Interview guides · Bigbear

Bigbear Software Engineer Interview Guide

Bigbear Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

As a Software Engineer at Bigbear, you play a foundational role in building advanced decision intelligence solutions that serve critical national security, supply chain, and digital identity missions. You will design, develop, and maintain robust software capabilities that operate within complex, distributed environments. Your day-to-day engineering efforts directly empower users to process vast amounts of data, derive predictive insights, and execute mission-critical operations with speed and precision. The work you drive bridges the gap between raw data and actionable intelligence, often involving large-scale systems, modern web architectures, and specialized developer tooling. Whether you are building full-stack applications, implementing backend data pipelines, or containerizing software capabilities, your contributions help shape products that tackle high-stakes challenges.

This guide is scoped to a Software Engineer candidate at Bigbear.

Focus areas

Java Development
System Design (architecture, trade-offs)
Requirements Elicitation

The Bigbear interview process

Bigbear candidates report 2 rounds over 2-4 weeks. The stages below are what candidates describe, not a published process.

Phone Screening

Initial phone screening with a recruiter to discuss the candidate's background and fit for the role.

What to demonstrate

Initial phone screening with a recruiter to discuss the candidate's background and fit for the role
Depth in Java Development

How to prepare

Be able to walk your CV end to end in two minutes, and say why this company specifically.
Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Interview

A technical interview conducted via video call or in-person, involving discussions with technical team members.

What to demonstrate

A technical interview conducted via video call or in-person, involving discussions with technical team members
Depth in Java Development

How to prepare

Answer aloud and timed: 1–2 sentences introducing the category and what it tests.
Answer aloud and timed: Bullet list of realistic example questions: Walk us through a complex project from your resume and explain your specific contributions to the architecture. How do you manage a single baseline to meet requirements across multiple disparate domains? What strategies do you use for requirements elicitation when working with cross-functional stakeholders? How do you ensure software components adhere to design requirements during rigorous testing phases? Can you describe a time when you had to make hardware and software trade-offs during system design?

Where candidates lose points

Focus on your resume narrative

Be prepared to walk through your resume projects in deep detail, as interviewers will use your past work as the primary springboard for technical discussions.

Emphasize collaboration and leadership

Highlight examples of how you mentor junior developers, communicate with stakeholders, and elevate team engineering standards.

Be ready to discuss trade-offs

Whether talking about database choices, microservices boundaries, or architecture design, always explain the "why" behind your technical decisions.

Communicate your thought process aloud

When presented with a design scenario or troubleshooting question, articulate your reasoning step-by-step so the interviewers can follow your logic.

Questions & practice

Collapse a redelivered event batch into per-aggregate high-water marks

Easy · hashing · at-least-once · aggregation

You drain a batch of up to 5,000,000 events, each (aggregate_id BIGINT, aggregate_version INT, event_type, payload). The log guarantees order within one aggregate only; the batch merges 64 partitions, and a relay failover has redelivered a range, so an older version for an aggregate can appear after a newer one. Given a map of last_applied_version per aggregate, produce the events worth applying, at most one per (aggregate_id, version), plus the count discarded. Target O(n) time. State the memory for 2,000,000 distinct aggregates and what you do when it does not fit.

Approach

One pass, one hash map from aggregate_id to the highest version kept, and a discard counter. An event whose version is at or below last_applied_version for its aggregate is dropped without further work, which is the whole reason the event carries its version rather than a delta. O(n) expected time, O(d) space in distinct aggregates.
Keep the maximum, never the last occurrence. The redelivered range means the final appearance of an aggregate in the batch can be an older version than one seen earlier in the same batch, so last-wins applies stale state over newer state and the projection regresses with no error anywhere.
Cost the memory instead of calling it large: an 8-byte key plus a 4-byte version is 12 bytes of payload, and an open-addressed table held at a 0.7 load factor costs roughly 17 bytes per entry before per-slot metadata, so 2,000,000 aggregates is tens of megabytes in a native layout and several times that in a runtime that boxes both key and value.
If the distinct set exceeds memory, partition on hash(aggregate_id) mod P and reduce each partition independently. Every event for one aggregate hashes to the same partition, so the per-partition result is exact and the merge is concatenation rather than a second reduction.

