A Software Engineer at Middesk plays a pivotal role in the company’s mission to modernize business identity verification. By replacing manual, legacy processes with automated, data-driven solutions, you directly influence how businesses across industries manage risk and onboard customers. Your work is not just about writing code; it is about delivering realized value through technical excellence and a deep understanding of the customer problems that Middesk solves. The engineering culture at Middesk is defined by the concept of "Velocity"—which they define as the rate at which they effect realized value rather than just the speed at which they ship features. You will be expected to be a self-motivated problem solver who is willing to roll up your sleeves to tackle messy, real-world data challenges. Whether you are working on the core verification platform or building out infrastructure, your contributions are instrumental in maintaining Middesk’s reputation as an industry leader in digital identity.
Recruiter Screen
reportedInitial screening by a recruiter to assess fit for the role.
What to demonstrate
- Initial screening by a recruiter to assess fit for the role
- Depth in Kubernetes
How to prepare
- Be able to walk your CV end to end in two minutes, and say why this company specifically.
- Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.
Technical Screening
reportedPair-programming session via CoderPad to evaluate technical skills.
What to demonstrate
- Pair-programming session via CoderPad to evaluate technical skills
- Depth in Kubernetes
How to prepare
- Answer aloud and timed: How do you handle JSON parsing and data validation when integrating with external data sources?
- Answer aloud and timed: Describe your experience with TypeORM or similar ORM tools in a production environment.
Onsite/Virtual Panel
reportedMulti-stage interviews including system design, product collaboration, and discussions with engineering leadership.
What to demonstrate
- Multi-stage interviews including system design, product collaboration, and discussions with engineering leadership
- Depth in Kubernetes
How to prepare
- Answer aloud and timed: How do you ensure high availability and reliability in your services?
- Answer aloud and timed: Design a system for tracking business identity verification status across multiple data sources.
PracHub editorial advice for the preparation topics above.
Think Aloud
Your thought process is just as important as the final code. Walk the interviewer through your logic, especially when you encounter obstacles.
Ask Clarifying Questions
Before jumping into a solution, clarify the requirements. It shows you are thinking about the business impact of your code.
Be Candid
If you don't know an answer, be honest and explain how you would go about finding the information. Authenticity is highly valued at Middesk.
Review Your Past Work
Be prepared to do a deep dive into a past project. Understand the trade-offs you made and why you made them.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Find overlapping job attempts and peak concurrency from lease records
A day of job_run history yields about 50,000,000 attempt records: (job_run_id, job_type, attempt, started_at, finished_at which is NULL when the worker died, lease_expires_at). Leases expire on a clock, so a job that outran its lease ran twice. Produce (a) every job_run_id whose attempts overlapped in wall-clock time and (b) the peak number of simultaneously running attempts per job_type with the minute it occurred. Target O(n log n). State how you treat a NULL finished_at and what clock skew does to your answer.
Approach
- Define the interval before sorting anything: an attempt occupies [started_at, COALESCE(finished_at, lease_expires_at)). finished_at is observed and lease_expires_at is only a promise, so every attempt without a finish contributes an estimate and the whole result is a lower bound on overlap rather than an exact count.
- For peak concurrency, sweep: emit 2n endpoints, sort by (timestamp, kind) with ends ordered before starts at equal timestamps, then walk the sequence maintaining a counter per job_type and record each type's maximum with its timestamp. O(n log n) dominated by the sort, O(n) space, or O(1) extra if the sort is external and the walk streams.
- For overlap detection, do not compare attempts pairwise. A single global sort by (job_run_id, started_at) gives both the grouping and the order; within a group, keep the maximum end seen so far and report an overlap exactly when the next start is less than that running maximum, which is one linear pass after the sort.
- Half-open intervals matter and are easy to get wrong: with closed intervals an attempt ending at the same millisecond another begins reads as concurrency two, and across 50,000,000 records that artefact swamps the real signal.
Follow-up
- A handler is not idempotent and you have found 400 overlapping jobs. Which of them actually caused damage, and what would you query to find out?
- Peak concurrency for one job_type is 4 against a configured cap of 4. Is the cap working, or is the data hiding attempts that never started?
Canonicalise a request body into a stable idempotency fingerprint
idempotency_key.request_fingerprint is a SHA-256 over the method, path and canonicalised body, and a retry whose fingerprint differs must be rejected with 422 rather than served the stored response. Write the canonicaliser. Bodies are JSON up to 256 KB nested at most 32 levels; clients vary key order, whitespace and unicode escaping, and some send 64-bit ids as JSON numbers. Produce a deterministic byte string such that semantically identical bodies match and any semantic difference does not. State your complexity and name two normalisations you refuse to perform.
