cswork / libraryOpen practice workspace

Interview guides · Black Cape

Black Cape Software Engineer Interview Guide

Black Cape Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

A Software Engineer at Black Cape plays a vital role in designing, building, and deploying cutting-edge technology solutions that directly support national security. As a full-stack engineer, you will work on cloud-native web applications, advanced data analysis tools, and artificial intelligence and machine learning (AI/ML) integrations. Your work will have a tangible impact on the missions of critical federal government customers, specifically within the Department of War (DoW) and the Intelligence Community (IC). Unlike typical commercial software roles, this position requires solving complex technical challenges within highly secure, air-gapped environments. You will collaborate with multi-disciplinary teams of engineers, data scientists, and mission experts to build robust, scalable systems.

This guide is scoped to a Software Engineer candidate at Black Cape.

Focus areas

  • Python
  • Full-Stack Development
  • REST

The Black Cape interview process

Black Cape candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Recruiter Phone Screen

Initial call to discuss your background, security clearance status, and interest in the company.

What to demonstrate

  • Initial call to discuss your background, security clearance status, and interest in the company
  • Depth in Python

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Preparation Call

Follow-up call to rehearse company details, discuss the format of upcoming rounds, and share potential questions.

What to demonstrate

  • Follow-up call to rehearse company details, discuss the format of upcoming rounds, and share potential questions
  • Depth in Python

How to prepare

  • Answer aloud and timed: Explain the differences between SQL and NoSQL databases, and describe a scenario where you would choose one over the other.
  • Answer aloud and timed: How do you secure a web application against common vulnerabilities, such as SQL injection or cross-site scripting (XSS)?

Technical Interview

In-depth discussion with a software lead about your past projects and technical skills.

What to demonstrate

  • In-depth discussion with a software lead about your past projects and technical skills
  • Depth in Python

How to prepare

  • Answer aloud and timed: Describe your experience with containerization and deploying applications in a cloud environment like AWS or Azure.
  • Answer aloud and timed: Tell me about a time you had to work with a difficult stakeholder or client. How did you manage the relationship?

Founders and Team Conversations

Meetings with company founders and the immediate team to assess leadership potential and cultural fit.

What to demonstrate

  • Meetings with company founders and the immediate team to assess leadership potential and cultural fit
  • Depth in Python

How to prepare

  • Answer aloud and timed: Describe a situation where you had to learn a new technology quickly to solve a problem. How did you approach it?
  • Answer aloud and timed: How do you handle a situation where a project's requirements change mid-development?

Where candidates lose points

Leverage the recruiter prep call

Take the recruiter's preparation call seriously. Use this time to ask detailed questions about the interviewers, the specific technologies the team uses, and the key themes they want to see you demonstrate.

Highlight your mission focus

Black Cape values engineers who care about the end-user. Be ready to explain why you want to support defense and intelligence missions and how you keep the end-user in mind when writing code.

Be ready to discuss past projects in-depth

The technical conversations will focus heavily on your resume. Be prepared to explain the "why" behind your technical choices, the challenges you faced, and how you resolved them.

Demonstrate database and data pipeline knowledge

Given the company's focus on advanced data analysis and AI/ML, having a strong grasp of data flow, databases, and ETL processes will set you apart from other candidates.

Questions & practice

Canonicalise a request body into a stable idempotency fingerprint

Medium · parsing · canonicalisation · hashing

idempotency_key.request_fingerprint is a SHA-256 over the method, path and canonicalised body, and a retry whose fingerprint differs must be rejected with 422 rather than served the stored response. Write the canonicaliser. Bodies are JSON up to 256 KB nested at most 32 levels; clients vary key order, whitespace and unicode escaping, and some send 64-bit ids as JSON numbers. Produce a deterministic byte string such that semantically identical bodies match and any semantic difference does not. State your complexity and name two normalisations you refuse to perform.

