Founding engineer role-specific interview questions

As asked

You used an AI coding agent to build a settings page and API route in a day. What checks do you perform before you ship it?

Sample answer outline

The candidate should treat AI output as untrusted code that can still be useful. Run the app, read the diff, check data flow, auth, validation, loading states, empty states, errors, accessibility, and telemetry. Tests should cover the contract between UI and API, plus the riskiest edge cases the agent may have missed. Strong answers mention dependency review, secret handling, permission boundaries, and manual product review against the intended user workflow. The main tripwire is shipping because the page looks right once, without understanding what was generated.

Expect these follow-ups

• What kinds of bugs do coding agents most often introduce?
• How do you keep velocity without turning review into a full rewrite?
• What would make you throw away the generated code?

As asked

You are the first engineer at a startup. The CEO wants a web app, a mobile app, and a public API all shipped within three months. Walk me through how you decide between a monorepo and a polyrepo, and what that choice costs you later when you hire your second and third engineer.

Sample answer outline

A strong answer weighs DX iteration speed (shared types, atomic commits) against tooling overhead at tiny team size, picks a concrete tool like Turborepo or Nx only if justified, and acknowledges the real cost: onboarding friction and CI complexity when headcount grows. Candidate should name which workspace structure they would actually use and why.

Expect these follow-ups

• What is the first thing that breaks about that decision at ten engineers?
• How do you share authentication logic between the web and mobile targets without duplicating it?

As asked

It is your first week. There is no CI. Deployments are manual. You have three weeks before the first external demo. What CI/CD pipeline do you stand up, what do you skip, and what do you intentionally leave as a manual step for now?

Sample answer outline

Candidate should propose lightweight GitHub Actions or similar, prioritize fast feedback (lint, type-check, unit tests on PR) over comprehensive coverage, and pick a single deploy target. The explicit tradeoff question is key: a strong answer names what they leave manual (e2e tests, database migrations, staging promotion) and why, with a concrete plan to automate it later.

Expect these follow-ups

• How do you handle a database migration that is part of the same deploy as an API change?
• What is the first test you write for a codebase that currently has none?

As asked

You launched two weeks ago. You have no monitoring, no alerting, and no dashboards. A user just reported that the app was down for forty-five minutes and you had no idea. What do you set up this week, and what do you defer?

Sample answer outline

Answer should cover the three pillars in priority order: structured logging to a hosted sink (Datadog, Logtail, Grafana Cloud), uptime alerting (uptime-robot or similar), and error tracking (Sentry). Candidate should explicitly defer distributed tracing until there are multiple services and defer custom metrics until they know what to measure.

Expect these follow-ups

• How do you decide what log level to assign to a given log line?
• Your error tracker shows 200 events per day. How do you triage which ones matter?

As asked

You have database credentials, third-party API keys, and a Stripe secret in your app. Right now they live in a .env file on one engineer's laptop. Walk me through how you fix this, what tools you use, and what you defer until you have five engineers.

Sample answer outline

Immediate fix: move secrets to a hosted secret store (AWS Secrets Manager, Doppler, or Infisical) with team access, inject into CI environment variables, never commit .env to git. Candidate should note that rotating a leaked key is the recovery procedure and should be practiced before it is needed. Deferred: Vault, hardware HSMs, per-service IAM roles.

Expect these follow-ups

• A .env file with real credentials was committed to the repo six months ago. What do you do right now?
• How do you give a new engineer access to development credentials without emailing them a password?

As asked

The CEO wants three new features by end of month. Your codebase has a critical security library that is two major versions behind and a data model that makes every new feature three times harder than it should be. How do you make the prioritisation call and communicate it?

Sample answer outline

Strong answer separates the two concerns: the security update is not debt negotiation, it is risk mitigation and should be non-negotiable. The data model refactor requires a cost/benefit conversation with the CEO using concrete estimates (this adds two days to every feature versus one week to fix now). Candidate should know how to frame tech debt in business language without using the term 'tech debt'.

Expect these follow-ups

• The CEO agrees to one week for the refactor but says the feature deadline is firm. What do you do?
• How do you track tech debt items so they do not disappear into a backlog never to be seen again?