Approach
- Parse once into a tree, then re-serialise under fixed rules: object keys sorted, array order preserved, one escaping convention, no insignificant whitespace. Parsing is O(n) and sorting keys is O(k log k) per object, so O(n log n) overall with O(depth) stack, and the 32-level cap is enforced during parsing because hostile nesting is how a canonicaliser becomes a stack overflow.
- Sort keys by their UTF-8 bytes and say why the obvious implementation is wrong in some runtimes: a default string comparison that orders by UTF-16 code units places surrogate pairs, meaning code points from U+10000 up, below U+E000 to U+FFFF, which is not UTF-8 byte order, so two services written in different languages disagree on the same document.
- Do not re-encode numbers through a double. IEEE-754 binary64 represents integers exactly only up to 2^53, so normalising a 19-digit id through a float changes it, and 1 against 1.0 cannot be reconciled without deciding whether they are the same value. Preserve the literal token, and require ids as strings at the API boundary if you want them comparable.
- Reject duplicate keys rather than picking one. JSON permits them and parsers disagree, most keeping the last, so any choice you make ties the fingerprint to a parser detail that the code handling the request does not necessarily share.
Follow-up
- A client sends the same logical request with an extra field your API ignores. Same key, different fingerprint, so you return 422. Is that the right answer?
- Where does the fingerprint get computed relative to request decompression and the body-size limit?
Collapse a redelivered event batch into per-aggregate high-water marks
You drain a batch of up to 5,000,000 events, each (aggregate_id BIGINT, aggregate_version INT, event_type, payload). The log guarantees order within one aggregate only; the batch merges 64 partitions, and a relay failover has redelivered a range, so an older version for an aggregate can appear after a newer one. Given a map of last_applied_version per aggregate, produce the events worth applying, at most one per (aggregate_id, version), plus the count discarded. Target O(n) time. State the memory for 2,000,000 distinct aggregates and what you do when it does not fit.
Approach
- One pass, one hash map from aggregate_id to the highest version kept, and a discard counter. An event whose version is at or below last_applied_version for its aggregate is dropped without further work, which is the whole reason the event carries its version rather than a delta. O(n) expected time, O(d) space in distinct aggregates.
- Keep the maximum, never the last occurrence. The redelivered range means the final appearance of an aggregate in the batch can be an older version than one seen earlier in the same batch, so last-wins applies stale state over newer state and the projection regresses with no error anywhere.
- Cost the memory instead of calling it large: an 8-byte key plus a 4-byte version is 12 bytes of payload, and an open-addressed table held at a 0.7 load factor costs roughly 17 bytes per entry before per-slot metadata, so 2,000,000 aggregates is tens of megabytes in a native layout and several times that in a runtime that boxes both key and value.
- If the distinct set exceeds memory, partition on hash(aggregate_id) mod P and reduce each partition independently. Every event for one aggregate hashes to the same partition, so the per-partition result is exact and the merge is concatenation rather than a second reduction.
Follow-up
- The payload is a patch rather than a snapshot, so applying only the highest version loses the intermediate changes. What changes in your reduction?
- How do you detect that version 7 arrived while version 6 was never delivered, and what should the consumer do about the gap?
How would you structure a database schema for a business verification service?
How would you structure a database schema for a business verification service?
Approach
- Name the grain you start from and join outward from it.
- Check whether any join is one-to-many before aggregating, or the sums inflate.
- Say which index the query would use, and what makes it unusable.
- Handle the rows that do not match: that is usually the actual question.
Follow-up
- How does the query change if that join becomes one-to-many?
- What happens to this when the table is ten times larger?
Hold a per-tenant active cap against concurrent creates
A tenant on the standard plan may hold at most 50 resources with status='active'. The create handler runs SELECT count(*) FROM resource WHERE tenant_id = $1 AND status = 'active', compares to 50, then inserts. Two creates arrive 3 ms apart on different instances and the tenant lands at 51. Name the anomaly, say whether PostgreSQL 16 READ COMMITTED or REPEATABLE READ prevents it and why, then give an implementation that holds the cap at READ COMMITTED with the exact statements. Finally, say what changes when the cap is 'at most one running export per tenant' on job_run.
