Interview guides · Guardsquare

Guardsquare Software Engineer Interview Guide

Guardsquare Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

As a Software Engineer at Guardsquare, you are at the forefront of mobile application security. You will be tasked with developing sophisticated solutions that protect millions of devices worldwide from reverse engineering, tampering, and malicious attacks. This role is critical because the work you produce directly safeguards the intellectual property and user privacy of some of the world’s most prominent mobile applications. You will operate in an environment where precision and deep technical understanding are paramount. Whether you are working on obfuscation techniques, hardening SDKs, or building security tooling, your contributions will have a global impact. Expect to engage with complex, low-level challenges that require a mastery of programming languages and a mindset geared toward defensive engineering. ##### Tip The work at Guardsquare is highly specialized.

This guide is scoped to a Software Engineer candidate at Guardsquare.

Focus areas

C++
String parsing
Java

The Guardsquare interview process

Guardsquare candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Recruiter Screen

Initial screening to establish baseline fit and expectations.

What to demonstrate

Initial screening to establish baseline fit and expectations
Depth in C++

How to prepare

Be able to walk your CV end to end in two minutes, and say why this company specifically.
Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Evaluations

Series of technical evaluations including theoretical questions and hands-on coding exercises.

What to demonstrate

Series of technical evaluations including theoretical questions and hands-on coding exercises
Depth in C++

How to prepare

Answer aloud and timed: What are the common security pitfalls associated with this language?
Answer aloud and timed: Discuss the differences between specific paradigms or language versions.

Team Lead Interview

Deep dive into your technical background with a team lead.

What to demonstrate

Deep dive into your technical background with a team lead
Depth in C++

How to prepare

Answer aloud and timed: Explain how you would approach parsing a complex string or data structure.
Answer aloud and timed: Walk me through how you would architect a solution for a given security constraint.

Leadership Interaction

Final interaction with leadership to ensure long-term alignment.

What to demonstrate

Final interaction with leadership to ensure long-term alignment
Depth in C++

How to prepare

Answer aloud and timed: How do you handle ambiguity when a requirement is not fully defined?
Answer aloud and timed: Describe a time you had to debug a difficult issue in a large codebase.

Where candidates lose points

Be transparent

If you don't know an answer, communicate your thought process rather than guessing. We value intellectual honesty.

Ask questions

We appreciate candidates who are curious about our technology, our market, and our team structure.

Focus on the fundamentals

You don't need to be a security expert, but you should demonstrate a strong interest in understanding how software is secured.

Prepare your stories

Use the STAR method (Situation, Task, Action, Result) to structure your answers for behavioral questions.

Questions & practice

Can you explain the memory management model in your primary language?

Medium · Technical Proficiency and Language Maste

Approach

Say what the runtime actually does before reasoning about the code.
Name what is shared across threads and what owns each piece of state.
Identify the window where an invariant is briefly untrue.
Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

What happens if two callers reach this at the same time?
Where could this allocate more than you expect?

How would you optimize this specific code snippet for performance?

Medium · Technical Proficiency and Language Maste

Approach

Say what the runtime actually does before reasoning about the code.
Name what is shared across threads and what owns each piece of state.
Identify the window where an invariant is briefly untrue.
Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

What happens if two callers reach this at the same time?
Where could this allocate more than you expect?

What are the common security pitfalls associated with this language?

Medium · Technical Proficiency and Language Maste

Approach

Say what the runtime actually does before reasoning about the code.
Name what is shared across threads and what owns each piece of state.
Identify the window where an invariant is briefly untrue.
Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

What happens if two callers reach this at the same time?
Where could this allocate more than you expect?

Discuss the differences between specific paradigms or language versions.

Medium · Technical Proficiency and Language Maste

Approach

Say what the runtime actually does before reasoning about the code.
Name what is shared across threads and what owns each piece of state.
Identify the window where an invariant is briefly untrue.
Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

What happens if two callers reach this at the same time?
Where could this allocate more than you expect?

Explain how you would approach parsing a complex string or data structure.