As asked

Your team ships at least three times a week. You have no tests right now. Walk me through the testing pyramid you would implement, what you write first, and what you explicitly decide not to automate.

Sample answer outline

Start with integration tests on the API layer (not unit tests on pure functions) because they catch real regressions without over-specifying implementation. Add a small set of browser-level smoke tests for the critical user path (sign up, core action, payment). Explicitly defer full e2e coverage, visual regression, and unit tests on internal utilities until the product stabilises. Candidate should explain why unit tests on unstable code have a negative ROI.

Expect these follow-ups

• What is the difference between a unit test and an integration test in the context of a Next.js API route?
• Your integration test suite takes eight minutes. How do you speed it up?

As asked

Thirty minutes before a live demo to your five most important prospects, you discover a bug that causes the core feature to fail for about 20% of users. You cannot fix it in time. What do you do?

Sample answer outline

Strong answers immediately inform the CEO and sales lead so they are not blindsided, evaluate whether a workaround (use a known-good demo account) is available, and decide whether to demo at all or reschedule. The key behavior is proactive communication upward, not heroic solo firefighting. Candidate should also describe what they do in the hour after the demo to prioritize the fix.

Expect these follow-ups

• The CEO says proceed with the demo and do not tell the prospects. Do you comply?
• How do you ensure you have a reliable demo environment in the future?

As asked

The CEO wants a feature that would take your team three weeks to build. A SaaS vendor offers the same functionality for $500 per month. You have two engineers and three months until your Series A. What is your decision framework?

Sample answer outline

Factors in the decision: is this feature core to your competitive advantage (if yes, build; if no, buy), what is the integration cost of the vendor (three weeks to build might still be less total effort than a fragile integration), what is the risk if the vendor disappears or raises prices. Pre-Series A with a tight timeline, the default should be buy unless the feature is core IP. Strong answers quantify the build vs buy trade-off rather than making it a values statement.

Expect these follow-ups

• The CEO says the vendor is a competitor and using them would be embarrassing in a pitch. How do you respond?
• You bought the vendor solution and it breaks at 2x your current scale. When do you build your own?

As asked

Your team wants to ship code behind flags so sales can demo unreleased features and you can do gradual rollouts. Walk me through whether you build a simple flag system in your own database or pay for LaunchDarkly, and what the implementation looks like at the code level.

Sample answer outline

A strong answer distinguishes flag types (boolean on/off, percentage rollout, user-segment targeting) and scales the complexity to team size. At five engineers, a flags table in Postgres with a thin SDK wrapper is often faster and cheaper than LaunchDarkly. Candidate should cover flag evaluation in the API layer not the frontend, stale flag cleanup, and the risk of flag debt.

Expect these follow-ups

• How do you prevent flag proliferation from making the codebase unreadable?
• A flag controls a database schema change. How do you safely remove it after the migration is complete?

As asked

Your Node.js app Docker image is 1.8 GB and deployments take twelve minutes. Walk me through a concrete sequence of changes to bring the image size below 200 MB without breaking anything.

Sample answer outline

Multi-stage build is the primary lever: build stage installs all deps and compiles TypeScript, production stage copies only node_modules/dist onto a slim or alpine base. Candidate should cover .dockerignore to exclude node_modules and .git from context, npm ci --omit=dev to skip devDependencies in the final stage, and the risk of alpine musl libc incompatibility with certain native binaries.

Expect these follow-ups

• Your alpine-based image breaks in production because a dependency needs glibc. How do you fix that without going back to Debian full?
• How do you cache npm install in a multi-stage Docker build so that unchanged dependencies do not reinstall every time?

As asked

The CEO asks you to hire your first junior-to-mid engineer. You have one week to write the job spec, run interviews, and make a hire. Walk me through what you prioritize in the spec, how you structure the interview, and what makes someone a no-hire even if their code is strong.

Sample answer outline

Strong answer focuses the spec on tangible outcomes rather than a laundry list of technologies, structures the interview to include a take-home or pairing exercise that mirrors real work (not LeetCode), and identifies cultural red flags: unwillingness to do tasks outside the job title, inability to work without clear specs, and poor communication under ambiguity. A no-hire for strong code but bad communication is correct for an early-stage role.

