As a Software Engineer at Securitas, you are at the forefront of transforming the global security industry through digital innovation. We are shifting from traditional guarding to Intelligent Security, which relies heavily on sophisticated software solutions, real-time data processing, and integrated technology stacks. Your work directly impacts the safety of thousands of clients and the efficiency of our security professionals on the ground. You will contribute to a diverse ecosystem of products, ranging from GPS-based vehicle tracking systems and mobile applications for field personnel to complex backend systems that aggregate security data from IoT sensors. The engineering team is tasked with building high-availability, scalable systems that can handle mission-critical security alerts without failure. At Securitas, your code isn't just about functionality; it is about providing peace of mind and protecting lives and assets globally. The role is ideal for engineers who enjoy solving complex, real-world problems where software meets physical security. Whether you are optimizing a or designing a robust cloud architecture, your contributions will drive our strategic goal of becoming a lead integrator of technology and human expertise. GPS detection algorithm
Initial Screening
reportedAlign on expectations and discuss the role's requirements.
What to demonstrate
- Align on expectations and discuss the role's requirements
- Depth in GPS-Based Applications
How to prepare
- Be able to walk your CV end to end in two minutes, and say why this company specifically.
- Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.
Technical Evaluations
reportedDeeper assessments including coding assessments and system design discussions.
What to demonstrate
- Deeper assessments including coding assessments and system design discussions
- Depth in GPS-Based Applications
How to prepare
- Answer aloud and timed: Explain the logic behind a GPS tracking algorithm that minimizes battery drain on a mobile device.
- Answer aloud and timed: What are the trade-offs between using a relational database versus a NoSQL database for storing security logs?
Behavioral Interviews
reportedEvaluate cultural fit and communication skills through discussions about past experiences.
What to demonstrate
- Evaluate cultural fit and communication skills through discussions about past experiences
- Depth in GPS-Based Applications
How to prepare
- Prepare three examples from your own work, each with a decision you made and an outcome you can quantify.
- Re-read the description of the behavioral interviews above and write down what you would ask to confirm before it.
Final Round
reportedConclude with high-level discussions focusing on alignment with Securitas' mission.
What to demonstrate
- Conclude with high-level discussions focusing on alignment with Securitas' mission
- Depth in GPS-Based Applications
How to prepare
- Answer aloud and timed: How do you handle a situation where a production system goes down outside of standard working hours?
- Answer aloud and timed: Describe a project where you had to learn a new technology very quickly.
PracHub editorial advice for the preparation topics above.
Understand the Business
Before your interview, research Securitas' shift toward "Electronic Security." Being able to talk about how software replaces or enhances traditional guarding will impress your interviewers.
Focus on Reliability
In the security world, "it works most of the time" is not enough. Emphasize your commitment to testing, error handling, and system uptime.
Be Clear on Your Background
Be ready to talk through your resume in detail. Interviewers often ask about specific projects, your role in them, and the impact they had.
Ask About the Project
Our interviewers enjoy talking about the specific security challenges they are solving. Asking insightful questions about the GPS tracking or IoT integration projects shows genuine interest.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Describe how you would implement a real-time notification system for a mobile security app.
Describe how you would implement a real-time notification system for a mobile security app.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Explain the logic behind a GPS tracking algorithm that minimizes battery drain on a mobile device.
Explain the logic behind a GPS tracking algorithm that minimizes battery drain on a mobile device.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
What are the trade-offs between using a relational database versus a NoSQL database for storing security logs?
What are the trade-offs between using a relational database versus a NoSQL database for storing security logs?
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
How do you ensure your code is secure against common vulnerabilities like SQL injection?
How do you ensure your code is secure against common vulnerabilities like SQL injection?
Approach
- Name the grain you start from and join outward from it.
- Check whether any join is one-to-many before aggregating, or the sums inflate.
- Say which index the query would use, and what makes it unusable.
- Handle the rows that do not match: that is usually the actual question.
Follow-up
- How does the query change if that join becomes one-to-many?
- What happens to this when the table is ten times larger?
