Ing Deutschland · Software Engineer
Updated · 2026-10-02

Ing Deutschland Software Engineer
Interview Guide

THE 60-SECOND BRIEF

A Software Engineer at Ing Deutschland plays a critical role in shaping the digital banking experience for millions of customers. As one of the leading digital-focused banks in Germany, Ing Deutschland relies heavily on robust, secure, and highly scalable software solutions to power its financial products. Engineers here do not just write code; they build and maintain the core infrastructure that handles high-volume transactions, complex loan calculations, and sensitive customer data daily. The impact of this role is substantial. Your work directly influences the reliability, speed, and security of services like retail banking apps, automated lending platforms, and backend financial calculators. Because Ing Deutschland operates in a highly regulated financial environment, engineers must balance rapid feature delivery with strict security compliance and high architectural standards.

This guide is scoped to a Software Engineer candidate at Ing Deutschland.

Ing Deutschland candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Coding ChallengesREST APIsBackend Development

24 min read

Browse Software Engineer questions

See the practice prompts

18Practice promptsAcross five skill areas

A Software Engineer at Ing Deutschland plays a critical role in shaping the digital banking experience for millions of customers. As one of the leading digital-focused banks in Germany, Ing Deutschland relies heavily on robust, secure, and highly scalable software solutions to power its financial products. Engineers here do not just write code; they build and maintain the core infrastructure that handles high-volume transactions, complex loan calculations, and sensitive customer data daily. The impact of this role is substantial. Your work directly influences the reliability, speed, and security of services like retail banking apps, automated lending platforms, and backend financial calculators. Because Ing Deutschland operates in a highly regulated financial environment, engineers must balance rapid feature delivery with strict security compliance and high architectural standards. You will work on modernizing legacy systems, migrating services to cloud environments, and developing clean, microservices-based APIs. To succeed as a here, you must possess strong technical craftsmanship, a deep understanding of modern backend frameworks (particularly within the Java ecosystem), and an unwavering commitment to security. The teams operate with a high degree of autonomy, meaning you will have the opportunity to influence design decisions, collaborate closely with product owners, and drive technical excellence across the organization. Software Engineer

01

Recruiter Screening

reported

Initial screening to assess mutual fit between the candidate and the company.

What to demonstrate

  • Initial screening to assess mutual fit between the candidate and the company
  • Depth in Coding Challenges

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.
Ing Deutschland Software Engineer candidate reports ↗
02

Technical Assignment

reported

Candidates complete an offline technical assignment, typically involving building a functional microservice or set of APIs.

What to demonstrate

  • Candidates complete an offline technical assignment, typically involving building a functional microservice or set of APIs
  • Depth in Coding Challenges

How to prepare

  • Answer aloud and timed: What strategies do you use to ensure your backend services are highly testable, and how do you structure your unit and integration tests?
  • Answer aloud and timed: Explain the difference between optimistic and pessimistic locking, and when you would use each in a transaction-heavy financial system.
Ing Deutschland Software Engineer candidate reports ↗
03

Code Review

reported

Submitted code undergoes a rigorous review by company engineers to evaluate its quality.

What to demonstrate

  • Submitted code undergoes a rigorous review by company engineers to evaluate its quality
  • Depth in Coding Challenges

How to prepare

  • Answer aloud and timed: How do you secure a REST API against common vulnerabilities such as those listed in the OWASP Top 10?
  • Answer aloud and timed: Explain how you would implement secure authentication and authorization (e.g., OAuth2, JWT) for a microservices architecture.
Ing Deutschland Software Engineer candidate reports ↗
04

Technical Interviews

reported

Candidates present their solution and discuss architectural choices, followed by deep-dive questions on security and system design.