Approach

  1. Parse once into a tree, then re-serialise under fixed rules: object keys sorted, array order preserved, one escaping convention, no insignificant whitespace. Parsing is O(n) and sorting keys is O(k log k) per object, so O(n log n) overall with O(depth) stack, and the 32-level cap is enforced during parsing because hostile nesting is how a canonicaliser becomes a stack overflow.
  2. Sort keys by their UTF-8 bytes and say why the obvious implementation is wrong in some runtimes: a default string comparison that orders by UTF-16 code units places surrogate pairs, meaning code points from U+10000 up, below U+E000 to U+FFFF, which is not UTF-8 byte order, so two services written in different languages disagree on the same document.
  3. Do not re-encode numbers through a double. IEEE-754 binary64 represents integers exactly only up to 2^53, so normalising a 19-digit id through a float changes it, and 1 against 1.0 cannot be reconciled without deciding whether they are the same value. Preserve the literal token, and require ids as strings at the API boundary if you want them comparable.
  4. Reject duplicate keys rather than picking one. JSON permits them and parsers disagree, most keeping the last, so any choice you make ties the fingerprint to a parser detail that the code handling the request does not necessarily share.

Follow-up

  • A client sends the same logical request with an extra field your API ignores. Same key, different fingerprint, so you return 422. Is that the right answer?
  • Where does the fingerprint get computed relative to request decompression and the body-size limit?

Merge partitioned event streams into one ordered feed with bounded lateness

Hard · k-way merge · watermarks · out-of-order streams

The read-model service consumes 64 log partitions carrying about 4,000 events per second in total. Each partition is ordered within itself, but partitions drift by up to 30 seconds, and the activity feed must present a tenant's events in occurred_at order. Produce the merge. State its complexity, the buffer it requires in events and in bytes, what happens when one partition is idle, and what you do with an event that arrives after you have already emitted its position. Payloads average 1 KB.

Approach

  1. Merge with a min-heap over the 64 partition heads keyed on (occurred_at, event_id): O(log P) per event and O(n log P) overall. The tie-break on event_id is what makes the output deterministic when two partitions carry the same millisecond, which matters because the feed is paginated and a non-deterministic order reorders pages under the reader.
  2. Emitting the heap head is only correct once every partition has produced everything up to that timestamp, so the emit condition is a watermark: the minimum across partitions of the highest occurred_at seen, less the allowed lateness. Events are held until the watermark passes them, which is what turns individually ordered streams into a jointly ordered one.
  3. Size the buffer from the lateness rather than guessing: 4,000 events per second times 30 seconds is 120,000 buffered events, and at 1 KB each about 120 MB of heap. That number is the real price of the ordering guarantee and belongs in front of whoever asked for it.
  4. Handle the idle partition explicitly, because it fails the feed rather than corrupting it: a partition with no traffic never advances its own maximum, so the watermark freezes and output stops entirely. Either every partition emits a periodic idle marker carrying the broker's current time, or the watermark falls back to wall clock for a partition silent beyond a threshold.

Follow-up

  • The lateness budget is raised to five minutes. What is the new buffer, and what besides memory changes?
  • The consumer restarts. Where does it resume from, and what does the feed look like for the first 30 seconds?

Diff a projection against the primary without per-row point reads

Hard · reconciliation · range hashing · throttling

The listing projection has drifted and some rows show a stale version. The primary holds 40,000,000 resource rows across 12,000 tenants while serving 1,200 writes and 14,000 reads per second. The obvious repair, reading each resource row and comparing its version against the projection, is correct and would eventually finish. Explain precisely why it is unacceptable here, then give a diff that finds the differing rows, state its complexity, and make it safe to run against a live primary. Replication lag is usually under 100 ms and is not bounded.

