As a Software Engineer at Malt, you are joining a mission-driven organization that is actively redefining the future of work. With over 700,000 freelancers and 70,000 companies on the platform, your code directly influences the economic livelihood of a global community. This is not just a role for writing features; it is a position focused on building a scalable, human-centered marketplace that balances complex product requirements with high-performance engineering standards. Whether you are in a Staff or Senior capacity, you will operate at the intersection of technical architecture and business strategy. You will engage with a modern, robust stack—including Kotlin, Java Spring Boot, and Kubernetes—while collaborating across cross-functional squads. The work is challenging, requiring you to act as a "glue" between product, design, and engineering, ensuring that the solutions you build are not only technically sound but also drive real value for the Malt ecosystem. ##### Tip Malt places a high value on internal culture and mentorship. Even in technical interviews, demonstrate your ability to explain complex concepts clearly to non-technical stakeholders.
Preparation focus
editorialNo round sequence has been reported for this company, so confirm the format with your recruiter and work the reported questions below.
What to demonstrate
- Breadth across the topics this company reports testing
- Whether you confirm the format before preparing for it
How to prepare
- Ask the recruiter for the sequence, the duration of each stage and whether you will be writing code
- Work the reported questions below and time yourself
PracHub editorial advice for the preparation topics above.
Prepare for "Why Malt
Be ready to discuss the freelance market and why you are passionate about the "future of work."
Showcase your Mentorship
Have specific examples ready of how you helped a colleague improve their craft or how you influenced a team's technical direction.
Ask Strategic Questions
Use your interview time to ask about the company’s technical challenges, the roadmap for their AI initiatives, or how teams coordinate across different countries.
Be Transparent about Salary
As seen in historical data, being clear about your expectations and the value you bring is appreciated. Don't be afraid to discuss your requirements early.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Diff a projection against the primary without per-row point reads
The listing projection has drifted and some rows show a stale version. The primary holds 40,000,000 resource rows across 12,000 tenants while serving 1,200 writes and 14,000 reads per second. The obvious repair, reading each resource row and comparing its version against the projection, is correct and would eventually finish. Explain precisely why it is unacceptable here, then give a diff that finds the differing rows, state its complexity, and make it safe to run against a live primary. Replication lag is usually under 100 ms and is not bounded.
Approach
- Quantify the naive cost rather than calling it slow: 40,000,000 point reads at even 0.5 ms each is over five hours serialised, and the only lever is concurrency, which is exactly what you cannot spend. The primary's pool is sized for the write path, and 40,000,000 random reads evict the buffer cache that sustains the 85 percent cache hit rate, so the audit degrades the system it is auditing.
- Replace random access with one ordered pass per side. Both sides can be read in (tenant_id, resource_id) order, which is a sequential scan on each and a merge join in O(n) time and O(1) memory. For a dense diff that is the whole answer, and it reads the primary once instead of 40,000,000 times.
- For the expected sparse case, compare range hashes instead of rows: partition the key space, compute per range an order-independent aggregate over hash(resource_id, version), compare aggregates, and descend only into ranges that differ. With d differing rows and branching factor B, at most d ranges mismatch per level, so the drill-down examines O(d log_B(n/d)) ranges and reads full rows only in mismatching leaves.
- Aggregate with a sum modulo 2^64 or a multiset hash, never XOR. XOR is order-independent but self-cancelling, so two rows wrong in the same way, or a row duplicated on one side, leave the range aggregate matching and the range is declared clean.
Follow-up
- The diff reports 900 stale rows. How do you decide between patching those rows and rebuilding the projection from resource_revision?
- Same job, but the projection lives in a search index that cannot be scanned in key order. What changes?
Merge partitioned event streams into one ordered feed with bounded lateness
The read-model service consumes 64 log partitions carrying about 4,000 events per second in total. Each partition is ordered within itself, but partitions drift by up to 30 seconds, and the activity feed must present a tenant's events in occurred_at order. Produce the merge. State its complexity, the buffer it requires in events and in bytes, what happens when one partition is idle, and what you do with an event that arrives after you have already emitted its position. Payloads average 1 KB.
Approach
- Merge with a min-heap over the 64 partition heads keyed on (occurred_at, event_id): O(log P) per event and O(n log P) overall. The tie-break on event_id is what makes the output deterministic when two partitions carry the same millisecond, which matters because the feed is paginated and a non-deterministic order reorders pages under the reader.