Expect these follow-ups

• How do you onboard an engineer when there is no documentation and you are too busy to babysit?
• Three weeks in, the new hire is consistently missing small but important details. How do you handle it?

As asked

You run a migration script in a terminal and realize two seconds later that you targeted production instead of staging. You have just deleted 50,000 rows of customer data. What do you do in the next 10 minutes?

Sample answer outline

Immediately stop any running processes that might overwrite backup state. Check if point-in-time recovery (PITR) is enabled on the database and what the last backup timestamp is. Notify the team and assess customer impact scope. Do not attempt a fix without a second set of eyes. Restore from backup in staging first to validate the recovery, then in production. Strong candidates know the difference between WAL-based PITR and nightly snapshots.

Expect these follow-ups

• PITR is not enabled and the last backup is from last night. What do you do?
• How do you prevent this from ever happening again?

As asked

Your technical co-founder comes to you and says the current Node.js and Postgres stack is 'embarrassing' and wants to rewrite everything in Rust before the next funding round because investors will ask about it. What do you do?

Sample answer outline

Strong candidates do not immediately agree or flatly refuse. They ask what the actual problem is (performance? hiring? pride?) and address that specifically. They note that investors fund teams and traction, not tech stacks. If performance is a real concern, they offer to profile and identify the actual bottleneck. They propose the smallest thing that solves the real problem, not a rewrite.

Expect these follow-ups

• The co-founder is also your direct manager. Does that change your approach?
• Suppose an investor did ask about the stack in a due diligence call. How would you answer?

As asked

You assigned a feature to one engineer. While they were building it, another engineer assumed it was unowned and also built it. Both implementations are now in separate branches. How do you handle this?

Sample answer outline

This is a process and communication failure, not a blame event. Candidate should evaluate both implementations on merit before deciding which to keep, handle the conversation with the engineer whose work gets dropped with care and explicit acknowledgment of their effort, and fix the underlying process (ticket ownership, daily standups, or a shared board).

Expect these follow-ups

• The engineer whose code you did not ship is visibly frustrated. How do you handle that?
• What process change prevents this from happening again in a five-person team?

As asked

While reviewing code, you find a SQL injection vulnerability in a three-year-old endpoint that has been in production and was written before you joined. There is no evidence of exploitation. What do you do?

Sample answer outline

Immediate: assess exploitability (is the parameter user-controlled from an authenticated or unauthenticated endpoint), check logs for exploit patterns, and determine if a WAF rule can provide temporary protection while a fix is prepared. Fix: parameterized queries, deploy within hours not days. Disclosure: internal notification to CEO and legal, assess whether customer notification is legally required based on jurisdiction and data accessed.

Expect these follow-ups

• You find evidence that the endpoint was hit with injection attempts but no data was returned. Do you notify customers?
• How do you audit the rest of the codebase for similar vulnerabilities without stopping all feature work?

As asked

Your biggest prospective customer will only sign if you build a custom Salesforce integration within four weeks. It is a $200k ACV deal. You are three sprints into a core product roadmap. What do you do?

Sample answer outline

This is a classic early-stage founder-engineer tension. Candidate should quantify the roadmap cost (what gets pushed, what that means for other deals), assess whether the integration is reusable for other customers or truly custom, and raise the conversation to the CEO with a clear cost/benefit framing. If they build it, they should negotiate for a deployment timeline buffer and scope limits. Strong candidates also raise the question of whether this customer's needs are representative of the target market.

Expect these follow-ups

• You build the integration in four weeks, the customer signs, and three months later wants three more custom features. How do you handle it?
• How do you prevent integration debt from accumulating across many enterprise customers?

As asked

AWS us-east-1 goes down and your entire product is hosted there. You have paying customers who are locked out. You are the only engineer online. Walk me through your decisions and actions in real time.

Sample answer outline

First ten minutes: confirm the scope (is it a full region outage or a service-specific issue), check the AWS health dashboard, and update the status page so customers see something. Do not attempt heroic multi-region failover in a panic if you have no prior multi-region setup. Communicate an honest ETA and keep updating every 15-30 minutes. Post-incident: evaluate whether multi-region is worth the operational cost given your SLA.

Expect these follow-ups

• How do you communicate to customers who are angrily messaging support?
• What is the minimum viable multi-region setup and at what company size does it make sense?