As a Software Engineer at Securly, you are at the forefront of building technology that keeps students safe in an increasingly digital world. Your work directly impacts the efficacy of cloud-based web filtering, student safety monitoring, and classroom management tools used by millions of users globally. You will be responsible for building scalable, secure, and performant systems that operate under high-traffic conditions, ensuring that educational institutions can rely on our platforms without interruption. This role requires a blend of deep technical expertise and a mission-driven mindset. You will contribute to complex product architectures, navigate the challenges of real-time data processing, and collaborate with cross-functional teams to translate safety-focused requirements into robust software solutions. It is a critical position that demands not only strong coding proficiency but also a commitment to high-quality engineering standards and architectural integrity.
Technical Screening
reportedInitial assessment to establish baseline proficiency in technical skills.
What to demonstrate
- Initial assessment to establish baseline proficiency in technical skills
- Depth in Data Structures
How to prepare
- Answer aloud and timed: Given an array of integers, find the first non-repeating character.
- Answer aloud and timed: Implement a function to reverse a linked list.
Multiple Technical Rounds
reportedIn-depth evaluation of coding, system design, and architectural thinking.
What to demonstrate
- In-depth evaluation of coding, system design, and architectural thinking
- Depth in Data Structures
How to prepare
- Answer aloud and timed: Optimize a solution for searching in a rotated sorted array.
- Answer aloud and timed: Discuss the time complexity of various sorting algorithms in different scenarios.
Live Coding Sessions
reportedCandidates write, test, and optimize solutions in real-time.
What to demonstrate
- Candidates write, test, and optimize solutions in real-time
- Depth in Data Structures
How to prepare
- Answer aloud and timed: Solve a medium-level problem involving dynamic programming or tree traversal.
- Answer aloud and timed: Explain the difference between
let,const, andvarin JavaScript.
Management or Culture-Fit Rounds
reportedFinal assessment focusing on cultural fit and management alignment.
What to demonstrate
- Final assessment focusing on cultural fit and management alignment
- Depth in Data Structures
How to prepare
- Prepare three examples from your own work, each with a decision you made and an outcome you can quantify.
- Re-read the description of the management or culture-fit rounds above and write down what you would ask to confirm before it.
PracHub editorial advice for the preparation topics above.
Prioritize Optimization
Always look for ways to improve your initial solution. If you provide a naive solution, immediately follow up with how it can be optimized.
Understand the Basics
Do not overlook fundamental concepts like networking (TCP/IP) or compiler theory, as these can appear in technical rounds.
Ask Clarifying Questions
Before diving into a coding problem, ensure you fully understand the constraints. This shows that you think before you act.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Given an array of integers, find the first non-repeating character.
Given an array of integers, find the first non-repeating character.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Implement a function to reverse a linked list.
Implement a function to reverse a linked list.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Optimize a solution for searching in a rotated sorted array.
Optimize a solution for searching in a rotated sorted array.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Discuss the time complexity of various sorting algorithms in different scenarios.
Discuss the time complexity of various sorting algorithms in different scenarios.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Solve a medium-level problem involving dynamic programming or tree traversal.
Solve a medium-level problem involving dynamic programming or tree traversal.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Explain the difference between `let`, `const`, and `var` in JavaScript.
Explain the difference between let, const, and var in JavaScript.
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
Describe how the event loop functions in a browser environment.
Describe how the event loop functions in a browser environment.
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
What are the key principles of OOPS and how do you apply them in your code?
What are the key principles of OOPS and how do you apply them in your code?
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
Explain the difference between TCP and UDP protocols.
Explain the difference between TCP and UDP protocols.
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
How does the garbage collection process work in your preferred language?
How does the garbage collection process work in your preferred language?
Approach
- Say what the runtime actually does before reasoning about the code.
- Name what is shared across threads and what owns each piece of state.
- Identify the window where an invariant is briefly untrue.
- Distinguish a value from a reference to it, and say which one you handed out.
Follow-up
- What happens if two callers reach this at the same time?
- Where could this allocate more than you expect?
Replace offset paging on the resource feed with keyset
resource holds resource_id, tenant_id, owner_user_id, title, body_ref, version, status ('draft','active','archived','deleted'), created_at, updated_at, deleted_at, with an index on (tenant_id, status, updated_at DESC, resource_id DESC). The listing endpoint returns active resources for one tenant, newest update first, 50 per page, today with LIMIT 50 OFFSET n. Tenants reach page 400 and rows are created while they read. Write the keyset query, define what the cursor carries and how it is encoded, and say which part of the index each predicate uses. Assume PostgreSQL 16.