- Emitting the heap head is only correct once every partition has produced everything up to that timestamp, so the emit condition is a watermark: the minimum across partitions of the highest occurred_at seen, less the allowed lateness. Events are held until the watermark passes them, which is what turns individually ordered streams into a jointly ordered one.
- Size the buffer from the lateness rather than guessing: 4,000 events per second times 30 seconds is 120,000 buffered events, and at 1 KB each about 120 MB of heap. That number is the real price of the ordering guarantee and belongs in front of whoever asked for it.
- Handle the idle partition explicitly, because it fails the feed rather than corrupting it: a partition with no traffic never advances its own maximum, so the watermark freezes and output stops entirely. Either every partition emits a periodic idle marker carrying the broker's current time, or the watermark falls back to wall clock for a partition silent beyond a threshold.
Follow-up
- The lateness budget is raised to five minutes. What is the new buffer, and what besides memory changes?
- The consumer restarts. Where does it resume from, and what does the feed look like for the first 30 seconds?
Canonicalise a request body into a stable idempotency fingerprint
idempotency_key.request_fingerprint is a SHA-256 over the method, path and canonicalised body, and a retry whose fingerprint differs must be rejected with 422 rather than served the stored response. Write the canonicaliser. Bodies are JSON up to 256 KB nested at most 32 levels; clients vary key order, whitespace and unicode escaping, and some send 64-bit ids as JSON numbers. Produce a deterministic byte string such that semantically identical bodies match and any semantic difference does not. State your complexity and name two normalisations you refuse to perform.
Approach
- Parse once into a tree, then re-serialise under fixed rules: object keys sorted, array order preserved, one escaping convention, no insignificant whitespace. Parsing is O(n) and sorting keys is O(k log k) per object, so O(n log n) overall with O(depth) stack, and the 32-level cap is enforced during parsing because hostile nesting is how a canonicaliser becomes a stack overflow.
- Sort keys by their UTF-8 bytes and say why the obvious implementation is wrong in some runtimes: a default string comparison that orders by UTF-16 code units places surrogate pairs, meaning code points from U+10000 up, below U+E000 to U+FFFF, which is not UTF-8 byte order, so two services written in different languages disagree on the same document.
- Do not re-encode numbers through a double. IEEE-754 binary64 represents integers exactly only up to 2^53, so normalising a 19-digit id through a float changes it, and 1 against 1.0 cannot be reconciled without deciding whether they are the same value. Preserve the literal token, and require ids as strings at the API boundary if you want them comparable.
- Reject duplicate keys rather than picking one. JSON permits them and parsers disagree, most keeping the last, so any choice you make ties the fingerprint to a parser detail that the code handling the request does not necessarily share.
Follow-up
- A client sends the same logical request with an extra field your API ignores. Same key, different fingerprint, so you return 422. Is that the right answer?
- Where does the fingerprint get computed relative to request decompression and the body-size limit?
Replace offset paging on the resource feed with keyset
resource holds resource_id, tenant_id, owner_user_id, title, body_ref, version, status ('draft','active','archived','deleted'), created_at, updated_at, deleted_at, with an index on (tenant_id, status, updated_at DESC, resource_id DESC). The listing endpoint returns active resources for one tenant, newest update first, 50 per page, today with LIMIT 50 OFFSET n. Tenants reach page 400 and rows are created while they read. Write the keyset query, define what the cursor carries and how it is encoded, and say which part of the index each predicate uses. Assume PostgreSQL 16.
Approach
- Name the two failures separately. OFFSET 20000 makes the server produce and discard 20,000 rows, so page cost grows with depth rather than with page size. Independently, any write that changes how many rows sort above the offset moves the window between two fetches, and the direction decides which anomaly you get: an insert lands at the head of updated_at DESC and pushes already-returned rows down past the boundary, so they are returned a second time; a delete above the offset, or a row whose updated_at is bumped above the cursor, pulls rows up and one is never returned at all. Nothing in the response reveals either.
- Write the seek: WHERE tenant_id = $1 AND status = 'active' AND (updated_at, resource_id) < ($2, $3) ORDER BY updated_at DESC, resource_id DESC LIMIT 50. The row-value comparison is one index range rather than a disjunction, and both columns are NOT NULL, which is what makes that comparison well defined.
- Map each predicate onto the index: tenant_id and status are equality on the leading columns, (updated_at, resource_id) is the range, and the ORDER BY matches the index order so no Sort node appears and the scan stops after 50 rows. The DESC in the definition only matters for mixed directions — a plain ascending btree on the same columns is read backwards for this query.
