As a Software Engineer at Guardsquare, you are at the forefront of mobile application security. You will be tasked with developing sophisticated solutions that protect millions of devices worldwide from reverse engineering, tampering, and malicious attacks. This role is critical because the work you produce directly safeguards the intellectual property and user privacy of some of the world’s most prominent mobile applications. You will operate in an environment where precision and deep technical understanding are paramount. Whether you are working on obfuscation techniques, hardening SDKs, or building security tooling, your contributions will have a global impact. Expect to engage with complex, low-level challenges that require a mastery of programming languages and a mindset geared toward defensive engineering. ##### Tip The work at Guardsquare is highly specialized. Demonstrating a genuine interest in mobile security and a deep understanding of the underlying architecture of your preferred language—particularly C++ or Java—will set you apart from other applicants.
Recruiter Screen
reportedInitial screening to establish baseline fit and expectations.
What to demonstrate
- Initial screening to establish baseline fit and expectations
- Depth in C++
How to prepare
- Be able to walk your CV end to end in two minutes, and say why this company specifically.
- Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.
Technical Evaluations
reportedSeries of technical evaluations including theoretical questions and hands-on coding exercises.
What to demonstrate
- Series of technical evaluations including theoretical questions and hands-on coding exercises
- Depth in C++
How to prepare
- Answer aloud and timed: What are the common security pitfalls associated with this language?
- Answer aloud and timed: Discuss the differences between specific paradigms or language versions.
Team Lead Interview
reportedDeep dive into your technical background with a team lead.
What to demonstrate
- Deep dive into your technical background with a team lead
- Depth in C++
How to prepare
- Answer aloud and timed: Explain how you would approach parsing a complex string or data structure.
- Answer aloud and timed: Walk me through how you would architect a solution for a given security constraint.
Leadership Interaction
reportedFinal interaction with leadership to ensure long-term alignment.
What to demonstrate
- Final interaction with leadership to ensure long-term alignment
- Depth in C++
How to prepare
- Answer aloud and timed: How do you handle ambiguity when a requirement is not fully defined?
- Answer aloud and timed: Describe a time you had to debug a difficult issue in a large codebase.
PracHub editorial advice for the preparation topics above.
Be transparent
If you don't know an answer, communicate your thought process rather than guessing. We value intellectual honesty.
Ask questions
We appreciate candidates who are curious about our technology, our market, and our team structure.
Focus on the fundamentals
You don't need to be a security expert, but you should demonstrate a strong interest in understanding how software is secured.
Prepare your stories
Use the STAR method (Situation, Task, Action, Result) to structure your answers for behavioral questions.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Can you explain the memory management model in your primary language?
Can you explain the memory management model in your primary language?
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
How would you optimize this specific code snippet for performance?
How would you optimize this specific code snippet for performance?
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
What are the common security pitfalls associated with this language?
What are the common security pitfalls associated with this language?
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
Discuss the differences between specific paradigms or language versions.
Discuss the differences between specific paradigms or language versions.
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
Explain how you would approach parsing a complex string or data structure.
Explain how you would approach parsing a complex string or data structure.
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
Replace offset paging on the resource feed with keyset
resource holds resource_id, tenant_id, owner_user_id, title, body_ref, version, status ('draft','active','archived','deleted'), created_at, updated_at, deleted_at, with an index on (tenant_id, status, updated_at DESC, resource_id DESC). The listing endpoint returns active resources for one tenant, newest update first, 50 per page, today with LIMIT 50 OFFSET n. Tenants reach page 400 and rows are created while they read. Write the keyset query, define what the cursor carries and how it is encoded, and say which part of the index each predicate uses. Assume PostgreSQL 16.
Approach
- Name the two failures separately. OFFSET 20000 makes the server produce and discard 20,000 rows, so page cost grows with depth rather than with page size. Independently, any write that changes how many rows sort above the offset moves the window between two fetches, and the direction decides which anomaly you get: an insert lands at the head of updated_at DESC and pushes already-returned rows down past the boundary, so they are returned a second time; a delete above the offset, or a row whose updated_at is bumped above the cursor, pulls rows up and one is never returned at all. Nothing in the response reveals either.