Approach

  1. Quantify the naive cost rather than calling it slow: 40,000,000 point reads at even 0.5 ms each is over five hours serialised, and the only lever is concurrency, which is exactly what you cannot spend. The primary's pool is sized for the write path, and 40,000,000 random reads evict the buffer cache that sustains the 85 percent cache hit rate, so the audit degrades the system it is auditing.
  2. Replace random access with one ordered pass per side. Both sides can be read in (tenant_id, resource_id) order, which is a sequential scan on each and a merge join in O(n) time and O(1) memory. For a dense diff that is the whole answer, and it reads the primary once instead of 40,000,000 times.
  3. For the expected sparse case, compare range hashes instead of rows: partition the key space, compute per range an order-independent aggregate over hash(resource_id, version), compare aggregates, and descend only into ranges that differ. With d differing rows and branching factor B, at most d ranges mismatch per level, so the drill-down examines O(d log_B(n/d)) ranges and reads full rows only in mismatching leaves.
  4. Aggregate with a sum modulo 2^64 or a multiset hash, never XOR. XOR is order-independent but self-cancelling, so two rows wrong in the same way, or a row duplicated on one side, leave the range aggregate matching and the range is declared clean.

Follow-up

  • The diff reports 900 stale rows. How do you decide between patching those rows and rebuilding the projection from resource_revision?
  • Same job, but the projection lives in a search index that cannot be scanned in key order. What changes?

Explain the differences between SQL and NoSQL databases, and describe a scenario where you would choose one ov

Medium · Technical & Architecture Questions

Explain the differences between SQL and NoSQL databases, and describe a scenario where you would choose one over the other.

Approach

  1. Name the grain you start from and join outward from it.
  2. Check whether any join is one-to-many before aggregating, or the sums inflate.
  3. Say which index the query would use, and what makes it unusable.
  4. Handle the rows that do not match: that is usually the actual question.

Follow-up

  • How does the query change if that join becomes one-to-many?
  • What happens to this when the table is ten times larger?

How do you secure a web application against common vulnerabilities, such as SQL injection or cross-site script

Medium · Technical & Architecture Questions

How do you secure a web application against common vulnerabilities, such as SQL injection or cross-site scripting (XSS)?

Approach

  1. Name the grain you start from and join outward from it.
  2. Check whether any join is one-to-many before aggregating, or the sums inflate.
  3. Say which index the query would use, and what makes it unusable.
  4. Handle the rows that do not match: that is usually the actual question.

Follow-up

  • How does the query change if that join becomes one-to-many?
  • What happens to this when the table is ten times larger?

Walk me through a complex technical project you worked on recently. What architectural decisions did you make,

Medium · Technical & Architecture Questions

Walk me through a complex technical project you worked on recently. What architectural decisions did you make, and why?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

How do you optimize database queries when dealing with large, relational datasets?

Medium · Technical & Architecture Questions

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Why are you interested in working with the Department of War and the Intelligence Community?

Medium · Mission & Alignment Questions

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How do you maintain high development standards when working under strict security or compliance constraints?

Medium · Mission & Alignment Questions

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

What does "mission-driven engineering" mean to you, and how do you apply it to your daily work?

Medium · Mission & Alignment Questions

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

One customer endpoint stalls deliveries to every other destination

Medium · bulkhead · timeouts · saturation

The egress service delivers about 1.5k webhooks/second across 40,000 destinations, with a per-destination concurrency cap of 4 and a 10-second connect-plus-read timeout. Throughput falls to 300/second, queue depth climbs, and p99 delivery latency for unaffected destinations goes from 200 ms to minutes, while the error rate barely moves. One tenant holds 900 destination rows whose URLs share a hostname that now answers in 9.5 seconds. Explain the mechanism with the arithmetic, then give the containment in the order you would apply it.

