Abnormal Security Software Engineer Interview Questions
4+ questions from real Abnormal Security Software Engineer interviews, reported by candidates.
Round Types
Top Topics
Questions
Abnormal Security Third Round Interview Experience with Code Review and System Design
There were 4 rounds in total. The third round was code review + system design. Before this round, you were given a link for a pre-review code review. The interview was divided into two parts. The firs
There were four rounds in total. This was the final round, and like the third round, it was divided into two parts. This round involved coding and a deep dive into a past project. The coding question
## Problem You are given a Python snippet that implements a user session cache. Identify all bugs, performance issues, and design problems. Be prepared to explain the impact of each issue and propose fixes. ```python sessions = {} def get_session(user_id): if user_id not in sessions: sessions[user_id] = {"created": time.time(), "data": load_from_db(user_id)} return sessions[user_id] def invalidate_session(user_id): del sessions[user_id] def cleanup_old_sessions(): for uid, session in sessions.items(): if time.time() - session["created"] > 3600: del sessions[uid] ``` **Your task:** List every issue you can find in 10 minutes. Rewrite the module addressing all concerns. ## Follow-ups 1. `cleanup_old_sessions` modifies a dict while iterating — what error does this cause and how do you fix it? 2. The global dict is not thread-safe. How would you make this safe for a multi-threaded web server? 3. If this service runs across 10 instances, what breaks and how do you fix it? 4. How would you add an LRU eviction policy when memory usage exceeds a threshold?
## Problem You have a table of user events with timestamps. A session is a sequence of events from the same user with no gap exceeding 30 minutes. Compute per-user: number of sessions, average session duration in minutes, and the session with the most events. ```sql -- Schema events(event_id, user_id, event_type, created_at TIMESTAMP) ``` **Expected output:** ``` user_id | num_sessions | avg_duration_min | max_events_in_session u1 | 3 | 22.5 | 8 u2 | 1 | 45.0 | 15 ``` ## Approach Use window functions: `LAG(created_at) OVER (PARTITION BY user_id ORDER BY created_at)` to compute gaps, then mark session boundaries, assign session IDs with a running sum, and aggregate. ## Follow-ups 1. Write the full SQL using CTEs. Walk through each step. 2. How does your query perform on a 1B-row events table? What indexes help? 3. If sessions should expire after 30 minutes of inactivity OR at midnight, how do you add the midnight boundary? 4. How would you detect bot sessions (e.g., events arriving faster than 1 per second for > 5 minutes)?
What Abnormal Security Looks for in Software Engineer Interviews
Abnormal Security Software Engineer interviews are calibrated against the level and scope expected of the role. Across 4+ verified candidate reports on LeakCode, the consistent signals interviewers look for: clear problem decomposition before coding, explicit complexity reasoning, structured handling of edge cases, and the ability to articulate trade-offs between two reasonable approaches.
The discriminator between candidates who advance and candidates who do not is rarely the final correctness of the solution. It is the path to the solution: did you ask clarifying questions, did you state your approach before coding, did you handle edge cases without prompting, and did you communicate your reasoning throughout. Reports tagged "no hire" frequently cite a working solution with poor communication; reports tagged "strong hire" cite clear thinking even when the final solution was incomplete.
How To Use This Question Set
Real interview reports are a calibration tool, not a memorization target. Companies update their question pools every 2-4 months; memorizing exact problems risks misleading you when the interviewer uses a variant. The high-leverage use: identify the patterns that appear repeatedly in Abnormal Security Software Engineer reports, practice those patterns on similar (not identical) problems, and use the reports to understand the interviewer's typical follow-up depth.
Filter the questions below by round type, difficulty, and recency. Focus first on reports from the past 6-12 months; older reports may reference questions that have since rotated out of Abnormal Security's pool. Reports tagged with quantified difficulty (e.g., "medium-hard") are higher-signal than reports without difficulty tags.
Round-by-Round Expectations
Abnormal Security Software Engineer loops typically span 4-6 rounds across phone screens and on-site or virtual on-site interviews. The structure varies by company: some run 1 recruiter screen + 1 technical phone + 3-4 on-site rounds; others run 1 recruiter screen + 1 OA + 4-5 on-site rounds. The recruiter screen is logistics and culture-light; the technical phone screen is medium-difficulty coding; the on-site loop covers coding, system design (at L4+ levels), and behavioral rounds.
Each round is designed to surface a specific signal. Coding rounds: correctness, code quality, complexity reasoning, communication. System design rounds: requirements clarification, design judgment, operational thinking. Behavioral rounds: ownership scope, leadership, ambiguity tolerance, conflict navigation. Strong candidates explicitly hit each signal dimension out loud during the round; weak candidates focus only on solving the prompt.
Common Interview Mistakes At This Combination
Reports tagged "no hire" at Abnormal Security Software Engineer commonly cite: jumping into code without clarifying requirements, coding silently for 10+ minutes without verbalizing approach, missing edge cases (empty input, single element, very large input, overflow), and producing a working solution that the candidate cannot explain or refactor when probed. Strong candidates avoid these patterns by following a consistent template: clarify, verbalize approach, code with narration, test with examples.
Behavioral and design rounds have their own failure modes. Behavioral: stories that use "we" instead of "I" diluting individual signal, stories with no quantified outcome, defensiveness when probed about failure. Design: not asking clarifying questions, not stating requirements out loud, designing for a single server when the prompt clearly implies scale, ignoring operational concerns (deployment, monitoring, rollback). These show up in roughly half of Abnormal Security Software Engineer interview retrospectives on LeakCode.
See All 4 Abnormal Security Software Engineer Questions
Full question text, answer context, and frequency data for subscribers.
Get Access