Denormalise tenant onto revisions and backfill it live
resource_revision (revision_id, resource_id, version, actor_user_id, change_kind, patch, request_id, created_at) has 400M rows and no tenant column; tenant_id lives only on resource. Two reads need it: a tenant-scoped audit feed ordered by created_at DESC, and an offboarding purge. Both join back to resource today. Justify adding tenant_id to resource_revision against those two reads, name the anomaly the copy introduces and the constraint that prevents it, then give the ordered migration for a live table taking 1.2k writes/second — the lock each step takes, how the backfill is batched, and where each step stops being reversible. PostgreSQL 16.
Approach
- Justify from the access path rather than from taste. Without the column, the audit feed either scans resource_revision by created_at and discards other tenants' rows, or resolves the tenant's resource_ids first and probes with them — both proportional to the tenant's whole history rather than to one page. With (tenant_id, created_at DESC, revision_id DESC) it is a seek that stops at 50 rows, and the purge becomes a ranged delete instead of a join.
- Name the cost exactly: a second copy of a fact can disagree with the first. Make the disagreement unwritable rather than documented — add UNIQUE (resource_id, tenant_id) on resource so it can serve as a foreign-key target, then FOREIGN KEY (resource_id, tenant_id) REFERENCES resource (resource_id, tenant_id) on the revision table. A revision can then only ever carry its parent's tenant.
- Step one, expand: ALTER TABLE resource_revision ADD COLUMN tenant_id BIGINT NULL, with no default, so it is a catalogue change and no rewrite. It still needs ACCESS EXCLUSIVE for an instant, and that instant queues behind the longest open transaction on the table while every later query queues behind it — set lock_timeout to 2s and retry rather than wait.
- Step two, dual-write: deploy the writer that populates tenant_id on every new revision while reads still use the join. Reversible by redeploying the previous build, because nothing reads the column yet.
Follow-up
- The backfill is half finished and a rollback is required. What state is the table in, and what does the previous build do with a half-populated column?
- How do you verify the backfill actually finished, given rows are still being inserted while it runs?
Give the resource write endpoints a failure taxonomy clients can act on
Two callers use POST and PATCH /v1/resources: a server-side SDK that retries automatically, and a browser app that shows the user a message. Today every failure is a 500 carrying prose. Define the error contract for a malformed body, a field that fails validation, an expired token, a token whose auth_version no longer matches, a resource_id owned by another tenant, a version mismatch on update, an idempotency key reused with a different body, an exceeded tenant quota, and a read replica that has not caught up. Deliverable: the envelope, the status per case, and what each caller does.
Approach
- Split the envelope by audience: a stable
codeenum for programs, amessagedocumented as human-only and free to change wording, arequest_idthat joins to resource_revision.request_id and the trace, and adetailsarray of field paths for validation failures. Publish the negative rules too - clients never branch onmessage, and an unrecognisedcodefalls back to the status class. - Assign status by who has to change something. 400 for bytes that do not parse, 422 for a body that parses and violates a rule, 401 for a token that no longer authenticates - expiry and an auth_version mismatch are the same instruction, re-authenticate - 403 for a scope the principal lacks, 404 rather than 403 for another tenant's resource_id because 403 confirms the id exists, 412 for a failed If-Match (409 if the version travels in the body instead), 422 for a key reused with a different fingerprint, 429 for quota.
- Derive retryability from whether the outcome is unknown, not from the status number. A timeout or a 5xx on a write is unknown - the transaction may have committed and the response lost - so the only safe retry is one carrying the same idempotency key. Every 4xx except 429 is deterministic, and retrying it only spends the caller's remaining deadline.
- Refuse to model replica lag as an error. Read-after-write is held by pinning the session to the primary for a short window, not by a 404 the SDK retries into a loop; if staleness must be visible, expose it as a watermark on a 200, because a failure code invites a retry that cannot fix it.
Follow-up
- A customer reports two resources created from one click. Which of your status codes could have produced that, and what in the contract permitted the client's reading?
- You need a tenth error code next quarter without a version bump. What must v1 already have said for that to be non-breaking?
