ICF Software Engineer Interview Guide

The 60-second brief

A Software Engineer at ICF plays a pivotal role in delivering mission-critical digital transformation, consulting services, and platform engineering to public sector agencies and commercial clients. Unlike traditional tech companies focused on consumer apps, ICF builds enterprise-grade software solutions across public health, disaster recovery, energy efficiency, and defense projects. Modernization initiatives frequently leverage enterprise platforms such as Appian, Salesforce, MuleSoft, and ServiceNow, alongside custom full-stack solutions driven by Java, Angular, and Spring Boot. As a engineer at ICF, your work impacts millions of citizens through federally funded digital infrastructure and enterprise platform integrations.

This guide is scoped to a Software Engineer candidate at ICF.

Focus areas

• Authentication (Auth)
• Token-based Authentication (Push token + verify via API)
• Problem Solving (Complex situations)

The ICF interview process

ICF candidates report 3 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Phone Screen

Initial call with a recruiter to review qualifications, salary expectations, and alignment with the role.

What to demonstrate

• Initial call with a recruiter to review qualifications, salary expectations, and alignment with the role
• Depth in Authentication (Auth)

How to prepare

• Be able to walk your CV end to end in two minutes, and say why this company specifically.
• Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Evaluation

Includes live coding session, scripting exercise, or structured technical interview focusing on system design.

What to demonstrate

• Includes live coding session, scripting exercise, or structured technical interview focusing on system design
• Depth in Authentication (Auth)

How to prepare

• Answer aloud and timed: How do author, publisher, and dispatcher components interact in a CMS environment?
• Answer aloud and timed: Explain the difference between registering a servlet on path versus resource type.

Panel Discussions

Conversations with engineering leads, solutions architects, and hiring managers focusing on project walkthroughs and behavioral questions.

What to demonstrate

• Conversations with engineering leads, solutions architects, and hiring managers focusing on project walkthroughs and behavioral questions
• Depth in Authentication (Auth)

How to prepare

• Answer aloud and timed: How do you construct and modify server-side script includes in enterprise workflows?
• Answer aloud and timed: What kind of APIs are you currently working with in your projects?

Where candidates lose points

Match Your Resume to Your Verbal Story

Be prepared for interviewers to probe deeply into any technical tool or framework listed on your CV. If a technology is on your resume, review its syntax, lifecycle methods, and best practices beforehand.

Master the STAR Method

Frame behavioral responses using a clear Situation, Task, Action, and Result narrative. Emphasize your personal contribution using "I" rather than ambiguous "we" statements.

Brush Up on Web and API Fundamentals

Understand token authentication, REST verb usage, HTTP status codes, and server-side execution pathways, as these come up frequently across platform and full-stack technical rounds.

Questions & practice

Write a program to parse a text file containing file names and sizes, then output the total accumulated size g

Medium · Practical Coding & Data Processing

Write a program to parse a text file containing file names and sizes, then output the total accumulated size grouped by file extension.

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Describe basic Java, Spring, and Hibernate ORM concepts, including caching and dependency injection.

Medium · Practical Coding & Data Processing

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Explain core Java Collections and multithreading concepts like thread safety and synchronization.

Medium · Practical Coding & Data Processing

Approach

1. Say what the runtime actually does before reasoning about the code.
2. Name what is shared across threads and what owns each piece of state.
3. Identify the window where an invariant is briefly untrue.
4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

• What happens if two callers reach this at the same time?
• Where could this allocate more than you expect?

Walk through a live coding challenge involving string splitting, array processing, or linked list manipulation

Medium · Practical Coding & Data Processing

Walk through a live coding challenge involving string splitting, array processing, or linked list manipulation.

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

1. Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
2. Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
3. For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
4. State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

• A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
• How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Explain why the owner filter ignores the listing index

Medium · composite index · query plans · sort elimination

The only index on resource is (tenant_id, status, updated_at DESC, resource_id DESC). A new endpoint returns one user's resources across all statuses, newest created first: WHERE tenant_id = $1 AND owner_user_id = $2 ORDER BY created_at DESC LIMIT 20. On a tenant with 2M rows it takes 900 ms and EXPLAIN shows a sort above a large scan. Explain precisely why the existing index cannot serve it, give the index that can, and state which of these the new index still will not help: owner_user_id alone across tenants; the same query ordered by updated_at. PostgreSQL 16.