Approach
- Name it: write skew. The two transactions read an overlapping set and write disjoint rows, so there is no row-level conflict for the engine to detect and each commit is individually legal.
- Rule out the levels precisely. READ COMMITTED takes a fresh snapshot per statement and takes no lock on the counted rows, so both see 49. PostgreSQL's REPEATABLE READ is snapshot isolation: it removes non-repeatable reads and phantoms within the snapshot but still admits write skew, because the anomaly is not a re-read of a changed row, it is a read of a set that a concurrent transaction invalidates. Only SERIALIZABLE closes it, by tracking the read dependency and aborting one transaction with SQLSTATE 40001 — a guarantee that exists only if the application re-runs the whole transaction from the read.
- Convert the set predicate into a single-row conflict: keep tenant.active_resource_count and run UPDATE tenant SET active_resource_count = active_resource_count + 1 WHERE tenant_id = $1 AND active_resource_count < 50 in the same transaction as the INSERT. Zero affected rows is the cap, returned as 409. The row lock serialises the decision at any isolation level, and contention is bounded to one tenant's row — which is also the fair-scheduling unit, unlike a global counter that would convoy every tenant behind one row.
- State the cost you just took on: a counter is a second source of truth that can drift, so every path that changes status must adjust it inside the same transaction, and a periodic reconciliation has to exist, with resource_revision as the authority for what the count should have been.
Follow-up
- A resource moves from archived back to active. Which statements change, and what breaks if the counter update and the status change land in different transactions?
- The cap becomes plan-dependent and a plan can change mid-month. Where does the number 50 live, and who reads it?
Explain the process of taking a feature from database design to a functional REST API endpoint.
Explain the process of taking a feature from database design to a functional REST API endpoint.
Approach
- Say who the caller is and what they do when the call fails halfway.
- Define the identity of a request so a retry cannot double-apply it.
- Separate accepted, pending, failed and confirmed; they are different facts.
- Design the error taxonomy before the success shape; callers branch on it.
Follow-up
- What happens if the caller retries after a timeout?
- How does a client discover it is on an old version of this contract?
How do you ensure high availability and reliability in your services?
How do you ensure high availability and reliability in your services?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Design a system for tracking business identity verification status across multiple data sources.
Design a system for tracking business identity verification status across multiple data sources.
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
How would you approach building an observability system to monitor service performance?
How would you approach building an observability system to monitor service performance?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Given a set of business constraints, how do you balance technical debt with the need for speed?
Given a set of business constraints, how do you balance technical debt with the need for speed?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Listing latency scales with page size, not with filters
The tenant listing endpoint reads resource filtered by tenant_id and status, ordered by updated_at DESC, and returns each row plus the owner's display name from app_user and the actor of that resource's latest resource_revision. p99 is 55 ms at 10 rows per page and 1.4 s at 200. Database telemetry shows 401 statements per request, each under 1 ms, and nothing in the slow-query log. Diagnose the cause and give the fix, stating the statement count per request and the p99 you expect afterwards.
Approach
- Read the counters before forming a theory. 401 statements for 200 rows is one driver query plus two per row, and sub-millisecond execution with an empty slow-query log rules out a bad plan. The time is round trips, which is why it is invisible in every per-query metric and scales with rows returned rather than with filter selectivity.
- Name the two per-row statements from their normalised text: a single-row app_user lookup by user_id, and a resource_revision lookup by resource_id ordered by version DESC LIMIT 1. Confirm by dropping those two response fields and watching the statement count fall to one. That locates the calls in the serialisation layer, not the repository.
- Check that the arithmetic accounts for the whole gap. Measure one round trip to the replica in isolation; 400 trips at roughly 3 ms of network plus 0.2 ms of execution is about 1.3 s on top of a 55 ms baseline, which matches. If the multiplication had fallen short, the N+1 would only be part of the story and you would keep looking.
- Batch both lookups. Collect owner_user_ids and resource_ids from the driver query, then issue WHERE tenant_id = $1 AND user_id = ANY($2) for the users, and PostgreSQL's SELECT DISTINCT ON (resource_id) ... WHERE resource_id = ANY($2) ORDER BY resource_id, version DESC for the latest revision, which the UNIQUE (resource_id, version) index serves directly. On an engine without DISTINCT ON, use a lateral join or a row_number window. Three statements per request at any page size.
Follow-up
- The page size is capped at 200 today. What breaks first if it is raised to 2,000, and is it still this bug?