- Write the seek: WHERE tenant_id = $1 AND status = 'active' AND (updated_at, resource_id) < ($2, $3) ORDER BY updated_at DESC, resource_id DESC LIMIT 50. The row-value comparison is one index range rather than a disjunction, and both columns are NOT NULL, which is what makes that comparison well defined.
- Map each predicate onto the index: tenant_id and status are equality on the leading columns, (updated_at, resource_id) is the range, and the ORDER BY matches the index order so no Sort node appears and the scan stops after 50 rows. The DESC in the definition only matters for mixed directions — a plain ascending btree on the same columns is read backwards for this query.
- Put both sort columns in the cursor and nothing the client can tamper with into another tenant: base64 of (updated_at, resource_id), validated server-side, with tenant_id taken from the principal.
Follow-up
- The client asks for 'jump to page 400'. What do you offer instead, and what does the honest version cost?
- Sort order becomes user-selectable across four columns. How many indexes is that, and which would you refuse to add?
Keep soft-deleted accounts from blocking re-registration
app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.
Approach
- Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
- Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
- For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
- State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.
Follow-up
- A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
- How do you honour an erasure request while resource_revision.actor_user_id still references this table?
Walk me through how you would architect a solution for a given security constraint.
Walk me through how you would architect a solution for a given security constraint.
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
If you were tasked with securing this specific feature, where would you start?
If you were tasked with securing this specific feature, where would you start?
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
How do you balance code readability with performance requirements?
How do you balance code readability with performance requirements?
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
Every query on one table stalls for forty seconds mid-deploy
During a release on PostgreSQL, every query touching resource times out for about 40 seconds and then recovers with no intervention. The release ran one migration, ALTER TABLE resource ADD COLUMN archived_reason TEXT, and the migration log shows it completing in 6 ms. Unrelated tables showed no change in error rate. Explain how a 6 ms statement caused a 40-second stall, give the ordered checks you would run on a live system to confirm it, and give the migration procedure that prevents a repeat.
Approach
- Separate the statement's duration from the lock's duration. ADD COLUMN with no default is a catalogue-only change and genuinely runs in milliseconds, but it requires ACCESS EXCLUSIVE, and it cannot acquire that until every transaction already touching the table has finished.
- Account for the queueing, which is the part that surprises people. A lock request that is waiting blocks later requests for conflicting modes behind it rather than letting them overtake, so one long-open transaction holds the DDL and the DDL holds all the traffic. The stall length is set by the longest open transaction, not by the size of the change.
- Confirm on a live system in this order: pg_stat_activity for that table ordered by xact_start, looking for the oldest transaction and specifically for state = idle in transaction; then pg_locks where granted = false to find the waiter; then join them on pid to name blocker and blocked. pg_blocking_pids() does that join for you and is the fastest single call.
- Prevent rather than merely time it better. Set lock_timeout to a second or two on the migration session so the DDL abandons the queue after a bounded wait and is retried, instead of holding it for as long as the oldest transaction lives. Be exact about what that buys: queries arriving during the wait still queue behind the pending ACCESS EXCLUSIVE request, so each attempt costs them up to one lock_timeout of added latency. The outage goes from 40 seconds to about one second per attempt, not to zero. Also run migrations away from deploy-time peaks, and put a statement timeout and an idle-in-transaction timeout on the analytics role that opens the long transactions.
Follow-up
- The same release also wants NOT NULL on that column. What is the sequence that gets there without a long lock?
- Your lock_timeout retry fails ten times in a row because the analytics transaction is always open. What do you change?
Built from the rounds and topics Guardsquare candidates report.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Map the Guardsquare loop
- Write out the reported sequence: Recruiter Screen, Technical Evaluations, Team Lead Interview, Leadership Interaction.
- For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.
Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.
02Work C++
- Spend the session on C++, which Guardsquare candidates report being tested on.
- Write one worked example in C++ and time yourself on it.