Approach

  1. Look at saturation before errors. A flat error rate with collapsing throughput says nothing is failing, things are waiting, so the first signal to pull is in-flight request count or pool wait time rather than the error counter. This is the distinction that decides the whole investigation.
  2. Group in-flight work by resolved host, not by destination id. The cap is keyed per destination row, so 900 rows sharing one hostname buy 3,600 concurrent slots against a single host, each held for 9.5 seconds. The bulkhead was never a bulkhead for that host, and grouping by the wrong dimension is why the dashboard looked healthy.
  3. Do the arithmetic in both directions. Required concurrency is arrival rate times latency, so 1.5k/second at 200 ms needs about 300 in flight, which is entirely consumed by 3,600 slow slots; conversely whatever concurrency is left sustains rate equals concurrency divided by 9.5 seconds, which is the 300/second you are seeing. Matching both numbers is what promotes this from a plausible story to the mechanism.
  4. Explain why the circuit breaker never helped. It opens on consecutive failures, and a 9.5-second response inside a 10-second timeout is a success. Slow is not failing, so an error-rate breaker cannot see this; you need a slow-call ratio, a deadline propagated from the caller's remaining budget, or a concurrency limiter.

Follow-up

  • The host recovers to 80 ms. How long does the queue take to drain, and what does the drain do to the recovered host?
  • Where should the 10-second timeout number actually come from?

Suggested practice checklist

Built from the rounds and topics Black Cape candidates report.

Day 1 — Map the Black Cape loop

  • Write out the reported sequence: Recruiter Phone Screen, Preparation Call, Technical Interview, Founders and Team Conversations.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work Python

  • Spend the session on Python, which Black Cape candidates report being tested on.
  • Write one worked example in Python and time yourself on it.

Deliverable: One timed worked example in Python.

Day 3 — Work Full-Stack Development

  • Spend the session on Full-Stack Development, which Black Cape candidates report being tested on.
  • Write one worked example in Full-Stack Development and time yourself on it.

Deliverable: One timed worked example in Full-Stack Development.

Day 4 — Work REST

  • Spend the session on REST, which Black Cape candidates report being tested on.
  • Write one worked example in REST and time yourself on it.

Deliverable: One timed worked example in REST.

Day 5 — Answer out loud: Technical & Architecture Questions

  • Answer aloud, timed: Walk me through a complex technical project you worked on recently. What architectural decisions did you make, and why?
  • Answer aloud, timed: How do you optimize database queries when dealing with large, relational datasets?

Deliverable: Spoken answers to 2 reported Technical & Architecture Questions question(s), under time.

Day 6 — Answer out loud: Behavioral & Experience Questions

  • Answer aloud, timed: Tell me about a time you had to work with a difficult stakeholder or client. How did you manage the relationship?
  • Answer aloud, timed: Describe a situation where you had to learn a new technology quickly to solve a problem. How did you approach it?

Deliverable: Spoken answers to 2 reported Behavioral & Experience Questions question(s), under time.

Day 7 — Answer out loud: Mission & Alignment Questions

  • Answer aloud, timed: Why are you interested in working with the Department of War and the Intelligence Community?
  • Answer aloud, timed: How do you maintain high development standards when working under strict security or compliance constraints?

Deliverable: Spoken answers to 2 reported Mission & Alignment Questions question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

Describe your experience with containerization and deploying applications in a cloud environment like AWS or A

Medium · Technical & Architecture Questions

Describe your experience with containerization and deploying applications in a cloud environment like AWS or Azure.

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Tell me about a time you had to work with a difficult stakeholder or client. How did you manage the relationsh

Medium · Behavioral & Experience Questions

Tell me about a time you had to work with a difficult stakeholder or client. How did you manage the relationship?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Describe a situation where you had to learn a new technology quickly to solve a problem. How did you approach

Medium · Behavioral & Experience Questions

Describe a situation where you had to learn a new technology quickly to solve a problem. How did you approach it?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you handle a situation where a project's requirements change mid-development?

Medium · Behavioral & Experience Questions

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Tell me about a time you made a technical mistake. What did you learn, and how did you rectify it?

Medium · Behavioral & Experience Questions

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you prioritize your tasks when working on multiple high-priority deliverables simultaneously?

Medium · Behavioral & Experience Questions

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?