Follow-up

The payload is a patch rather than a snapshot, so applying only the highest version loses the intermediate changes. What changes in your reduction?
How do you detect that version 7 arrived while version 6 was never delivered, and what should the consumer do about the gap?

Merge partitioned event streams into one ordered feed with bounded lateness

Hard · k-way merge · watermarks · out-of-order streams

The read-model service consumes 64 log partitions carrying about 4,000 events per second in total. Each partition is ordered within itself, but partitions drift by up to 30 seconds, and the activity feed must present a tenant's events in occurred_at order. Produce the merge. State its complexity, the buffer it requires in events and in bytes, what happens when one partition is idle, and what you do with an event that arrives after you have already emitted its position. Payloads average 1 KB.

Approach

Merge with a min-heap over the 64 partition heads keyed on (occurred_at, event_id): O(log P) per event and O(n log P) overall. The tie-break on event_id is what makes the output deterministic when two partitions carry the same millisecond, which matters because the feed is paginated and a non-deterministic order reorders pages under the reader.
Emitting the heap head is only correct once every partition has produced everything up to that timestamp, so the emit condition is a watermark: the minimum across partitions of the highest occurred_at seen, less the allowed lateness. Events are held until the watermark passes them, which is what turns individually ordered streams into a jointly ordered one.
Size the buffer from the lateness rather than guessing: 4,000 events per second times 30 seconds is 120,000 buffered events, and at 1 KB each about 120 MB of heap. That number is the real price of the ordering guarantee and belongs in front of whoever asked for it.
Handle the idle partition explicitly, because it fails the feed rather than corrupting it: a partition with no traffic never advances its own maximum, so the watermark freezes and output stops entirely. Either every partition emits a periodic idle marker carrying the broker's current time, or the watermark falls back to wall clock for a partition silent beyond a threshold.

Follow-up

The lateness budget is raised to five minutes. What is the new buffer, and what besides memory changes?
The consumer restarts. Where does it resume from, and what does the feed look like for the first 30 seconds?

Canonicalise a request body into a stable idempotency fingerprint

Medium · parsing · canonicalisation · hashing

idempotency_key.request_fingerprint is a SHA-256 over the method, path and canonicalised body, and a retry whose fingerprint differs must be rejected with 422 rather than served the stored response. Write the canonicaliser. Bodies are JSON up to 256 KB nested at most 32 levels; clients vary key order, whitespace and unicode escaping, and some send 64-bit ids as JSON numbers. Produce a deterministic byte string such that semantically identical bodies match and any semantic difference does not. State your complexity and name two normalisations you refuse to perform.

Approach

Parse once into a tree, then re-serialise under fixed rules: object keys sorted, array order preserved, one escaping convention, no insignificant whitespace. Parsing is O(n) and sorting keys is O(k log k) per object, so O(n log n) overall with O(depth) stack, and the 32-level cap is enforced during parsing because hostile nesting is how a canonicaliser becomes a stack overflow.
Sort keys by their UTF-8 bytes and say why the obvious implementation is wrong in some runtimes: a default string comparison that orders by UTF-16 code units places surrogate pairs, meaning code points from U+10000 up, below U+E000 to U+FFFF, which is not UTF-8 byte order, so two services written in different languages disagree on the same document.
Do not re-encode numbers through a double. IEEE-754 binary64 represents integers exactly only up to 2^53, so normalising a 19-digit id through a float changes it, and 1 against 1.0 cannot be reconciled without deciding whether they are the same value. Preserve the literal token, and require ids as strings at the API boundary if you want them comparable.
Reject duplicate keys rather than picking one. JSON permits them and parsers disagree, most keeping the last, so any choice you make ties the fingerprint to a parser detail that the code handling the request does not necessarily share.

