended up going with CISPA, mostly because it was my top choice from the beginning and because the institute itself had so many people I’d be happy to work with. Another factor was that I’d have the mentorship of two researchers whose work I really admire, Sajin Sasy and Wouter Lueks.

Half-a-Year into my Decision

So far, I am very happy with my decision. The moment I left the US, a big worry and stressor has left my chest. There have been a few things I have had to learn on the fly, namely, German bureaucracy, but I feel very well supported by CISPA and the people around me.

I have had to bring myself up to speed on privacy enhancing technologies, which has been fun and frustrating at the same time. I have been covering a lot of literature that I would have known had I began working in this area in my undergrad. Moreover, I have also been adjusting to going back to school to take classes and adjusting to a totally new country and continent. I also like everyone I’ve met at CISPA, one of the pros of being such a large center is that there are so many people to meet!

Conclusion

PhD applications can feel like a shot in the dark, but talk to your mentors and other people for advice. The main thing that changed between both cycles was my personal statement, and the outcome was very different, so don’t underestimate how important each part of the application packet is.

If you’d like to see my application material, feel free to reach out to me! My contact info is in the home page.

Postscript

I just recalled while writing this that one of the first things I wanted to work on with Santiago that was not in software supply-chain security was on private communication systems. He knew a few people working on an open-source project on it but nothing really came from it. It’s fun recalling this as one of my advisors at CISPA, Sajin Sasy, works on private communication systems. It’s crazy how the world works sometimes.