Approach
- Name the two failures separately. OFFSET 20000 makes the server produce and discard 20,000 rows, so page cost grows with depth rather than with page size. Independently, any write that changes how many rows sort above the offset moves the window between two fetches, and the direction decides which anomaly you get: an insert lands at the head of updated_at DESC and pushes already-returned rows down past the boundary, so they are returned a second time; a delete above the offset, or a row whose updated_at is bumped above the cursor, pulls rows up and one is never returned at all. Nothing in the response reveals either.
- Write the seek: WHERE tenant_id = $1 AND status = 'active' AND (updated_at, resource_id) < ($2, $3) ORDER BY updated_at DESC, resource_id DESC LIMIT 50. The row-value comparison is one index range rather than a disjunction, and both columns are NOT NULL, which is what makes that comparison well defined.
- Map each predicate onto the index: tenant_id and status are equality on the leading columns, (updated_at, resource_id) is the range, and the ORDER BY matches the index order so no Sort node appears and the scan stops after 50 rows. The DESC in the definition only matters for mixed directions — a plain ascending btree on the same columns is read backwards for this query.
- Put both sort columns in the cursor and nothing the client can tamper with into another tenant: base64 of (updated_at, resource_id), validated server-side, with tenant_id taken from the principal.
Follow-up
- The client asks for 'jump to page 400'. What do you offer instead, and what does the honest version cost?
- Sort order becomes user-selectable across four columns. How many indexes is that, and which would you refuse to add?
Hold a per-tenant active cap against concurrent creates
A tenant on the standard plan may hold at most 50 resources with status='active'. The create handler runs SELECT count(*) FROM resource WHERE tenant_id = $1 AND status = 'active', compares to 50, then inserts. Two creates arrive 3 ms apart on different instances and the tenant lands at 51. Name the anomaly, say whether PostgreSQL 16 READ COMMITTED or REPEATABLE READ prevents it and why, then give an implementation that holds the cap at READ COMMITTED with the exact statements. Finally, say what changes when the cap is 'at most one running export per tenant' on job_run.
Approach
- Name it: write skew. The two transactions read an overlapping set and write disjoint rows, so there is no row-level conflict for the engine to detect and each commit is individually legal.
- Rule out the levels precisely. READ COMMITTED takes a fresh snapshot per statement and takes no lock on the counted rows, so both see 49. PostgreSQL's REPEATABLE READ is snapshot isolation: it removes non-repeatable reads and phantoms within the snapshot but still admits write skew, because the anomaly is not a re-read of a changed row, it is a read of a set that a concurrent transaction invalidates. Only SERIALIZABLE closes it, by tracking the read dependency and aborting one transaction with SQLSTATE 40001 — a guarantee that exists only if the application re-runs the whole transaction from the read.
- Convert the set predicate into a single-row conflict: keep tenant.active_resource_count and run UPDATE tenant SET active_resource_count = active_resource_count + 1 WHERE tenant_id = $1 AND active_resource_count < 50 in the same transaction as the INSERT. Zero affected rows is the cap, returned as 409. The row lock serialises the decision at any isolation level, and contention is bounded to one tenant's row — which is also the fair-scheduling unit, unlike a global counter that would convoy every tenant behind one row.
- State the cost you just took on: a counter is a second source of truth that can drift, so every path that changes status must adjust it inside the same transaction, and a periodic reconciliation has to exist, with resource_revision as the authority for what the count should have been.
Follow-up
- A resource moves from archived back to active. Which statements change, and what breaks if the counter update and the status change land in different transactions?
- The cap becomes plan-dependent and a plan can change mid-month. Where does the number 50 live, and who reads it?
How would you design a URL shortening service?
How would you design a URL shortening service?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Explain the role of a load balancer in a distributed system.
Explain the role of a load balancer in a distributed system.
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
What are the key considerations when implementing AWS services for a high-traffic application?