Follow-up

A client sends the same logical request with an extra field your API ignores. Same key, different fingerprint, so you return 422. Is that the right answer?
Where does the fingerprint get computed relative to request decompression and the body-size limit?

Stop tag and share joins from fanning out a page

Medium · join fan-out · semi-joins · many-to-many

resource_tag is (resource_id, tag_id) with PK (resource_id, tag_id); resource_share is (resource_id, shared_with_user_id, permission). The tagged-and-shared listing inner-joins resource to both, filters tenant_id, tag_id = ANY($2) and shared_with_user_id = $3, orders by updated_at DESC and takes 50. Pages come back with fewer than 50 distinct resources and the total in the header is far too high. Explain the row multiplication, rewrite both the page query and the count query so each is correct, and name the index each one needs. PostgreSQL 16.

Approach

Do the arithmetic against the predicates that are actually there. An inner join emits one row per matching child row, and both joins are filtered: tag_id = ANY($2) admits only the requested tags, shared_with_user_id = $3 admits one user's share rows. So a resource holding three of the requested tags and shared with $3 once yields three rows, not one — the multiplier is its count of matching tags times its share rows for that single user, and that second factor is 1 unless the table admits duplicate (resource_id, shared_with_user_id) pairs. LIMIT 50 then limits rows rather than resources, and COUNT(*) counts pairs — the header is the product, not the population.
Reject DISTINCT as the fix. It deduplicates after the product has been built, so the planner must materialise and sort the fanned-out set before the LIMIT can apply, and it leaves any SUM or AVG in the same select list wrong.
Rewrite both filters as semi-joins, keeping resource as the only row source: AND EXISTS (SELECT 1 FROM resource_tag rt WHERE rt.resource_id = r.resource_id AND rt.tag_id = ANY($2)) and the same shape against resource_share. A semi-join stops at the first match per resource and preserves the driving index order, so ORDER BY updated_at DESC, resource_id DESC LIMIT 50 still stops after 50 rows.
Count with the same predicates and no join at all: SELECT count(*) FROM resource r WHERE r.tenant_id = $1 AND r.status = 'active' AND EXISTS (...) AND EXISTS (...). Nothing multiplies a resource, so the number is the population.

Follow-up

The filter changes from 'any of these tags' to 'all of these tags'. Rewrite it and state what it costs relative to the ANY form.
A resource can be shared with the same user twice under different permissions. Does your count change, and should it?

Write the update path that detects a concurrent edit

Medium · optimistic concurrency · transactional outbox · audit history

resource carries version INT NOT NULL DEFAULT 1. resource_revision holds revision_id, resource_id, version, actor_user_id, change_kind, patch JSONB, request_id, created_at with UNIQUE (resource_id, version). outbox_event holds aggregate_type, aggregate_id, aggregate_version, event_type, payload, status. A PUT carries the version the client read. Write the exact statements for the single transaction that applies the edit, records the revision and enqueues 'resource.updated', and give the handler's branch on zero affected rows. Then say what PostgreSQL 16 does under READ COMMITTED when two of these updates hit one row at once.

Approach

One transaction, three writes, no network call inside it: UPDATE resource SET title = $3, version = version + 1, updated_at = now() WHERE resource_id = $1 AND tenant_id = $4 AND version = $2; then INSERT the resource_revision row at version $2 + 1; then INSERT the outbox_event row at the same aggregate_version. The event goes to a table rather than a broker because no transaction spans both.
Branch on the affected-row count before doing anything else. Zero has three causes — stale version, wrong tenant, row gone — so re-read once and map to 409 carrying the current version, or 404 for an id outside the caller's tenant, which also stops the endpoint confirming that another tenant's id exists.
State the engine behaviour instead of assuming it. Under READ COMMITTED the second UPDATE blocks on the row lock, and when the first commits PostgreSQL re-evaluates the WHERE clause against the newly committed row, so the version predicate now fails and the statement reports zero rows. Under REPEATABLE READ the identical collision raises SQLSTATE 40001 instead, so the handler must fold both shapes into one conflict response.
Keep UNIQUE (resource_id, version) even though the predicate already serialises writers. It is what makes a lost update unwritable if any other path ever reaches the revision table, and it converts a logic bug into 23505 rather than into a silently missing history row.