What to demonstrate

  • Candidates present their solution and discuss architectural choices, followed by deep-dive questions on security and system design
  • Depth in Coding Challenges

How to prepare

  • Answer aloud and timed: How do you handle sensitive data, such as personally identifiable information (PII) or financial records, both in transit and at rest?
  • Answer aloud and timed: Describe a scenario where you had to refactor a monolithic application into microservices. What challenges did you face, and how did you address them?
Ing Deutschland Software Engineer candidate reports ↗

PracHub editorial advice for the preparation topics above.

01

Be proactive with communication

Candidates have occasionally reported delays in receiving feedback after submitting the coding challenge. Do not hesitate to send a polite follow-up email to your recruiter if you have not heard back within a week.

02

Ensure your follow-ups are polite but persistent

Staying on top of your application status shows your continued interest and helps keep your hiring pipeline moving forward.

03

Prioritize security in your code

When completing the take-home task, go beyond basic functionality. Implement input validation, secure error handling, and ensure no sensitive data is exposed. Mentioning these security choices in your code comments or readme file will immediately set you apart.

Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.

15 technical prompts0 include a worked solution

Collapse a redelivered event batch into per-aggregate high-water marks

easy
hashingat-least-onceaggregation

You drain a batch of up to 5,000,000 events, each (aggregate_id BIGINT, aggregate_version INT, event_type, payload). The log guarantees order within one aggregate only; the batch merges 64 partitions, and a relay failover has redelivered a range, so an older version for an aggregate can appear after a newer one. Given a map of last_applied_version per aggregate, produce the events worth applying, at most one per (aggregate_id, version), plus the count discarded. Target O(n) time. State the memory for 2,000,000 distinct aggregates and what you do when it does not fit.

Approach
  1. One pass, one hash map from aggregate_id to the highest version kept, and a discard counter. An event whose version is at or below last_applied_version for its aggregate is dropped without further work, which is the whole reason the event carries its version rather than a delta. O(n) expected time, O(d) space in distinct aggregates.
  2. Keep the maximum, never the last occurrence. The redelivered range means the final appearance of an aggregate in the batch can be an older version than one seen earlier in the same batch, so last-wins applies stale state over newer state and the projection regresses with no error anywhere.
  3. Cost the memory instead of calling it large: an 8-byte key plus a 4-byte version is 12 bytes of payload, and an open-addressed table held at a 0.7 load factor costs roughly 17 bytes per entry before per-slot metadata, so 2,000,000 aggregates is tens of megabytes in a native layout and several times that in a runtime that boxes both key and value.
  4. If the distinct set exceeds memory, partition on hash(aggregate_id) mod P and reduce each partition independently. Every event for one aggregate hashes to the same partition, so the per-partition result is exact and the merge is concatenation rather than a second reduction.
Follow-up
  • The payload is a patch rather than a snapshot, so applying only the highest version loses the intermediate changes. What changes in your reduction?
  • How do you detect that version 7 arrived while version 6 was never delivered, and what should the consumer do about the gap?

Diff a projection against the primary without per-row point reads

hard
reconciliationrange hashingthrottling

The listing projection has drifted and some rows show a stale version. The primary holds 40,000,000 resource rows across 12,000 tenants while serving 1,200 writes and 14,000 reads per second. The obvious repair, reading each resource row and comparing its version against the projection, is correct and would eventually finish. Explain precisely why it is unacceptable here, then give a diff that finds the differing rows, state its complexity, and make it safe to run against a live primary. Replication lag is usually under 100 ms and is not bounded.