Deliverable: One timed worked example in C++.
03Work String parsing
- Spend the session on String parsing, which Guardsquare candidates report being tested on.
- Write one worked example in String parsing and time yourself on it.
Deliverable: One timed worked example in String parsing.
04Work Java
- Spend the session on Java, which Guardsquare candidates report being tested on.
- Write one worked example in Java and time yourself on it.
Deliverable: One timed worked example in Java.
05Answer out loud: Technical Proficiency and Language Mastery
- Answer aloud, timed: Can you explain the memory management model in your primary language?
- Answer aloud, timed: How would you optimize this specific code snippet for performance?
Deliverable: Spoken answers to 2 reported Technical Proficiency and Language Mastery question(s), under time.
06Answer out loud: Problem-Solving and Case Studies
- Answer aloud, timed: Walk me through how you would architect a solution for a given security constraint.
- Answer aloud, timed: How do you handle ambiguity when a requirement is not fully defined?
Deliverable: Spoken answers to 2 reported Problem-Solving and Case Studies question(s), under time.
07Answer out loud: Behavioral and Culture Fit
- Answer aloud, timed: Why do you want to work for Guardsquare specifically?
- Answer aloud, timed: Describe a time you had a disagreement with a team member; how did you resolve it?
Deliverable: Spoken answers to 2 reported Behavioral and Culture Fit question(s), under time.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
How do you handle ambiguity when a requirement is not fully defined?
How do you handle ambiguity when a requirement is not fully defined?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a time you had to debug a difficult issue in a large codebase.
Describe a time you had to debug a difficult issue in a large codebase.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Why do you want to work for Guardsquare specifically?
Why do you want to work for Guardsquare specifically?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a time you had a disagreement with a team member; how did you resolve it?
Describe a time you had a disagreement with a team member; how did you resolve it?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
What is your preferred working environment, and how do you stay productive?
What is your preferred working environment, and how do you stay productive?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Tell us about a technical project you are particularly proud of.
Tell us about a technical project you are particularly proud of.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
How do you handle feedback on your code or design decisions?
How do you handle feedback on your code or design decisions?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
- 01
How do you handle ambiguity when a requirement is not fully defined?
- 02
Describe a time you had to debug a difficult issue in a large codebase.
- 03
Why do you want to work for Guardsquare specifically?
- 04
Describe a time you had a disagreement with a team member; how did you resolve it?
How difficult are the technical interviews?
The difficulty is moderate, focusing on core concepts rather than trick questions. We prioritize your ability to explain your reasoning clearly and write clean code.
Guardsquare Software Engineer candidate reports ↗How much time should I spend preparing?
Focus on refreshing your core language knowledge (especially memory management) and practicing standard coding problems. A few weeks of consistent, focused practice is typically sufficient.
Guardsquare Software Engineer candidate reports ↗What is the company culture like?
Guardsquare is a collaborative and transparent environment. We value direct communication and engineers who take pride in the quality and security of their work.
Guardsquare Software Engineer candidate reports ↗How long does the hiring process take?
While it can vary, we strive to keep the process efficient. You can expect a professional and transparent timeline from initial contact to final decision.
Guardsquare Software Engineer candidate reports ↗What topics does Guardsquare test in interviews?
Guardsquare interviews most often cover B2B Sales (Account Executive), C++, Sales Process & Deal Lifecycle Management, String parsing, and Pipeline Timing & Sales Cycle Metrics. The exact emphasis depends on the specific role you apply for.
Guardsquare Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Guardsquare Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
Symantec Software Engineer Interview Guide
What Symantec asks Software Engineer candidates, from reported rounds and questions.
Raytheon Technologies Corporate Headquarters Software Engineer Interview Guide
What Raytheon Technologies Corporate Headquarters asks Software Engineer candidates, from reported rounds and questions.
Not Sure Software Engineer Interview Guide
What Not Sure asks Software Engineer candidates, from reported rounds and questions.
NCR Software Engineer Interview Guide
What NCR asks Software Engineer candidates, from reported rounds and questions.