Follow-up

A client sends the version it read ten minutes ago and the resource has moved three versions. What is in your 409 so it can resolve the conflict without a full re-fetch?
Two editors, two disjoint fields, no overlap. Does your answer still refuse the second write, and should it?

1–2 sentences introducing the category and what it tests.

Medium · Technical and Domain Knowledge

Approach

Clarify what is being asked and what a complete answer contains.
State your assumptions explicitly before working the problem.
Say what you would check first and why it is the highest-information step.
Work from the requirement backwards to the design.

Follow-up

What assumption would you test first?
How would you know your answer was wrong?

Bullet list of realistic example questions: How have you utilized object-oriented design principles in your pa

Medium · Technical and Domain Knowledge

Bullet list of realistic example questions: How have you utilized object-oriented design principles in your past microservices architectures? Can you explain your experience with Java Development and how you approach building RESTful services? What is your familiarity with public key infrastructure (PKI) and securing web applications? How do you approach containerizing legacy or existing software capabilities using Docker? What experience do you have performing development within specialized environments like Evo or utilizing tools such as GreyBox?

Approach

Fix the scope first: who calls this, how often, and what they do when it fails.
Name the read and write paths separately; they rarely have the same bottleneck.
Choose a partition key and say what query it makes expensive.
State the consistency you need, and where you are willing to be stale.

Follow-up

What breaks first when traffic grows ten times?
How does this behave when that dependency is down for an hour?

1–2 sentences introducing the category and what it tests.

Medium · Project Experience and Architecture

Approach

Fix the scope first: who calls this, how often, and what they do when it fails.
Name the read and write paths separately; they rarely have the same bottleneck.
Choose a partition key and say what query it makes expensive.
State the consistency you need, and where you are willing to be stale.

Follow-up

What breaks first when traffic grows ten times?
How does this behave when that dependency is down for an hour?

Bullet list of realistic example questions: Walk us through a complex project from your resume and explain you

Medium · Project Experience and Architecture

Bullet list of realistic example questions: Walk us through a complex project from your resume and explain your specific contributions to the architecture. How do you manage a single baseline to meet requirements across multiple disparate domains? What strategies do you use for requirements elicitation when working with cross-functional stakeholders? How do you ensure software components adhere to design requirements during rigorous testing phases? Can you describe a time when you had to make hardware and software trade-offs during system design?

Approach

Fix the scope first: who calls this, how often, and what they do when it fails.
Name the read and write paths separately; they rarely have the same bottleneck.
Choose a partition key and say what query it makes expensive.
State the consistency you need, and where you are willing to be stale.

Follow-up

What breaks first when traffic grows ten times?
How does this behave when that dependency is down for an hour?

1–2 sentences introducing the category and what it tests.

Medium · Development Workflows and Tooling

Approach

Clarify what is being asked and what a complete answer contains.
State your assumptions explicitly before working the problem.
Say what you would check first and why it is the highest-information step.
Work from the requirement backwards to the design.

Follow-up

What assumption would you test first?
How would you know your answer was wrong?

Bullet list of realistic example questions: How do you incorporate CI/CD pipelines and build automation into y

Medium · Development Workflows and Tooling

Bullet list of realistic example questions: How do you incorporate CI/CD pipelines and build automation into your daily development workflow? What role does Gitlab or similar version control platforms play in your team collaboration? How do you approach writing technical documentation, such as wiki sites or architecture design records? What practices do you implement to ensure security and data integrity within your applications? How do you collaborate with junior developers to improve their understanding of software development best practices?

