A Software Engineer at Semgrep plays a pivotal role in advancing the company's core mission: making it expensive to exploit software. At its heart, Semgrep is a developer-first application security platform designed to deliver industry-leading code, dependency, and secrets scanning. Unlike traditional security tools that slow down development cycles, Semgrep is built to seamlessly integrate into the developer workflow, catching vulnerabilities early and helping teams fix them faster. In this role, you will contribute directly to products that analyze codebases at massive scale. This involves solving complex problems around static analysis, parsing, program analysis, and software composition analysis (SCA). Your work will help developers cut through the noise of security alerts by focusing on the small percentage of vulnerabilities that are actually reachable given how dependencies are used. As a Software Engineer, you will collaborate closely with product managers, security researchers, and designers to build robust, highly performant, and developer-friendly tools. You will work on engineering challenges where performance, accuracy, and usability intersect, ensuring that security scanners remain blazingly fast while providing highly actionable insights to engineering teams globally.
Recruiter Phone Screen
reportedInitial call to discuss your background, motivation for joining Semgrep, and career goals.
What to demonstrate
- Initial call to discuss your background, motivation for joining Semgrep, and career goals
- Depth in Software Composition Analysis (SCA)
How to prepare
- Be able to walk your CV end to end in two minutes, and say why this company specifically.
- Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.
Technical Screening
reportedIncludes a practical coding challenge or a custom programming exercise.
What to demonstrate
- Includes a practical coding challenge or a custom programming exercise
- Depth in Software Composition Analysis (SCA)
How to prepare
- Answer aloud and timed: Design and write a custom parser or utility in Python to process and validate structured configuration files.
- Answer aloud and timed: Implement a rate-limiter or a basic caching mechanism to optimize network calls.
Remote Onsite Interviews
reportedSeries of interviews covering system design, project planning, code reviews, and behavioral discussions.
What to demonstrate
- Series of interviews covering system design, project planning, code reviews, and behavioral discussions
- Depth in Software Composition Analysis (SCA)
How to prepare
- Answer aloud and timed: Walk through a design discussion for a developer-facing tool, outlining API structures, database schemas, and integration points.
- Answer aloud and timed: How would you plan and break down the development of a new feature for a static analysis platform into iterative, shippable milestones?
PracHub editorial advice for the preparation topics above.
Focus on working code
During coding rounds, prioritize getting a functional solution working before optimizing. The interviewers value working software and practical problem-solving over premature optimization.
Semgrep values practical engineering
Focus your preparation on writing clean, functional code that handles real-world scenarios rather than memorizing complex algorithmic puzzles.
Communicate your thought process
Treat the interview as a collaborative pairing session. Talk through your design decisions, explain your trade-offs, and ask clarifying questions early.
Show empathy for the developer
Remember that Semgrep builds tools for developers. Whenever you design an API, write code, or discuss a feature, keep the end-user developer's experience in mind.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Write a program that models a state machine, such as a vending machine, managing state transitions, inputs, an
Write a program that models a state machine, such as a vending machine, managing state transitions, inputs, and error conditions.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Implement a rate-limiter or a basic caching mechanism to optimize network calls.
Implement a rate-limiter or a basic caching mechanism to optimize network calls.
Approach
- Restate the input: its shape, its size, and what is guaranteed about it.
- Name the brute-force solution and its complexity before improving on it.
- Choose the data structure from the access pattern, not from familiarity.
- State the target complexity and say which constraint rules the naive version out.
Follow-up
- How does this change if the input no longer fits in memory?
- What is the worst case, and how likely is it on real data?
Archive a resource graph without breaking live references or recursing
Resources reference other resources within a tenant; for the largest tenant the reference table holds up to 2,000,000 nodes and 8,000,000 edges. Archiving a resource must archive everything reachable from it that nothing outside the set still references, refuse when a live external referrer exists, and terminate when references form cycles, which they legitimately do. Produce the archive order and the refusal list, targeting O(V+E). Say what stops the traversal crossing a tenant boundary, and why recursion is the wrong control structure at this size.