Medium · Technical Proficiency and Language Maste

Approach

Say what the runtime actually does before reasoning about the code.
Name what is shared across threads and what owns each piece of state.
Identify the window where an invariant is briefly untrue.
Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

What happens if two callers reach this at the same time?
Where could this allocate more than you expect?

Replace offset paging on the resource feed with keyset

Easy · keyset pagination · composite index · sort order

resource holds resource_id, tenant_id, owner_user_id, title, body_ref, version, status ('draft','active','archived','deleted'), created_at, updated_at, deleted_at, with an index on (tenant_id, status, updated_at DESC, resource_id DESC). The listing endpoint returns active resources for one tenant, newest update first, 50 per page, today with LIMIT 50 OFFSET n. Tenants reach page 400 and rows are created while they read. Write the keyset query, define what the cursor carries and how it is encoded, and say which part of the index each predicate uses. Assume PostgreSQL 16.

Approach

Name the two failures separately. OFFSET 20000 makes the server produce and discard 20,000 rows, so page cost grows with depth rather than with page size. Independently, any write that changes how many rows sort above the offset moves the window between two fetches, and the direction decides which anomaly you get: an insert lands at the head of updated_at DESC and pushes already-returned rows down past the boundary, so they are returned a second time; a delete above the offset, or a row whose updated_at is bumped above the cursor, pulls rows up and one is never returned at all. Nothing in the response reveals either.
Write the seek: WHERE tenant_id = $1 AND status = 'active' AND (updated_at, resource_id) < ($2, $3) ORDER BY updated_at DESC, resource_id DESC LIMIT 50. The row-value comparison is one index range rather than a disjunction, and both columns are NOT NULL, which is what makes that comparison well defined.
Map each predicate onto the index: tenant_id and status are equality on the leading columns, (updated_at, resource_id) is the range, and the ORDER BY matches the index order so no Sort node appears and the scan stops after 50 rows. The DESC in the definition only matters for mixed directions — a plain ascending btree on the same columns is read backwards for this query.
Put both sort columns in the cursor and nothing the client can tamper with into another tenant: base64 of (updated_at, resource_id), validated server-side, with tenant_id taken from the principal.

Follow-up

The client asks for 'jump to page 400'. What do you offer instead, and what does the honest version cost?
Sort order becomes user-selectable across four columns. How many indexes is that, and which would you refuse to add?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Walk me through how you would architect a solution for a given security constraint.

Medium · Problem-Solving and Case Studies

Approach

Fix the scope first: who calls this, how often, and what they do when it fails.
Name the read and write paths separately; they rarely have the same bottleneck.
Choose a partition key and say what query it makes expensive.
State the consistency you need, and where you are willing to be stale.

Follow-up

What breaks first when traffic grows ten times?
How does this behave when that dependency is down for an hour?

If you were tasked with securing this specific feature, where would you start?

Medium · Problem-Solving and Case Studies

Approach

Clarify what is being asked and what a complete answer contains.
State your assumptions explicitly before working the problem.
Say what you would check first and why it is the highest-information step.
Work from the requirement backwards to the design.

Follow-up

What assumption would you test first?
How would you know your answer was wrong?

How do you balance code readability with performance requirements?

Medium · Problem-Solving and Case Studies

Approach

Clarify what is being asked and what a complete answer contains.
State your assumptions explicitly before working the problem.
Say what you would check first and why it is the highest-information step.
Work from the requirement backwards to the design.

Follow-up

What assumption would you test first?
How would you know your answer was wrong?

Every query on one table stalls for forty seconds mid-deploy

Medium · lock contention · ddl · migrations

During a release on PostgreSQL, every query touching resource times out for about 40 seconds and then recovers with no intervention. The release ran one migration, ALTER TABLE resource ADD COLUMN archived_reason TEXT, and the migration log shows it completing in 6 ms. Unrelated tables showed no change in error rate. Explain how a 6 ms statement caused a 40-second stall, give the ordered checks you would run on a live system to confirm it, and give the migration procedure that prevents a repeat.

