Security engineer system design interview questions

As asked

Design a secrets rotation system that automatically rotates database passwords, API keys, and TLS certificates for a platform with 50 microservices, each potentially running multiple instances. The rotation must be zero-downtime and auditable.

Sample answer outline

A strong answer uses HashiCorp Vault as the secrets source of truth with dynamic secrets for databases (Vault generates short-lived credentials per service on demand), a sidecar pattern to deliver secrets to pods without storing them in environment variables, a rotation orchestrator that coordinates dual-write windows for API keys (both old and new keys valid simultaneously), and certificate automation via Vault PKI or cert-manager with ACME. Audit events from Vault are streamed to the SIEM.

Expect these follow-ups

• How would you handle a service that stores its database password in a config file on disk rather than reading from Vault at runtime?

As asked

Design a single sign-on system for a SaaS product that supports SAML 2.0 and OIDC federation with enterprise customers, enforces MFA at both the IdP and application level, and handles session invalidation when a user is deprovisioned in the customer's IdP.

Sample answer outline

A strong answer covers supporting both SAML 2.0 SP-initiated and OIDC authorization code with PKCE flows, mapping external IdP identities to internal user IDs with a federation table, requesting the acr claim or AuthnContextClassRef to enforce MFA at the IdP, and maintaining short-lived sessions (8-hour maximum) with a refresh path that re-verifies IdP session status. SCIM provisioning or SAML JIT handles user lifecycle, and webhook or polling of IdP revocation endpoints handles immediate deprovisioning.

Expect these follow-ups

• How do you handle a customer whose IdP does not support SCIM for deprovisioning?

As asked

Design a vulnerability management program for a 200-engineer company with a mix of cloud infrastructure, containerized microservices, and legacy on-premise applications. How do you discover, prioritize, track, and remediate vulnerabilities at scale?

Sample answer outline

A strong answer covers continuous discovery via cloud asset inventory (AWS Security Hub, Orca), container image scanning in CI (Trivy), agent-based host scanning (Qualys, Tenable), and DAST for web applications. Prioritization uses CVSS adjusted by reachability, asset criticality, and exploit maturity (EPSS score), resulting in SLA tiers (e.g. Critical: 24h, High: 7d, Medium: 30d). Tracking uses Jira tickets linked to findings, with weekly aging reports to engineering managers and executive metrics on mean-time-to-remediation per severity.

Expect these follow-ups

• How do you handle a legacy application that cannot be patched without a major rewrite?

As asked

Design the security controls for an API gateway that handles requests containing personally identifiable information for a financial services application. Include authentication, authorization, rate limiting, logging, and data handling requirements.

Sample answer outline

A strong answer includes mTLS between internal services, JWT validation at the gateway with short-lived tokens, OAuth 2.0 scopes mapped to OPA policies for per-endpoint authorization, per-client and per-endpoint rate limiting in Redis, request/response logging with PII fields masked or tokenized before writing to log storage, and TLS termination at the gateway with re-encryption internally. The candidate should discuss field-level encryption for PII at rest and the key management hierarchy for that.

Expect these follow-ups

• How would you implement field-level masking in logs without breaking the ability to correlate requests across services for debugging?

As asked

Design a system that detects anomalous behavior from user accounts, such as impossible travel, credential sharing, and insider threat indicators, using authentication logs, VPN data, and SaaS API logs. How do you build baselines and reduce alert fatigue?

Sample answer outline

A strong answer builds per-user behavioral baselines over 30-day rolling windows (typical login times, locations, ASNs, device fingerprints), uses GeoIP to detect impossible travel (two logins from locations physically impossible within the time gap), flags concurrent sessions from different countries, and scores insider threat indicators (large download volumes, unusual access patterns outside business hours) using an anomaly scoring model. Alerts are suppressed for known travel by cross-referencing calendar or VPN data, and analysts tune per-user exceptions.

Expect these follow-ups

• How would you handle the privacy and legal implications of behavioral monitoring for insider threat detection?

As asked

Design a CSPM system that continuously evaluates the security posture of AWS and GCP accounts across a company with 200 AWS accounts and 50 GCP projects. How do you aggregate findings, prioritize them, and drive remediation without creating alert fatigue?