- How do you stop the next N+1 from reaching production, given that no individual query is slow and the endpoint's tests pass?
Built from the rounds and topics Middesk candidates report.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Map the Middesk loop
- Write out the reported sequence: Recruiter Screen, Technical Screening, Onsite/Virtual Panel.
- For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.
Deliverable: A one-page map of the 3 reported rounds, with the weakest marked.
02Work Kubernetes
- Spend the session on Kubernetes, which Middesk candidates report being tested on.
- Write one worked example in Kubernetes and time yourself on it.
Deliverable: One timed worked example in Kubernetes.
03Work Infrastructure Engineering
- Spend the session on Infrastructure Engineering, which Middesk candidates report being tested on.
- Write one worked example in Infrastructure Engineering and time yourself on it.
Deliverable: One timed worked example in Infrastructure Engineering.
04Work Developer Experience (DevEx)
- Spend the session on Developer Experience (DevEx), which Middesk candidates report being tested on.
- Write one worked example in Developer Experience (DevEx) and time yourself on it.
Deliverable: One timed worked example in Developer Experience (DevEx).
05Answer out loud: Technical and Domain Knowledge
- Answer aloud, timed: How would you structure a database schema for a business verification service?
- Answer aloud, timed: Explain the process of taking a feature from database design to a functional REST API endpoint.
Deliverable: Spoken answers to 2 reported Technical and Domain Knowledge question(s), under time.
06Answer out loud: System Design and Collaboration
- Answer aloud, timed: Design a system for tracking business identity verification status across multiple data sources.
- Answer aloud, timed: How would you approach building an observability system to monitor service performance?
Deliverable: Spoken answers to 2 reported System Design and Collaboration question(s), under time.
07Dry run for Middesk
- Run one full mock under time, then write down the two questions you most want to ask your interviewers.
Deliverable: A completed timed mock and two questions to ask.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
How do you handle JSON parsing and data validation when integrating with external data sources?
How do you handle JSON parsing and data validation when integrating with external data sources?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe your experience with TypeORM or similar ORM tools in a production environment.
Describe your experience with TypeORM or similar ORM tools in a production environment.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a time you had to collaborate with a non-technical stakeholder to solve a complex problem.
Describe a time you had to collaborate with a non-technical stakeholder to solve a complex problem.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
How do you handle failure scenarios in a distributed system?
How do you handle failure scenarios in a distributed system?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
- 01
How do you handle JSON parsing and data validation when integrating with external data sources?
- 02
Describe your experience with TypeORM or similar ORM tools in a production environment.
- 03
Describe a time you had to collaborate with a non-technical stakeholder to solve a complex problem.
- 04
How do you handle failure scenarios in a distributed system?
How long should I spend preparing for the technical interviews?
Because the interviews focus on practical, real-world problems, you should prioritize building and reviewing backend systems over memorizing complex algorithms. Spend 1–2 weeks practicing your ability to talk through your design decisions while coding.
Middesk Software Engineer candidate reports ↗What is the most common reason candidates are rejected?
Candidates often struggle when they fail to demonstrate a clear thought process or when they focus on the "how" of coding without considering the "why" of the business problem. Ensure you are communicating your logic throughout the technical sessions.
Middesk Software Engineer candidate reports ↗How can I stand out in the System Design round?
Treat the interviewer as a collaborator. Ask questions about the constraints of the system, acknowledge potential trade-offs, and show that you are designing with the end user in mind.
Middesk Software Engineer candidate reports ↗Is the technical interview language-specific?
Typically, you can use the language of your choice, provided you are proficient enough to write clean, maintainable code. Focus on readability and standard library usage.
Middesk Software Engineer candidate reports ↗What topics does Middesk test in interviews?
Middesk interviews most often cover Kubernetes, Sales Outreach Planning, Infrastructure Engineering, Developer Experience (DevEx), and B2B Sales Strategy. The exact emphasis depends on the specific role you apply for.
Middesk Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Middesk Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
SWIFT Software Engineer Interview Guide
What SWIFT asks Software Engineer candidates, from reported rounds and questions.
North Highland Software Engineer Interview Guide
What North Highland asks Software Engineer candidates, from reported rounds and questions.
Invue Security Products Software Engineer Interview Guide
What Invue Security Products asks Software Engineer candidates, from reported rounds and questions.
Infoblox Software Engineer Interview Guide
What Infoblox asks Software Engineer candidates, from reported rounds and questions.