Welcome to the developing-candidate edition of Inside the Interview. You will hear a complete Software Engineer conversation, then a practical debrief.

The candidate is capable and employable. The gaps are about evidence, clarification, and ownership—not intelligence or personality. Every person, employer, incident, and number is fictional.

Hi, Elena. Thanks for joining. How are you?

I am good, thanks. A little nervous, but glad to be here.

No problem. We will start with your background, work through a design scenario, and then talk about production, quality, security, and teamwork.

Great, thanks.

Walk me through your background and the ownership you have taken on as a software engineer.

I have been a software engineer for about six years. I started in e-commerce, worked on several APIs, and then moved into backend services. I use TypeScript, Node, Postgres, and AWS, and I have also helped newer developers.

Which example best shows the level you are ready for now?

Probably our returns work. We rebuilt part of the refund process and support had fewer complaints afterward. I did the API changes and helped coordinate testing with finance.

Do you remember the scale or what decision you personally owned?

It was thousands of returns a month. I owned most of the service changes, but the architecture was a team decision. I should have brought the before-and-after numbers because that would make the impact clearer.

Why Harborline?

I like the mission, and healthcare seems like a place where reliable software matters. I also want more design responsibility than I have today.

How would you design reliable processing for partner appointment events?

I would receive the webhooks through an API, put them on S Q S, and process them with Lambda. I would use Postgres for appointments and Datadog for monitoring.

Before we settle on components, what would you want to know?

Right. I would ask about traffic and the latency requirement, and whether partners retry. I would also ask what happens when events arrive in the wrong order.

Assume two point four million events a month, bursts after partner outages, retries for twenty-four hours, out-of-order delivery, and a five-second target.

Then I would keep the queue and add an idempotency table. The consumer can check the event I D before updating the appointment. We can use timestamps to ignore older changes.

What if the event identifier or timestamp is unreliable?

I would probably hash the payload. Although, if the payload contains sensitive data, we should be careful about where that hash is stored and whether two legitimate events could look the same. I would need the partner contract and a privacy review before I chose that.

How would you measure success?

Error rate, queue depth, and latency. Also duplicates. I would need to define whether the duplicate rate is per raw delivery or per unique partner event, because those give different numbers.

Tell me about a production incident you helped resolve.

We had duplicate customer notifications after a retry change. The team paused the worker, checked logs, and rolled back. I helped compare the old and new code and added tests afterward.

What did you personally diagnose?

I traced one message through the retry path and found that acknowledgement happened before the database commit. That meant the queue could retry before our deduplication record existed. I suggested the failure-path test, but another engineer wrote the atomic transaction fix.

How did you know recovery was complete?

We watched the dashboard for about an hour and did not see more duplicates. I do not remember the attempt count, so saying zero by itself is weak evidence. In a real interview I would bring the window and denominator, plus the follow-up trend.

Tell me about a deadline where quality and speed were in tension.

For a tax export, we had a hard deadline, so we reduced scope and released behind a flag. We tested the important calculations with finance and handled a few issues during the pilot.

What did you defer, and what would have caused a rollback?

We deferred scheduling and custom mapping. We did not write a numeric rollback rule before launch; we mostly watched for finance concerns. I would improve that by setting a mismatch threshold and an export error-rate threshold in the decision record.

Who owned the deferred work?

It went into the backlog. That is another weak point: it did not have one owner or a review date, so some of it stayed longer than planned.

How do you approach security and privacy when the system handles sensitive health data?

I would make sure the service is H I P A A compliant, encrypt the data, restrict access, and avoid logging patient information.

Who decides what compliant means for this change?

Not me alone. I should start from Harborline’s data classification and control requirements, then review the flow with privacy and security. My job is to show where the data moves, implement the approved access and audit controls, and escalate uncertainty.

What would you check in the pull request?

Authorization tests, redaction, dependency scanning, and secret scanning. I would also check that traces and dead-letter records do not capture raw payloads. I have done pieces of that, though I have not led a full threat model yet.

Tell me about a code review or technical disagreement that changed your approach.

A senior engineer and I disagreed about a generic adapter. I thought it was too abstract, and we had a long pull-request discussion. Eventually we kept a common envelope but separate validation logic.

What moved the decision forward?

We built two examples and compared the tests. I should be more specific: the generic version made partner-specific retry rules hard to see, while the shared envelope still reduced repeated authentication code. The evidence mattered more than who was senior.

Do you use coding assistants?

Sometimes for tests or unfamiliar library syntax. I review the output and run the tests. I have not always noted it in the pull request, and I should be clearer about disclosure and about not sending confidential code or data to an unapproved tool.

What would you like to ask me?

How does the team decide which technical debt is important enough to schedule?

We tie it to incidents, delivery friction, or product risk and review the highest-cost items each quarter.

What does a healthy on-call rotation look like here?

Six engineers, one-week rotations, protected recovery time after significant incidents, and no expectation that one person knows every service.

Thanks, Elena. Recruiting will be in touch next week.

Thank you. I appreciate the conversation.

Elena demonstrated real experience. The developing signal came from answers that started one layer too shallow, not from a lack of ability.

In the design question, she named components before clarifying semantics, ordering, latency, and data sensitivity. After prompting, her reasoning improved. A stronger interview answer brings those questions forward.

In the incident answer, she eventually isolated her contribution, but the recovery claim lacked an attempt count and comparison window. Replace zero issues with a bounded observation: what was watched, for how long, and across how many attempts.

Her security repair was important. Engineers implement controls, but privacy and security partners own the organization’s legal and compliance determinations. Name the partnership and show how it changes the design.

For your practice, use five lines: requirement, decision, personal contribution, trade-off, and verified result.

Then say it naturally rather than memorizing a paragraph.

Prepare with evidence. Interview with confidence.

Continue your preparation at Rock Star C V dot com.