Specify the outbound webhook contract a customer endpoint can verify
Egress delivery sends resource.created, resource.updated and resource.archived to roughly 40k customer endpoints at about 1.5k deliveries/second, with a per-destination concurrency cap of 4 and a 10 second connect-plus-read timeout, at-least-once from the relay. The receiver is code you do not control, often behind a proxy that may re-encode JSON. Specify the payload envelope, how the receiver verifies authenticity and rejects replays, what ordering it may assume, how it deduplicates, which status codes it should return and what each means to us, and the retry, circuit and replay behaviour.
Approach
- Send the fact, not a pointer: event_id, event_type, aggregate_type, aggregate_id, aggregate_version, occurred_at and the payload copied from outbox_event. A receiver told only that resource 42 changed has to call back, and the call back returns a newer state than the event describes - that is precisely how a consumer applies changes out of order while believing it is following them.
- Sign the exact bytes on the wire: HMAC-SHA256 over the timestamp, a separator, and the raw body, in a header, compared in constant time before the body is parsed. Instruct receivers to verify the raw bytes, never a re-serialised copy, since a proxy that reorders keys or changes whitespace invalidates a signature computed over re-encoded JSON. Reject a timestamp outside a tolerance - five minutes is typical - and keep a short seen-set of event_ids, because a capture replayed inside the tolerance still verifies.
- Support key rotation by sending several signature values in one header during the overlap window and publishing that any one that verifies is sufficient. Without that rule a key rotation is a synchronised outage across every destination at once.
- State the guarantee as it actually is: at-least-once and unordered, including within a single aggregate_id. The outbox is ordered per aggregate at the source, but the relay holds up to 4 requests in flight per destination and backs off each retry independently, so a version 6 delivery that needs one retry lands after a version 7 that succeeded on its first attempt. Publishing per-aggregate ordering we do not enforce is worse than publishing none, because a receiver that trusts it overwrites new state with old. Receivers deduplicate on event_id and apply conditionally - UPDATE ... WHERE aggregate_version < :incoming, or the same comparison under a row lock on the aggregate - which discards stale redeliveries and stays correct when two deliveries for one aggregate are processed at the same time. A duplicate and an out-of-order delivery then have the same outcome: no-op.
Follow-up
- A customer insists an event never arrived. What do you check, in order, and which table settles the argument?
- A receiver cannot store a version and asks us to deliver their events in order. What would the relay have to give up to offer that, and what does one failing event then do to the rest of their stream?
Exports duplicate a row range about once a week
Roughly once a week an export writes a file containing a duplicated range of rows. The affected job_run rows show attempt = 1, status = succeeded, one started_at, and a lease_owner naming a different host from the one whose logs show the job starting. Leases last 30 seconds and are heartbeated every 10 from inside the handler; lease_expires_at is computed on the worker and compared against the database's now(). Find the mechanism, and give a fix that holds even if you cannot fix the clocks.
Approach
- Start from the fact that eliminates the obvious answer. attempt = 1 means no retry was recorded, so this is not a re-run after failure; two workers ran the same row concurrently and the takeover path never touched the counter. lease_owner naming a host other than the one that started the job is the same statement from the other side.
- Enumerate the mechanisms that cause a premature takeover, then find the signal that separates them. Either the lease genuinely expired because the heartbeat did not fire, which is what happens when the heartbeat runs on the handler's own thread and the handler makes a long blocking call, or it only appeared expired because two clocks disagree, since lease_expires_at is written from the worker's clock and evaluated against the database's. The discriminator is the distribution: incidents clustered on the longest exports indict the heartbeat, incidents clustered on one host indict skew. Measure both, and measure each host's offset against the database directly.
- Read the reclaim query precisely. In PostgreSQL now() is transaction start time, not statement time, so a reclaimer holding a long transaction compares against an older timestamp than expected; clock_timestamp() is the statement-time function. This is worth ruling in or out before you redesign anything, because it changes which rows look expired.
- Remove the second clock rather than trying to synchronise it. Issue and extend the lease in the database, with lease_expires_at = now() + interval '30 seconds' in both the claim and the heartbeat, so exactly one clock is ever compared and worker skew stops mattering to this predicate.
Follow-up
- The displaced worker has already streamed half the file to object storage. What makes that side effect safe to repeat?