Approach

Fix the scope first: who calls this, how often, and what they do when it fails.
Name the read and write paths separately; they rarely have the same bottleneck.
Choose a partition key and say what query it makes expensive.
State the consistency you need, and where you are willing to be stale.

Follow-up

What breaks first when traffic grows ten times?
How does this behave when that dependency is down for an hour?

Read latency spikes on a sixty-second sawtooth

Medium · cache stampede · single-flight · ttl

The cached listing read path serves about 14k reads/second at an 85% hit rate. p99 sits at 35 ms for 57 seconds, jumps to 900 ms for 3, and repeats. During each spike the primary shows several hundred identical listing queries starting within the same millisecond, all carrying one large tenant's id. Cache entries use a 60-second TTL. Give the mechanism, the ordered checks, the fix, and the correctness hazard your fix must not introduce.

Approach

Match the period to a configured number before theorising about load. A spike every 60 seconds against a 60-second TTL is an entry expiring, and you confirm it by correlating spike timestamps with the entry's write time rather than with the traffic curve. If the period had matched a cron or a GC interval instead, this is a different investigation.
Establish the concurrency of the miss. Several hundred identical queries in one millisecond means the miss path has no coalescing: every request that arrives between expiry and repopulation recomputes. The herd size is that key's arrival rate times its recompute time, so at 1.2k reads/second for the hot key and a 250 ms recompute you expect about 300 concurrent misses, which matches what is observed.
Add single-flight on the miss path so one caller per key recomputes under a short-lived lock while the rest wait for its result. Prefer stale-while-revalidate where the read tolerates it: return the expired value immediately and refresh asynchronously, which removes the latency spike rather than serialising it into a queue of waiters.
De-synchronise the keys. Write TTLs with jitter, for example 60 seconds plus or minus 10%, so a deploy or a mass invalidation does not align every key on the same second and turn a per-key herd into a fleet-wide one.

Follow-up

The same sawtooth appears on a key that is invalidated on write rather than expired. Is that the same bug?
How does your answer change if the recompute takes 4 seconds instead of 250 ms?

Suggested practice checklist

Built from the rounds and topics Bigbear candidates report.

Day 1 — Map the Bigbear loop

Write out the reported sequence: Phone Screening, Technical Interview.
For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 2 reported rounds, with the weakest marked.

Day 2 — Work Java Development

Spend the session on Java Development, which Bigbear candidates report being tested on.
Write one worked example in Java Development and time yourself on it.

Deliverable: One timed worked example in Java Development.

Day 3 — Work System Design (architecture, trade-offs)

Spend the session on System Design (architecture, trade-offs), which Bigbear candidates report being tested on.
Write one worked example in System Design (architecture, trade-offs) and time yourself on it.

Deliverable: One timed worked example in System Design (architecture, trade-offs).

Day 4 — Work Requirements Elicitation

Spend the session on Requirements Elicitation, which Bigbear candidates report being tested on.
Write one worked example in Requirements Elicitation and time yourself on it.

Deliverable: One timed worked example in Requirements Elicitation.

Day 5 — Answer out loud: Technical and Domain Knowledge

Answer aloud, timed: 1–2 sentences introducing the category and what it tests.
Answer aloud, timed: Bullet list of realistic example questions: How have you utilized object-oriented design principles in your past microservices architectures? Can you explain your experience with Java Development and how you approach building RESTful services? What is your familiarity with public key infrastructure (PKI) and securing web applications? How do you approach containerizing legacy or existing software capabilities using Docker? What experience do you have performing development within specialized environments like Evo or utilizing tools such as GreyBox?

Deliverable: Spoken answers to 2 reported Technical and Domain Knowledge question(s), under time.