- Put both sort columns in the cursor and nothing the client can tamper with into another tenant: base64 of (updated_at, resource_id), validated server-side, with tenant_id taken from the principal.
Follow-up
- The client asks for 'jump to page 400'. What do you offer instead, and what does the honest version cost?
- Sort order becomes user-selectable across four columns. How many indexes is that, and which would you refuse to add?
Write the update path that detects a concurrent edit
resource carries version INT NOT NULL DEFAULT 1. resource_revision holds revision_id, resource_id, version, actor_user_id, change_kind, patch JSONB, request_id, created_at with UNIQUE (resource_id, version). outbox_event holds aggregate_type, aggregate_id, aggregate_version, event_type, payload, status. A PUT carries the version the client read. Write the exact statements for the single transaction that applies the edit, records the revision and enqueues 'resource.updated', and give the handler's branch on zero affected rows. Then say what PostgreSQL 16 does under READ COMMITTED when two of these updates hit one row at once.
Approach
- One transaction, three writes, no network call inside it: UPDATE resource SET title = $3, version = version + 1, updated_at = now() WHERE resource_id = $1 AND tenant_id = $4 AND version = $2; then INSERT the resource_revision row at version $2 + 1; then INSERT the outbox_event row at the same aggregate_version. The event goes to a table rather than a broker because no transaction spans both.
- Branch on the affected-row count before doing anything else. Zero has three causes — stale version, wrong tenant, row gone — so re-read once and map to 409 carrying the current version, or 404 for an id outside the caller's tenant, which also stops the endpoint confirming that another tenant's id exists.
- State the engine behaviour instead of assuming it. Under READ COMMITTED the second UPDATE blocks on the row lock, and when the first commits PostgreSQL re-evaluates the WHERE clause against the newly committed row, so the version predicate now fails and the statement reports zero rows. Under REPEATABLE READ the identical collision raises SQLSTATE 40001 instead, so the handler must fold both shapes into one conflict response.
- Keep UNIQUE (resource_id, version) even though the predicate already serialises writers. It is what makes a lost update unwritable if any other path ever reaches the revision table, and it converts a logic bug into 23505 rather than into a silently missing history row.
Follow-up
- A client sends the version it read ten minutes ago and the resource has moved three versions. What is in your 409 so it can resolve the conflict without a full re-fetch?
- Two editors, two disjoint fields, no overlap. Does your answer still refuse the second write, and should it?
How would you design a scalable microservices architecture for a marketplace with high seasonal traffic?
How would you design a scalable microservices architecture for a marketplace with high seasonal traffic?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
What is your approach to managing technical debt while still delivering new product features?
What is your approach to managing technical debt while still delivering new product features?
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
One customer endpoint stalls deliveries to every other destination
The egress service delivers about 1.5k webhooks/second across 40,000 destinations, with a per-destination concurrency cap of 4 and a 10-second connect-plus-read timeout. Throughput falls to 300/second, queue depth climbs, and p99 delivery latency for unaffected destinations goes from 200 ms to minutes, while the error rate barely moves. One tenant holds 900 destination rows whose URLs share a hostname that now answers in 9.5 seconds. Explain the mechanism with the arithmetic, then give the containment in the order you would apply it.
Approach
- Look at saturation before errors. A flat error rate with collapsing throughput says nothing is failing, things are waiting, so the first signal to pull is in-flight request count or pool wait time rather than the error counter. This is the distinction that decides the whole investigation.
- Group in-flight work by resolved host, not by destination id. The cap is keyed per destination row, so 900 rows sharing one hostname buy 3,600 concurrent slots against a single host, each held for 9.5 seconds. The bulkhead was never a bulkhead for that host, and grouping by the wrong dimension is why the dashboard looked healthy.
- Do the arithmetic in both directions. Required concurrency is arrival rate times latency, so 1.5k/second at 200 ms needs about 300 in flight, which is entirely consumed by 3,600 slow slots; conversely whatever concurrency is left sustains rate equals concurrency divided by 9.5 seconds, which is the 300/second you are seeing. Matching both numbers is what promotes this from a plausible story to the mechanism.
- Explain why the circuit breaker never helped. It opens on consecutive failures, and a 9.5-second response inside a 10-second timeout is a success. Slow is not failing, so an error-rate breaker cannot see this; you need a slow-call ratio, a deadline propagated from the caller's remaining budget, or a concurrency limiter.