Approach
- Load the subgraph with the tenant predicate on both endpoints of the edge, not only on the side you started from. Scoping the left table alone is the classic cross-tenant leak: one mis-entered edge then pulls another tenant's resources into the traversal and, worse, into the archive.
- Traverse iteratively with an explicit stack. A 2,000,000-node graph can hold a chain deep enough to exhaust a native stack in the low tens of thousands of frames, and that failure is a process crash rather than an error you can return.
- Treat cycles as data rather than corruption: compute strongly connected components with Tarjan in O(V+E) using its own explicit stack, then condense. The condensation is a DAG, so a topological order over it gives the archive order, and every member of a component archives in one transaction because no order within a cycle is valid.
- Decide refusals with reverse edges. A candidate is archivable only if every in-edge originates inside the candidate set, so build the transpose or count in-degrees restricted to the visited set, and emit each blocked resource with the id of the external referrer, which is the only part of the answer an operator can act on.
Follow-up
- The graph is read in one query and the archive writes a minute later. What can change in between, and how do you make the write safe?
- The candidate set is 400,000 resources. Is that one transaction, and if not, what does a half-finished archive look like to a reader?
Denormalise tenant onto revisions and backfill it live
resource_revision (revision_id, resource_id, version, actor_user_id, change_kind, patch, request_id, created_at) has 400M rows and no tenant column; tenant_id lives only on resource. Two reads need it: a tenant-scoped audit feed ordered by created_at DESC, and an offboarding purge. Both join back to resource today. Justify adding tenant_id to resource_revision against those two reads, name the anomaly the copy introduces and the constraint that prevents it, then give the ordered migration for a live table taking 1.2k writes/second — the lock each step takes, how the backfill is batched, and where each step stops being reversible. PostgreSQL 16.
Approach
- Justify from the access path rather than from taste. Without the column, the audit feed either scans resource_revision by created_at and discards other tenants' rows, or resolves the tenant's resource_ids first and probes with them — both proportional to the tenant's whole history rather than to one page. With (tenant_id, created_at DESC, revision_id DESC) it is a seek that stops at 50 rows, and the purge becomes a ranged delete instead of a join.
- Name the cost exactly: a second copy of a fact can disagree with the first. Make the disagreement unwritable rather than documented — add UNIQUE (resource_id, tenant_id) on resource so it can serve as a foreign-key target, then FOREIGN KEY (resource_id, tenant_id) REFERENCES resource (resource_id, tenant_id) on the revision table. A revision can then only ever carry its parent's tenant.
- Step one, expand: ALTER TABLE resource_revision ADD COLUMN tenant_id BIGINT NULL, with no default, so it is a catalogue change and no rewrite. It still needs ACCESS EXCLUSIVE for an instant, and that instant queues behind the longest open transaction on the table while every later query queues behind it — set lock_timeout to 2s and retry rather than wait.
- Step two, dual-write: deploy the writer that populates tenant_id on every new revision while reads still use the join. Reversible by redeploying the previous build, because nothing reads the column yet.
Follow-up
- The backfill is half finished and a rollback is required. What state is the table in, and what does the previous build do with a half-populated column?
- How do you verify the backfill actually finished, given rows are still being inserted while it runs?
Keep soft-deleted accounts from blocking re-registration
app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.
Approach
- Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
- Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
- For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
- State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.
Follow-up
- A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
- How do you honour an erasure request while resource_revision.actor_user_id still references this table?
Implement a script or service that makes HTTP requests to an external API, parses the JSON payload, and filter
Implement a script or service that makes HTTP requests to an external API, parses the JSON payload, and filters the results based on specific business logic.
Approach
- Say who the caller is and what they do when the call fails halfway.
- Define the identity of a request so a retry cannot double-apply it.
- Separate accepted, pending, failed and confirmed; they are different facts.
- Design the error taxonomy before the success shape; callers branch on it.
Follow-up
- What happens if the caller retries after a timeout?
- How does a client discover it is on an old version of this contract?
Design and write a custom parser or utility in Python to process and validate structured configuration files.