Day 6 — Answer out loud: Project Experience and Architecture

Answer aloud, timed: 1–2 sentences introducing the category and what it tests.
Answer aloud, timed: Bullet list of realistic example questions: Walk us through a complex project from your resume and explain your specific contributions to the architecture. How do you manage a single baseline to meet requirements across multiple disparate domains? What strategies do you use for requirements elicitation when working with cross-functional stakeholders? How do you ensure software components adhere to design requirements during rigorous testing phases? Can you describe a time when you had to make hardware and software trade-offs during system design?

Deliverable: Spoken answers to 2 reported Project Experience and Architecture question(s), under time.

Day 7 — Answer out loud: Development Workflows and Tooling

Answer aloud, timed: 1–2 sentences introducing the category and what it tests.
Answer aloud, timed: Bullet list of realistic example questions: How do you incorporate CI/CD pipelines and build automation into your daily development workflow? What role does Gitlab or similar version control platforms play in your team collaboration? How do you approach writing technical documentation, such as wiki sites or architecture design records? What practices do you implement to ensure security and data integrity within your applications? How do you collaborate with junior developers to improve their understanding of software development best practices?

Deliverable: Spoken answers to 2 reported Development Workflows and Tooling question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

1–2 sentences introducing the category and what it tests.

Medium · Behavioral and Collaboration

Approach

Pick a story where you made the decision, not one where you watched it.
State the situation in two sentences and spend the rest on the reasoning.
Give the blast radius: what could have broken, and what you measured.
Name the disagreement and how you resolved it with evidence.

Follow-up

What would you do differently if you ran that again?
How did you know your change caused the improvement?

Bullet list of realistic example questions: Tell me about a time you had to engage directly with leadership or

Medium · Behavioral and Collaboration

Bullet list of realistic example questions: Tell me about a time you had to engage directly with leadership or customers to resolve a technical blocker. How do you handle situations where project requirements are ambiguous or shifting rapidly? Can you describe a scenario where you worked independently with minimal supervision to meet a strict deadline? How do you approach giving and receiving constructive feedback during code reviews? What motivates you to work in the national security and decision intelligence domain?

Approach

Pick a story where you made the decision, not one where you watched it.
State the situation in two sentences and spend the rest on the reasoning.
Give the blast radius: what could have broken, and what you measured.
Name the disagreement and how you resolved it with evidence.

Follow-up

What would you do differently if you ran that again?
How did you know your change caused the improvement?

Narrate an outage you owned from page to postmortem

Hard · incident response · blast radius · postmortems

Pick an incident you personally drove, ideally one where writes were affected rather than reads. In six to eight minutes: state the symptom as it first appeared on a dashboard, the blast radius you established before you knew the cause, the mitigation you applied and when, the mechanism you eventually proved, and the follow-up that would prevent a repeat. Bring numbers: error rate, tenants affected, minutes to mitigate, minutes to resolve. If you cannot name what you measured, choose a different incident.

Approach

Open on the signal rather than the cause: which metric at which percentile moved, on which service, at what time, so the listener follows the same evidence you had rather than a conclusion you already reached.
Separate mitigation from diagnosis out loud. State what you did to stop the bleeding (flag off, shed traffic, drain a lease, roll back a deploy) and say plainly that you did it before the mechanism was known, because those are two jobs with different deadlines.
Establish blast radius in countable terms: how many tenants, how many writes, and crucially whether the effect was loss or only delay. An append-only revision table or a pending outbox row means the change survived and the projection was merely behind, which is a repair rather than a data-loss incident.
Prove the mechanism instead of asserting it. Name the trace span that grew, the plan that flipped to a sequential scan, the lease that expired, plus one alternative you ruled out and the signal that stayed flat while you ruled it out.

Follow-up

What would you do differently in the first five minutes, given the same dashboard and no more information?
Which follow-up action did you deliberately not take, and why was dropping it the right call?