- You now count takeovers. What alert fires on that counter, and at what threshold?
Built from the rounds and topics Securitas candidates report.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Map the Securitas loop
- Write out the reported sequence: Initial Screening, Technical Evaluations, Behavioral Interviews, Final Round.
- For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.
Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.
02Work GPS-Based Applications
- Spend the session on GPS-Based Applications, which Securitas candidates report being tested on.
- Write one worked example in GPS-Based Applications and time yourself on it.
Deliverable: One timed worked example in GPS-Based Applications.
03Work System Design
- Spend the session on System Design, which Securitas candidates report being tested on.
- Write one worked example in System Design and time yourself on it.
Deliverable: One timed worked example in System Design.
04Work Technical Skills (General)
- Spend the session on Technical Skills (General), which Securitas candidates report being tested on.
- Write one worked example in Technical Skills (General) and time yourself on it.
Deliverable: One timed worked example in Technical Skills (General).
05Answer out loud: Technical & Problem Solving
- Answer aloud, timed: Describe how you would implement a real-time notification system for a mobile security app.
- Answer aloud, timed: How do you ensure your code is secure against common vulnerabilities like SQL injection?
Deliverable: Spoken answers to 2 reported Technical & Problem Solving question(s), under time.
06Answer out loud: Behavioral & Cultural Fit
- Answer aloud, timed: Tell me about a time you had to work with a difficult stakeholder to deliver a technical project.
- Answer aloud, timed: Why are you interested in the security industry specifically?
Deliverable: Spoken answers to 2 reported Behavioral & Cultural Fit question(s), under time.
07Dry run for Securitas
- Run one full mock under time, then write down the two questions you most want to ask your interviewers.
Deliverable: A completed timed mock and two questions to ask.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
Tell me about a time you had to work with a difficult stakeholder to deliver a technical project.
Tell me about a time you had to work with a difficult stakeholder to deliver a technical project.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Why are you interested in the security industry specifically?
Why are you interested in the security industry specifically?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
How do you handle a situation where a production system goes down outside of standard working hours?
How do you handle a situation where a production system goes down outside of standard working hours?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a project where you had to learn a new technology very quickly.
Describe a project where you had to learn a new technology very quickly.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
- 01
Tell me about a time you had to work with a difficult stakeholder to deliver a technical project.
- 02
Why are you interested in the security industry specifically?
- 03
How do you handle a situation where a production system goes down outside of standard working hours?
- 04
Describe a project where you had to learn a new technology very quickly.
How technical is the interview process for Software Engineers?
The process is moderately technical. While we do test your coding and design skills, we are equally interested in your ability to apply those skills to Securitas' specific business needs, such as tracking and monitoring.
Securitas Software Engineer candidate reports ↗Is there a specific focus on certain programming languages?
While we use a variety of tools, having a strong command of enterprise-level languages like Java or.NET is often beneficial. However, we value general problem-solving ability over specific syntax knowledge.
Securitas Software Engineer candidate reports ↗What is the work culture like for the engineering team?
The culture is often described as casual and laid back but very focused on results. Because we deal with security, there is a high level of individual responsibility and a "get it done right" mentality.
Securitas Software Engineer candidate reports ↗Does this role require travel?
Some roles, particularly those in the United States or global positions, may involve occasional travel to client sites or other Securitas offices to better understand the operational side of our security services.
Securitas Software Engineer candidate reports ↗What topics does Securitas test in interviews?
Securitas interviews most often cover Problem Solving, Technical Skills (General), Communication Skills, Managerial Interviewing, and Business Analysis. The exact emphasis depends on the specific role you apply for.
Securitas Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Securitas Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
Slack Software Engineer Interview Guide
What Slack asks Software Engineer candidates, from reported rounds and questions.
Root Software Engineer Interview Guide
What Root asks Software Engineer candidates, from reported rounds and questions.
Alarm Software Engineer Interview Guide
What Alarm asks Software Engineer candidates, from reported rounds and questions.
Arm Software Engineer Interview Guide
Systems practice for Arm software engineer candidates, weighted toward B2B software and infrastructure work: the load that actually arrives, the failure modes that matter there, and the invariants a partial outage must not break.