Approach
  1. Quantify the naive cost rather than calling it slow: 40,000,000 point reads at even 0.5 ms each is over five hours serialised, and the only lever is concurrency, which is exactly what you cannot spend. The primary's pool is sized for the write path, and 40,000,000 random reads evict the buffer cache that sustains the 85 percent cache hit rate, so the audit degrades the system it is auditing.
  2. Replace random access with one ordered pass per side. Both sides can be read in (tenant_id, resource_id) order, which is a sequential scan on each and a merge join in O(n) time and O(1) memory. For a dense diff that is the whole answer, and it reads the primary once instead of 40,000,000 times.
  3. For the expected sparse case, compare range hashes instead of rows: partition the key space, compute per range an order-independent aggregate over hash(resource_id, version), compare aggregates, and descend only into ranges that differ. With d differing rows and branching factor B, at most d ranges mismatch per level, so the drill-down examines O(d log_B(n/d)) ranges and reads full rows only in mismatching leaves.
  4. Aggregate with a sum modulo 2^64 or a multiset hash, never XOR. XOR is order-independent but self-cancelling, so two rows wrong in the same way, or a row duplicated on one side, leave the range aggregate matching and the range is declared clean.
Follow-up
  • The diff reports 900 stale rows. How do you decide between patching those rows and rebuilding the projection from resource_revision?
  • Same job, but the projection lives in a search index that cannot be scanned in key order. What changes?

Canonicalise a request body into a stable idempotency fingerprint

medium
parsingcanonicalisationhashing

idempotency_key.request_fingerprint is a SHA-256 over the method, path and canonicalised body, and a retry whose fingerprint differs must be rejected with 422 rather than served the stored response. Write the canonicaliser. Bodies are JSON up to 256 KB nested at most 32 levels; clients vary key order, whitespace and unicode escaping, and some send 64-bit ids as JSON numbers. Produce a deterministic byte string such that semantically identical bodies match and any semantic difference does not. State your complexity and name two normalisations you refuse to perform.

Approach
  1. Parse once into a tree, then re-serialise under fixed rules: object keys sorted, array order preserved, one escaping convention, no insignificant whitespace. Parsing is O(n) and sorting keys is O(k log k) per object, so O(n log n) overall with O(depth) stack, and the 32-level cap is enforced during parsing because hostile nesting is how a canonicaliser becomes a stack overflow.
  2. Sort keys by their UTF-8 bytes and say why the obvious implementation is wrong in some runtimes: a default string comparison that orders by UTF-16 code units places surrogate pairs, meaning code points from U+10000 up, below U+E000 to U+FFFF, which is not UTF-8 byte order, so two services written in different languages disagree on the same document.
  3. Do not re-encode numbers through a double. IEEE-754 binary64 represents integers exactly only up to 2^53, so normalising a 19-digit id through a float changes it, and 1 against 1.0 cannot be reconciled without deciding whether they are the same value. Preserve the literal token, and require ids as strings at the API boundary if you want them comparable.
  4. Reject duplicate keys rather than picking one. JSON permits them and parsers disagree, most keeping the last, so any choice you make ties the fingerprint to a parser detail that the code handling the request does not necessarily share.
Follow-up
  • A client sends the same logical request with an extra field your API ignores. Same key, different fingerprint, so you return 422. Is that the right answer?
  • Where does the fingerprint get computed relative to request decompression and the body-size limit?

Built from the rounds and topics Ing Deutschland candidates report.

Small steps. Visible outcomes.0 / 7 completed
ONE WEEK · YOUR PACE

Prepare, practise & reflect

One practical outcome each day. Spend longer where you need it.

0 / 7 done
01Map the Ing Deutschland loop
  • Write out the reported sequence: Recruiter Screening, Technical Assignment, Code Review, Technical Interviews.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

02Work Coding Challenges
  • Spend the session on Coding Challenges, which Ing Deutschland candidates report being tested on.
  • Write one worked example in Coding Challenges and time yourself on it.

Deliverable: One timed worked example in Coding Challenges.

03Work REST APIs
  • Spend the session on REST APIs, which Ing Deutschland candidates report being tested on.
  • Write one worked example in REST APIs and time yourself on it.

Deliverable: One timed worked example in REST APIs.

04Work Backend Development
  • Spend the session on Backend Development, which Ing Deutschland candidates report being tested on.
  • Write one worked example in Backend Development and time yourself on it.

Deliverable: One timed worked example in Backend Development.