Follow-up
- The host recovers to 80 ms. How long does the queue take to drain, and what does the drain do to the recovered host?
- Where should the 10-second timeout number actually come from?
Built from the topics and questions Malt candidates report; no round sequence has been reported.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Establish the Malt format
- No round sequence has been reported, so ask your recruiter for the sequence, the duration of each stage and whether you will write code.
Deliverable: A written reply from your recruiter confirming the format.
02Work System Architecture
- Spend the session on System Architecture, which Malt candidates report being tested on.
- Write one worked example in System Architecture and time yourself on it.
Deliverable: One timed worked example in System Architecture.
03Work Technical Leadership
- Spend the session on Technical Leadership, which Malt candidates report being tested on.
- Write one worked example in Technical Leadership and time yourself on it.
Deliverable: One timed worked example in Technical Leadership.
04Work Backend Engineering (Java/Kotlin ecosystem)
- Spend the session on Backend Engineering (Java/Kotlin ecosystem), which Malt candidates report being tested on.
- Write one worked example in Backend Engineering (Java/Kotlin ecosystem) and time yourself on it.
Deliverable: One timed worked example in Backend Engineering (Java/Kotlin ecosystem).
05Answer out loud: Technical & Architectural Depth
- Answer aloud, timed: How would you design a scalable microservices architecture for a marketplace with high seasonal traffic?
- Answer aloud, timed: Can you explain your experience with Kotlin or Java Spring Boot in a production environment?
Deliverable: Spoken answers to 2 reported Technical & Architectural Depth question(s), under time.
06Rehearse your own examples
- Prepare three examples from your own work where you made the decision, each with the outcome you can quantify.
Deliverable: Three examples written out, each with a number attached.
07Dry run for Malt
- Run one full mock under time, then write down the two questions you most want to ask your interviewers.
Deliverable: A completed timed mock and two questions to ask.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
Can you explain your experience with Kotlin or Java Spring Boot in a production environment?
Can you explain your experience with Kotlin or Java Spring Boot in a production environment?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
How do you handle data consistency across PostgreSQL and Elasticsearch in a distributed system?
How do you handle data consistency across PostgreSQL and Elasticsearch in a distributed system?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a time you had to troubleshoot a performance bottleneck in a cloud-native environment.
Describe a time you had to troubleshoot a performance bottleneck in a cloud-native environment.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
- 01
Can you explain your experience with Kotlin or Java Spring Boot in a production environment?
- 02
How do you handle data consistency across PostgreSQL and Elasticsearch in a distributed system?
- 03
Describe a time you had to troubleshoot a performance bottleneck in a cloud-native environment.
How long does the interview process typically take?
Depending on scheduling, the process generally spans a few weeks. It is structured to be efficient, but given the number of stakeholders involved, allow for enough time to complete the case studies and final interviews.
Malt Software Engineer candidate reports ↗Is the technical case study theoretical or practical?
It is designed to be practical. You will be asked to solve problems relevant to Malt's actual product ecosystem, testing your ability to apply your skills to real-world marketplace challenges.
Malt Software Engineer candidate reports ↗Does Malt offer remote work?
Yes, Malt has a very strong remote culture. Most of the team works full-remote throughout Europe, though there are physical offices if you prefer a hybrid model.
Malt Software Engineer candidate reports ↗What is the most important trait for success in the interview?
Ownership. The team wants to see that you take responsibility for your work, are curious about the "why" behind features, and are resourceful enough to get things done under constraints.
Malt Software Engineer candidate reports ↗What topics does Malt test in interviews?
Malt interviews most often cover Stakeholder Communication, Time Management, Structured interview process (multi-round hiring), System Architecture, and Operations Management. The exact emphasis depends on the specific role you apply for.
Malt Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Malt Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
Confluent Software Engineer Interview Guide
Concurrency exercises for Confluent candidates: check-then-act races, deadlock from inconsistent lock ordering, and why two individually atomic operations do not compose into an atomic update.
Zenith Bank (Uk) Limited. Software Engineer Interview Guide
What Zenith Bank (Uk) Limited. asks Software Engineer candidates, from reported rounds and questions.
WorldWide Technology Holding Software Engineer Interview Guide
What WorldWide Technology Holding asks Software Engineer candidates, from reported rounds and questions.
Wissen Infotech Software Engineer Interview Guide
What Wissen Infotech asks Software Engineer candidates, from reported rounds and questions.