Approach

1. Separate the two jobs an index does. For filtering, a composite btree is seekable only on a left prefix, so with no predicate on status the scan can at best range over tenant_id and test owner_user_id per row; PostgreSQL 16 has no btree skip scan to jump the unconstrained column.
2. For ordering, the index is sorted by (status, updated_at) within a tenant and not by created_at, so the LIMIT cannot stop early: every matching row is read and then sorted. That is the 'Sort Method: top-N heapsort' line, and it is why the plan reads 2M rows to answer with 20.
3. Derive the replacement from the access path — equality, equality, then the ordering column: CREATE INDEX CONCURRENTLY ON resource (tenant_id, owner_user_id, created_at DESC). The scan seeks to the (tenant, owner) range and walks 20 entries in order, so the Sort node disappears along with the row-read.
4. Treat INCLUDE (title, status) as conditional, not free. An index-only scan still visits the heap for any row whose page is not marked all-visible, so on a table taking 1.2k writes/second the win depends on autovacuum keeping the visibility map current, and the wider index costs more on every insert.

Follow-up

• 90% of rows are status='active'. Would a partial index WHERE status = 'active' change your answer, and for which of the three queries?
• A dashboard runs this for 40 owners in one page load. What changes about the design?

Do you have experience in ServiceNow development?

Medium · Enterprise Platforms & Scripting

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

What does .find return vs. what .index return in scripting?

Medium · Enterprise Platforms & Scripting

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

How do author, publisher, and dispatcher components interact in a CMS environment?

Medium · Enterprise Platforms & Scripting

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

Explain the difference between registering a servlet on path versus resource type.

Medium · Enterprise Platforms & Scripting

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

How do you construct and modify server-side script includes in enterprise workflows?

Medium · Enterprise Platforms & Scripting

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

What kind of APIs are you currently working with in your projects?

Medium · Web Architecture & API Security

Approach

1. Say who the caller is and what they do when the call fails halfway.
2. Define the identity of a request so a retry cannot double-apply it.
3. Separate accepted, pending, failed and confirmed; they are different facts.
4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

• What happens if the caller retries after a timeout?
• How does a client discover it is on an old version of this contract?

If you were to push an authentication token to an API and have it verified, how would you architect that flow?

Medium · Web Architecture & API Security

Approach

1. Fix the scope first: who calls this, how often, and what they do when it fails.
2. Name the read and write paths separately; they rarely have the same bottleneck.
3. Choose a partition key and say what query it makes expensive.
4. State the consistency you need, and where you are willing to be stale.

Follow-up

• What breaks first when traffic grows ten times?
• How does this behave when that dependency is down for an hour?

How do you push code changes from a development environment to a production environment safely?

Medium · Web Architecture & API Security

Approach

1. Say who the caller is and what they do when the call fails halfway.
2. Define the identity of a request so a retry cannot double-apply it.
3. Separate accepted, pending, failed and confirmed; they are different facts.
4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

• What happens if the caller retries after a timeout?
• How does a client discover it is on an old version of this contract?

Explain how you would design a RESTful integration between a front-end client and a backend service.

Medium · Web Architecture & API Security

Approach

1. Fix the scope first: who calls this, how often, and what they do when it fails.
2. Name the read and write paths separately; they rarely have the same bottleneck.
3. Choose a partition key and say what query it makes expensive.
4. State the consistency you need, and where you are willing to be stale.

Follow-up

• What breaks first when traffic grows ten times?
• How does this behave when that dependency is down for an hour?

Describe how you secure API endpoints across microservices or enterprise systems.

Medium · Web Architecture & API Security

Approach

1. Say who the caller is and what they do when the call fails halfway.
2. Define the identity of a request so a retry cannot double-apply it.
3. Separate accepted, pending, failed and confirmed; they are different facts.
4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

• What happens if the caller retries after a timeout?
• How does a client discover it is on an old version of this contract?

Every query on one table stalls for forty seconds mid-deploy

Medium · lock contention · ddl · migrations

During a release on PostgreSQL, every query touching resource times out for about 40 seconds and then recovers with no intervention. The release ran one migration, ALTER TABLE resource ADD COLUMN archived_reason TEXT, and the migration log shows it completing in 6 ms. Unrelated tables showed no change in error rate. Explain how a 6 ms statement caused a 40-second stall, give the ordered checks you would run on a live system to confirm it, and give the migration procedure that prevents a repeat.