05Answer out loud: Backend & API Design
  • Answer aloud, timed: Design a set of REST APIs that calculate loan repayments based on principal, interest rate, and term.
  • Answer aloud, timed: How do you handle validation and error states in a RESTful service to ensure a seamless client experience?

Deliverable: Spoken answers to 2 reported Backend & API Design question(s), under time.

06Answer out loud: Security & Architecture
  • Answer aloud, timed: How do you secure a REST API against common vulnerabilities such as those listed in the OWASP Top 10?
  • Answer aloud, timed: Explain how you would implement secure authentication and authorization (e.g., OAuth2, JWT) for a microservices architecture.

Deliverable: Spoken answers to 2 reported Security & Architecture question(s), under time.

07Answer out loud: Technical Presentation & Code Review
  • Answer aloud, timed: Walk us through the architectural patterns you chose for your coding challenge submission. Why did you choose them over alternatives?
  • Answer aloud, timed: How did you handle edge cases and input validation in your loan calculation logic?

Deliverable: Spoken answers to 2 reported Technical Presentation & Code Review question(s), under time.

Expand any day for tasks and deliverables. Your progress is saved on this device.

Behavioural rounds judge the decision you made and what it cost.

How do you handle validation and error states in a RESTful service to ensure a seamless client experience?

medium
Backend & API Design

How do you handle validation and error states in a RESTful service to ensure a seamless client experience?

Approach
  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.
Follow-up
  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you handle sensitive data, such as personally identifiable information (PII) or financial records, both

medium
Security & Architecture

How do you handle sensitive data, such as personally identifiable information (PII) or financial records, both in transit and at rest?

Approach
  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.
Follow-up
  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you handle constructive, sometimes rigorous, feedback on your code from peers or senior reviewers?

medium
Technical Presentation & Code Review

How do you handle constructive, sometimes rigorous, feedback on your code from peers or senior reviewers?

Approach
  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.
Follow-up
  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?
  • 01

    How do you handle validation and error states in a RESTful service to ensure a seamless client experience?

  • 02

    How do you handle sensitive data, such as personally identifiable information (PII) or financial records, both in transit and at rest?

  • 03

    How do you handle constructive, sometimes rigorous, feedback on your code from peers or senior reviewers?

PracHub preparation framework ↗
What is the typical tech stack for a Software Engineer at Ing Deutschland?

The core backend tech stack is heavily centered around Java and Spring Boot, with some teams also utilizing Kotlin. For data storage, relational databases like PostgreSQL are common, alongside message brokers like Kafka for event-driven architectures.

Ing Deutschland Software Engineer candidate reports ↗
How difficult is the take-home coding challenge?

The challenge itself is of average difficulty, typically focusing on designing REST APIs for financial calculations, such as loan repayments. However, the evaluation is highly rigorous, focusing heavily on clean code principles, test coverage, and security.

Ing Deutschland Software Engineer candidate reports ↗
How long does the entire interview process usually take?

The process can take anywhere from three to six weeks. While the steps themselves are straightforward, candidates sometimes experience delays in communication between stages, so it is important to stay proactive and follow up with your recruiter.

Ing Deutschland Software Engineer candidate reports ↗
Is German language proficiency required for this role?

No, the primary working language for most engineering teams, especially in hubs like Berlin, is English. However, having basic German skills can be beneficial for navigating daily life and general company communications.

Ing Deutschland Software Engineer candidate reports ↗
What is the hybrid work policy at Ing Deutschland?

Ing Deutschland generally offers a flexible hybrid working model, allowing engineers to balance working from home with collaboration days in their local office (such as Berlin or Frankfurt).

Ing Deutschland Software Engineer candidate reports ↗
What topics does Ing Deutschland test in interviews?

Ing Deutschland interviews most often cover REST APIs, API Design, Coding Challenges, Coding Challenges (Practical Exercises), and Operations Management. The exact emphasis depends on the specific role you apply for.

Ing Deutschland Software Engineer candidate reports ↗
Sources & methodology 3 sources ↗

No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.