What are the key considerations when implementing AWS services for a high-traffic application?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Edge instances grow 400 MB per hour until the nightly restart
Edge API instances start at 700 MB resident and grow about 400 MB/hour; a nightly rolling restart has hidden it for weeks. Growth continues unchanged when request rate halves overnight, p99 degrades in the last hours before an instance is recycled, and heap used immediately after a forced full GC rises monotonically. The service holds no product state. Name the discriminating measurement that separates the plausible causes, give the most likely cause, and give the fix and how you would verify it.
Approach
- Separate resident memory from live heap first, because they fail differently. Resident size can grow from fragmentation, native buffers or thread stacks while the heap is flat; heap used after a full GC rising monotonically is the measurement that says objects are reachable and not being released. You already have it, so this is retention, not fragmentation, and that closes off half the candidate list.
- Use the rate's independence from traffic as the discriminator. Growth that continues at half the request rate rules out per-request objects that are merely slow to collect and points at a structure that grows with distinct values observed rather than with call volume. Write the candidates that have that property: a metrics registry keyed on a high-cardinality label, an unevicted cache, an interner, a per-key lock map.
- Take two heap snapshots an hour apart and diff by retained size, reading the dominator tree, not by allocation count or instance count. Expect one root holding a map with millions of entries, then follow the reference chain to the code that inserts and never removes. Allocation profilers point at churn, which is the wrong signal here.
- The candidate that fits this service is an observability label carrying an identifier, such as a request path recorded before templating so that /v1/resources/48213 becomes its own metric series. That grows with distinct ids seen, is independent of rate, and explains the late p99 degradation, since GC cost rises with the size of the live set.
Follow-up
- Post-GC heap is now flat but resident size still creeps. What are you looking at, and does it matter?
- How would you have detected this before an OOM, given the nightly restart masked the trend?
Built from the rounds and topics Securly candidates report.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Map the Securly loop
- Write out the reported sequence: Technical Screening, Multiple Technical Rounds, Live Coding Sessions, Management or Culture-Fit Rounds.
- For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.
Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.
02Work Data Structures
- Spend the session on Data Structures, which Securly candidates report being tested on.
- Write one worked example in Data Structures and time yourself on it.
Deliverable: One timed worked example in Data Structures.
03Work Algorithms
- Spend the session on Algorithms, which Securly candidates report being tested on.
- Write one worked example in Algorithms and time yourself on it.
Deliverable: One timed worked example in Algorithms.
04Work Problem Solving
- Spend the session on Problem Solving, which Securly candidates report being tested on.
- Write one worked example in Problem Solving and time yourself on it.
Deliverable: One timed worked example in Problem Solving.
05Answer out loud: Data Structures and Algorithms
- Answer aloud, timed: Given an array of integers, find the first non-repeating character.
- Answer aloud, timed: Implement a function to reverse a linked list.
Deliverable: Spoken answers to 2 reported Data Structures and Algorithms question(s), under time.
06Answer out loud: Core Technical & Language Proficiency
- Answer aloud, timed: Explain the difference between `let`, `const`, and `var` in JavaScript.
- Answer aloud, timed: Describe how the event loop functions in a browser environment.
Deliverable: Spoken answers to 2 reported Core Technical & Language Proficiency question(s), under time.
07Answer out loud: System Design & Networking
- Answer aloud, timed: How would you design a URL shortening service?
- Answer aloud, timed: Explain the role of a load balancer in a distributed system.
Deliverable: Spoken answers to 2 reported System Design & Networking question(s), under time.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
How do you handle database indexing to improve query performance?
How do you handle database indexing to improve query performance?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Unblock an engineer without taking the keyboard
A teammate has spent two days on a job handler that occasionally writes duplicate rows. They are certain the queue is delivering twice by mistake. You suspect a lease expiring under a slow handler, so the job is running concurrently with itself. Describe how you have unblocked someone in this position: what you asked before offering a hypothesis, what you showed them rather than told them, and what you left them owning. Then say what you would do if their theory turned out to be the right one.
Approach
- Ask before diagnosing, and ask for things answerable from data they already have: the attempt count on the job rows that produced duplicates, the handler's observed duration against its lease expiry, and whether the duplicate rows share a natural key that a unique constraint could have caught.
- Teach the shape rather than the answer. A lease cannot distinguish a dead worker from a slow one, so a handler that outruns its lease is running twice by design, and deploys deliver the other half by killing handlers mid-run on every rollout. Both of their candidate theories produce identical duplicate rows, which is why the evidence has to come from timings rather than from argument.