Sample answer outline

A strong answer uses AWS Security Hub and GCP Security Command Center as native data sources, aggregates into a central normalization layer that maps findings to a common severity model, deduplicates cross-account findings for shared infrastructure, and maps each finding to the team responsible via a CMDB or tagging policy. Auto-remediation via Lambda/Cloud Functions handles well-understood low-risk findings (e.g. enabling S3 bucket versioning) while high-severity findings create Jira tickets with owner routing. Weekly posture scores per team drive accountability.

Expect these follow-ups

• How would you enforce a baseline security policy (e.g. MFA required for all IAM users) across 200 accounts using SCPs and policy-as-code?

As asked

A company has flat network access between office, cloud, and production systems. How would you redesign segmentation using zero-trust principles?

Sample answer outline

Start by inventorying assets, data sensitivity, traffic flows, and identities before drawing new subnet boundaries. Segment by trust level and service purpose, then enforce access with identity-aware proxies, mutual TLS, security groups, firewall policies, and just-in-time admin access. Prefer explicit allow-lists based on service identity over broad IP ranges where the platform supports it. Roll out in observe mode first so legitimate flows are discovered and owners can fix dependencies. The best answers balance security with operability and include logging for denied flows.

Expect these follow-ups

• Where do VPNs fit in a zero-trust design?
• How do you avoid breaking batch jobs that use undocumented network paths?
• What is the difference between segmentation and microsegmentation?

As asked

Design a security alerting pipeline that ingests 100k events per second from network sensors, EDR agents, and cloud audit logs, correlates them in real time to generate alerts, and delivers them to analysts with enough context to triage quickly.

Sample answer outline

A strong answer streams raw events through Kafka by source type, runs stateful correlation in Flink or Spark Streaming using sliding-window aggregations and enrichment joins against asset and identity data, writes alerts to a PostgreSQL or Elasticsearch alert store, and surfaces them in a SOAR platform with pre-fetched context (user history, asset criticality, related events). The candidate should discuss tiered storage for raw event retention, deduplication logic for repeated alerts, and SLA monitoring for alert delivery latency.

Expect these follow-ups

• How would you handle backpressure when a DDoS event generates 10x the normal event rate?

As asked

Design an internal platform for tracking penetration test findings across all of a company's products over multiple years. It needs to track remediation status, verify fixes, detect regressions, and report trends to the CISO.

Sample answer outline

A strong answer covers a data model with findings linked to assets, CVE/CWE references, severity, affected version, and remediation deadline, a state machine (open, in-remediation, remediated, accepted-risk, will not fix), integration with the vulnerability scanner to auto-verify fixes, and a regression detection pipeline that compares new scan results against historically remediated findings by fingerprint. CISO dashboards show MTTR by severity, open finding trends, and recurring finding categories.

Expect these follow-ups

• How would you fingerprint a finding reliably enough to detect a regression across different scanner versions?

As asked

Design a data loss prevention system for a SaaS collaboration platform where users can upload documents and share links. You need to detect and block exfiltration of sensitive data like PII, source code, and credentials without causing excessive false positives for legitimate use.

Sample answer outline

A strong answer places inspection at upload time and at share-link generation, uses a classification pipeline (regex for PII patterns like SSNs and card numbers, ML classifier for source code and credentials, hash-based matching for known sensitive documents), applies sharing restrictions based on classification result (e.g. externally-shareable vs internal-only), and provides a user-driven exception workflow for false positives that creates an audit trail. Async scanning for large files avoids blocking the upload path.

Expect these follow-ups

• How would you handle encrypted or password-protected files that your DLP scanner cannot inspect?

As asked

Design an internal PKI for an organization that needs to issue TLS certificates for internal services, client certificates for mTLS between microservices, and code signing certificates for CI/CD. Walk me through the CA hierarchy, key protection, and certificate lifecycle management.

Sample answer outline

A strong answer describes an offline root CA (air-gapped HSM, ceremony-based key generation), one or more intermediate CAs (online, HSM-backed) for different certificate classes, and Vault PKI as the issuing layer for automation. Certificate profiles enforce short validity periods for service certificates (90 days max, automated renewal), longer validity for client certificates with CRL/OCSP for revocation, and strict usage constraints via X.509 extended key usage fields. The candidate should discuss certificate transparency requirements for public-facing subdomains.

Expect these follow-ups

• How does OCSP stapling improve the performance and reliability of certificate revocation checking?