Design and write a custom parser or utility in Python to process and validate structured configuration files.
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Walk through a design discussion for a developer-facing tool, outlining API structures, database schemas, and
Walk through a design discussion for a developer-facing tool, outlining API structures, database schemas, and integration points.
Approach
- Say who the caller is and what they do when the call fails halfway.
- Define the identity of a request so a retry cannot double-apply it.
- Separate accepted, pending, failed and confirmed; they are different facts.
- Design the error taxonomy before the success shape; callers branch on it.
Follow-up
- What happens if the caller retries after a timeout?
- How does a client discover it is on an old version of this contract?
How would you plan and break down the development of a new feature for a static analysis platform into iterati
How would you plan and break down the development of a new feature for a static analysis platform into iterative, shippable milestones?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Design a scalable pipeline to ingest, process, and store dependency vulnerability data from multiple external
Design a scalable pipeline to ingest, process, and store dependency vulnerability data from multiple external feeds.
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Discuss how you would balance addressing technical debt with delivering new user-facing features on a tight sc
Discuss how you would balance addressing technical debt with delivering new user-facing features on a tight schedule.
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Read latency spikes on a sixty-second sawtooth
The cached listing read path serves about 14k reads/second at an 85% hit rate. p99 sits at 35 ms for 57 seconds, jumps to 900 ms for 3, and repeats. During each spike the primary shows several hundred identical listing queries starting within the same millisecond, all carrying one large tenant's id. Cache entries use a 60-second TTL. Give the mechanism, the ordered checks, the fix, and the correctness hazard your fix must not introduce.
Approach
- Match the period to a configured number before theorising about load. A spike every 60 seconds against a 60-second TTL is an entry expiring, and you confirm it by correlating spike timestamps with the entry's write time rather than with the traffic curve. If the period had matched a cron or a GC interval instead, this is a different investigation.
- Establish the concurrency of the miss. Several hundred identical queries in one millisecond means the miss path has no coalescing: every request that arrives between expiry and repopulation recomputes. The herd size is that key's arrival rate times its recompute time, so at 1.2k reads/second for the hot key and a 250 ms recompute you expect about 300 concurrent misses, which matches what is observed.
- Add single-flight on the miss path so one caller per key recomputes under a short-lived lock while the rest wait for its result. Prefer stale-while-revalidate where the read tolerates it: return the expired value immediately and refresh asynchronously, which removes the latency spike rather than serialising it into a queue of waiters.
- De-synchronise the keys. Write TTLs with jitter, for example 60 seconds plus or minus 10%, so a deploy or a mass invalidation does not align every key on the same second and turn a per-key herd into a fleet-wide one.
Follow-up
- The same sawtooth appears on a key that is invalidated on write rather than expired. Is that the same bug?
- How does your answer change if the recompute takes 4 seconds instead of 250 ms?
Built from the rounds and topics Semgrep candidates report.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Map the Semgrep loop
- Write out the reported sequence: Recruiter Phone Screen, Technical Screening, Remote Onsite Interviews.
- For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.
Deliverable: A one-page map of the 3 reported rounds, with the weakest marked.
02Work Software Composition Analysis (SCA)
- Spend the session on Software Composition Analysis (SCA), which Semgrep candidates report being tested on.
- Write one worked example in Software Composition Analysis (SCA) and time yourself on it.
Deliverable: One timed worked example in Software Composition Analysis (SCA).
03Work Software Engineering Leadership
- Spend the session on Software Engineering Leadership, which Semgrep candidates report being tested on.
- Write one worked example in Software Engineering Leadership and time yourself on it.
Deliverable: One timed worked example in Software Engineering Leadership.
04Work Supply Chain Security
- Spend the session on Supply Chain Security, which Semgrep candidates report being tested on.
- Write one worked example in Supply Chain Security and time yourself on it.
Deliverable: One timed worked example in Supply Chain Security.
05Answer out loud: Practical Coding & Implementation
- Answer aloud, timed: Write a program that models a state machine, such as a vending machine, managing state transitions, inputs, and error conditions.