- Hand over a checklist they execute: a natural key on every write the handler performs so the second copy collides rather than appends, the record of intent written before any external effect, a lease heartbeat while running, and the metric that shows it working.
- Keep ownership with them deliberately. Pair on the first write, then step back; if you finish it yourself you have closed one ticket and left the same person stuck on the next redelivery.
Follow-up
- How would you distinguish a genuine double-delivery from a lease expiry using only the data already stored?
- Their handler calls an external endpoint before recording that it did. What do you tell them to change first?
Reverse your own decision and price the reversal
Describe a technical decision you made and later reversed. Pick one that cost something: a service you split and merged back, a cache you added and removed, an index you created that pushed the planner onto a worse plan, a projection you rebuilt from scratch. State what you believed when you decided, the measurement that changed your mind, how long the wrong version ran in production, and what the reversal cost in migrations, dual writes, and a deprecation window for callers you did not own.
Approach
- State the original rationale without irony, in the version you would still defend given what was known then. If it is not defensible, the story is about carelessness rather than judgement, and a different example serves you better.
- Give the measurement that moved with a before and after: the p99 that did not improve, the cache hit rate that sat at 40%, the plan that flipped to a sequential scan once the table passed a size you can name.
- Cost the reversal in steps, not adjectives: expand-and-contract deploys, the dual-write window, the callers who had to be notified, the rows already written in the wrong shape that had to be backfilled or abandoned.
- Distinguish reversal from rewrite by naming what you kept. Most good reversals preserve the schema or the interface and undo one decision inside it, which is also why they were affordable.
Follow-up
- What in that decision was irreversible, and did you know it was irreversible when you made it?
- How did you tell the people who had already built on top of the original decision?
- 01
How do you handle database indexing to improve query performance?
- 02
A teammate has spent two days on a job handler that occasionally writes duplicate rows. They are certain the queue is delivering twice by mistake. You suspect a lease expiring under a slow handler, so the job is running concurrently with itself. Describe how you have unblocked someone in this position: what you asked before offering a hypothesis, what you showed them rather than told them, and what you left them owning. Then say what you would do if their theory turned out to be the right one.
- 03
Describe a technical decision you made and later reversed. Pick one that cost something: a service you split and merged back, a cache you added and removed, an index you created that pushed the planner onto a worse plan, a projection you rebuilt from scratch. State what you believed when you decided, the measurement that changed your mind, how long the wrong version ran in production, and what the reversal cost in migrations, dual writes, and a deprecation window for callers you did not own.
How should I prepare for the coding rounds?
Focus on mastering data structures and common algorithms. Practice solving problems on a whiteboard or a shared editor, and always practice thinking out loud while you code.
Securly Software Engineer candidate reports ↗Is there a focus on specific frameworks?
While we test for core language proficiency (e.g., JavaScript), we expect you to be comfortable discussing the frameworks you have used in your professional experience.
Securly Software Engineer candidate reports ↗What is the company culture like?
We value direct communication, technical rigor, and a mission-focused mindset. We look for engineers who are eager to learn and willing to contribute to a collaborative, fast-paced environment.
Securly Software Engineer candidate reports ↗What should I do if I get stuck on a problem?
Don't panic. Communicate your thought process to the interviewer. Often, the interviewer is looking to see how you handle ambiguity and whether you can collaborate to find a solution.
Securly Software Engineer candidate reports ↗What topics does Securly test in interviews?
Securly interviews most often cover Data Structures, Technical Product Support, Sales Development (SDR) Processes, Algorithms, and Business Development. The exact emphasis depends on the specific role you apply for.
Securly Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Securly Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
Netcore Software Engineer Interview Guide
What Netcore asks Software Engineer candidates, from reported rounds and questions.
Robinhood Software Engineer Interview Guide
Testing exercises for Robinhood software engineer prep: choosing boundary cases over repetition, isolating tests from shared clock and ordering, and treating an intermittent failure as a defect rather than noise.
Braze Software Engineer Interview Guide
Concurrency exercises for Braze candidates: check-then-act races, deadlock from inconsistent lock ordering, and why two individually atomic operations do not compose into an atomic update.
Zynga Software Engineer Interview Guide
Data structures and algorithms practice for Zynga candidates, where stating a bound means stating its precondition: constant-time hash lookup is an average case over keys that spread.