Approach

Separate the statement's duration from the lock's duration. ADD COLUMN with no default is a catalogue-only change and genuinely runs in milliseconds, but it requires ACCESS EXCLUSIVE, and it cannot acquire that until every transaction already touching the table has finished.
Account for the queueing, which is the part that surprises people. A lock request that is waiting blocks later requests for conflicting modes behind it rather than letting them overtake, so one long-open transaction holds the DDL and the DDL holds all the traffic. The stall length is set by the longest open transaction, not by the size of the change.
Confirm on a live system in this order: pg_stat_activity for that table ordered by xact_start, looking for the oldest transaction and specifically for state = idle in transaction; then pg_locks where granted = false to find the waiter; then join them on pid to name blocker and blocked. pg_blocking_pids() does that join for you and is the fastest single call.
Prevent rather than merely time it better. Set lock_timeout to a second or two on the migration session so the DDL abandons the queue after a bounded wait and is retried, instead of holding it for as long as the oldest transaction lives. Be exact about what that buys: queries arriving during the wait still queue behind the pending ACCESS EXCLUSIVE request, so each attempt costs them up to one lock_timeout of added latency. The outage goes from 40 seconds to about one second per attempt, not to zero. Also run migrations away from deploy-time peaks, and put a statement timeout and an idle-in-transaction timeout on the analytics role that opens the long transactions.

Follow-up

The same release also wants NOT NULL on that column. What is the sequence that gets there without a long lock?
Your lock_timeout retry fails ten times in a row because the analytics transaction is always open. What do you change?

Suggested practice checklist

Built from the rounds and topics Guardsquare candidates report.

Day 1 — Map the Guardsquare loop

Write out the reported sequence: Recruiter Screen, Technical Evaluations, Team Lead Interview, Leadership Interaction.
For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work C++

Spend the session on C++, which Guardsquare candidates report being tested on.
Write one worked example in C++ and time yourself on it.

Deliverable: One timed worked example in C++.

Day 3 — Work String parsing

Spend the session on String parsing, which Guardsquare candidates report being tested on.
Write one worked example in String parsing and time yourself on it.

Deliverable: One timed worked example in String parsing.

Day 4 — Work Java

Spend the session on Java, which Guardsquare candidates report being tested on.
Write one worked example in Java and time yourself on it.

Deliverable: One timed worked example in Java.

Day 5 — Answer out loud: Technical Proficiency and Language Mastery

Answer aloud, timed: Can you explain the memory management model in your primary language?
Answer aloud, timed: How would you optimize this specific code snippet for performance?

Deliverable: Spoken answers to 2 reported Technical Proficiency and Language Mastery question(s), under time.

Day 6 — Answer out loud: Problem-Solving and Case Studies

Answer aloud, timed: Walk me through how you would architect a solution for a given security constraint.
Answer aloud, timed: How do you handle ambiguity when a requirement is not fully defined?

Deliverable: Spoken answers to 2 reported Problem-Solving and Case Studies question(s), under time.

Day 7 — Answer out loud: Behavioral and Culture Fit

Answer aloud, timed: Why do you want to work for Guardsquare specifically?
Answer aloud, timed: Describe a time you had a disagreement with a team member; how did you resolve it?

Deliverable: Spoken answers to 2 reported Behavioral and Culture Fit question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

How do you handle ambiguity when a requirement is not fully defined?

Medium · Problem-Solving and Case Studies

Approach

Pick a story where you made the decision, not one where you watched it.
State the situation in two sentences and spend the rest on the reasoning.
Give the blast radius: what could have broken, and what you measured.
Name the disagreement and how you resolved it with evidence.

Follow-up

What would you do differently if you ran that again?
How did you know your change caused the improvement?

Describe a time you had to debug a difficult issue in a large codebase.

Medium · Problem-Solving and Case Studies

Approach

Pick a story where you made the decision, not one where you watched it.
State the situation in two sentences and spend the rest on the reasoning.
Give the blast radius: what could have broken, and what you measured.
Name the disagreement and how you resolved it with evidence.

Follow-up

What would you do differently if you ran that again?
How did you know your change caused the improvement?