- Answer aloud, timed: Implement a script or service that makes HTTP requests to an external API, parses the JSON payload, and filters the results based on specific business logic.
Deliverable: Spoken answers to 2 reported Practical Coding & Implementation question(s), under time.
06Answer out loud: System Design & Project Planning
- Answer aloud, timed: Walk through a design discussion for a developer-facing tool, outlining API structures, database schemas, and integration points.
- Answer aloud, timed: How would you plan and break down the development of a new feature for a static analysis platform into iterative, shippable milestones?
Deliverable: Spoken answers to 2 reported System Design & Project Planning question(s), under time.
07Answer out loud: Behavioral & Cultural Alignment
- Answer aloud, timed: Why do you want to work at Semgrep, and what excites you about developer tooling and application security?
- Answer aloud, timed: Describe a time when you had to deliver constructive feedback during a code review. How did you handle it, and what was the outcome?
Deliverable: Spoken answers to 2 reported Behavioral & Cultural Alignment question(s), under time.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
Why do you want to work at Semgrep, and what excites you about developer tooling and application security?
Why do you want to work at Semgrep, and what excites you about developer tooling and application security?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a time when you had to deliver constructive feedback during a code review. How did you handle it, and
Describe a time when you had to deliver constructive feedback during a code review. How did you handle it, and what was the outcome?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Talk about a project where you had to make a technical compromise to meet a deadline. How did you decide what
Talk about a project where you had to make a technical compromise to meet a deadline. How did you decide what to sacrifice?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
How do you handle ambiguous requirements when starting a new technical initiative?
How do you handle ambiguous requirements when starting a new technical initiative?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
- 01
Why do you want to work at Semgrep, and what excites you about developer tooling and application security?
- 02
Describe a time when you had to deliver constructive feedback during a code review. How did you handle it, and what was the outcome?
- 03
Talk about a project where you had to make a technical compromise to meet a deadline. How did you decide what to sacrifice?
- 04
How do you handle ambiguous requirements when starting a new technical initiative?
What programming languages are used during the technical interviews?
You can generally use the programming language you are most comfortable with, though Python is highly recommended for practical scripting and coding tasks due to its readability and standard library capabilities.
Semgrep Software Engineer candidate reports ↗How does Semgrep evaluate system design?
System design at Semgrep is highly collaborative and focused on practical planning. Rather than just drawing architecture diagrams, you will discuss how to break down a project into iterative milestones, manage technical quality, and incorporate customer feedback.
Semgrep Software Engineer candidate reports ↗Is prior security industry experience required?
No, prior security experience is not strictly required, though a strong interest in security and developer tooling is highly valued. The team welcomes engineers with diverse technical backgrounds who are eager to learn.
Semgrep Software Engineer candidate reports ↗What is the company's policy on remote work?
Semgrep supports hybrid and remote working arrangements, depending on the specific team and location. Many roles are open to remote candidates within certain states in the US, with offices in hubs like San Francisco.
Semgrep Software Engineer candidate reports ↗What topics does Semgrep test in interviews?
Semgrep interviews most often cover Software Composition Analysis (SCA), Software Engineering Leadership, Supply Chain Security, Static Analysis, and Vulnerability Reachability Analysis. The exact emphasis depends on the specific role you apply for.
Semgrep Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Semgrep Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
Scale Ai Software Engineer Interview Guide
Data structures and algorithms practice for Scale Ai candidates, where stating a bound means stating its precondition: constant-time hash lookup is an average case over keys that spread.
CoreWeave Software Engineer Interview Guide
Failure-handling practice for CoreWeave software engineer candidates: requests whose outcome a timeout leaves unknown, where a retry is safe, and deduplicating at the receiver instead of assuming exactly-once delivery.
Harvey Software Engineer Interview Questions & Guide 2026
Prepare for the software engineer interview at Harvey with original coding, system design and debugging exercises, each paired with a worked solution and the reasoning behind it.
Western Alliance Bank Software Engineer Interview Guide
What Western Alliance Bank asks Software Engineer candidates, from reported rounds and questions.