Approach

1. Separate the statement's duration from the lock's duration. ADD COLUMN with no default is a catalogue-only change and genuinely runs in milliseconds, but it requires ACCESS EXCLUSIVE, and it cannot acquire that until every transaction already touching the table has finished.
2. Account for the queueing, which is the part that surprises people. A lock request that is waiting blocks later requests for conflicting modes behind it rather than letting them overtake, so one long-open transaction holds the DDL and the DDL holds all the traffic. The stall length is set by the longest open transaction, not by the size of the change.
3. Confirm on a live system in this order: pg_stat_activity for that table ordered by xact_start, looking for the oldest transaction and specifically for state = idle in transaction; then pg_locks where granted = false to find the waiter; then join them on pid to name blocker and blocked. pg_blocking_pids() does that join for you and is the fastest single call.
4. Prevent rather than merely time it better. Set lock_timeout to a second or two on the migration session so the DDL abandons the queue after a bounded wait and is retried, instead of holding it for as long as the oldest transaction lives. Be exact about what that buys: queries arriving during the wait still queue behind the pending ACCESS EXCLUSIVE request, so each attempt costs them up to one lock_timeout of added latency. The outage goes from 40 seconds to about one second per attempt, not to zero. Also run migrations away from deploy-time peaks, and put a statement timeout and an idle-in-transaction timeout on the analytics role that opens the long transactions.

Follow-up

• The same release also wants NOT NULL on that column. What is the sequence that gets there without a long lock?
• Your lock_timeout retry fails ten times in a row because the analytics transaction is always open. What do you change?

Suggested practice checklist

Built from the rounds and topics ICF candidates report.

Day 1 — Map the ICF loop

• Write out the reported sequence: Phone Screen, Technical Evaluation, Panel Discussions.
• For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 3 reported rounds, with the weakest marked.

Day 2 — Work Authentication (Auth)

• Spend the session on Authentication (Auth), which ICF candidates report being tested on.
• Write one worked example in Authentication (Auth) and time yourself on it.

Deliverable: One timed worked example in Authentication (Auth).

Day 3 — Work Token-based Authentication (Push token + verify via API)

• Spend the session on Token-based Authentication (Push token + verify via API), which ICF candidates report being tested on.
• Write one worked example in Token-based Authentication (Push token + verify via API) and time yourself on it.

Deliverable: One timed worked example in Token-based Authentication (Push token + verify via API).

Day 4 — Work Problem Solving (Complex situations)

• Spend the session on Problem Solving (Complex situations), which ICF candidates report being tested on.
• Write one worked example in Problem Solving (Complex situations) and time yourself on it.

Deliverable: One timed worked example in Problem Solving (Complex situations).

Day 5 — Answer out loud: Enterprise Platforms & Scripting

• Answer aloud, timed: Do you have experience in ServiceNow development?
• Answer aloud, timed: What does .find return vs. what .index return in scripting?

Deliverable: Spoken answers to 2 reported Enterprise Platforms & Scripting question(s), under time.

Day 6 — Answer out loud: Web Architecture & API Security

• Answer aloud, timed: What kind of APIs are you currently working with in your projects?
• Answer aloud, timed: If you were to push an authentication token to an API and have it verified, how would you architect that flow?

Deliverable: Spoken answers to 2 reported Web Architecture & API Security question(s), under time.

Day 7 — Answer out loud: Practical Coding & Data Processing

• Answer aloud, timed: Write a program to parse a text file containing file names and sizes, then output the total accumulated size grouped by file extension.
• Answer aloud, timed: Describe basic Java, Spring, and Hibernate ORM concepts, including caching and dependency injection.

Deliverable: Spoken answers to 2 reported Practical Coding & Data Processing question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

How do you handle errors and edge cases when consuming third-party API payloads?

Medium · Practical Coding & Data Processing

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

Walk me through a specific technical problem you solved during real-time development.

Medium · Behavioral & Experience Deep Dives

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

Describe a piece of code you worked on that you were particularly proud of and how it impacted the overall pro

Medium · Behavioral & Experience Deep Dives

Describe a piece of code you worked on that you were particularly proud of and how it impacted the overall project.

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

Give me an example of a time you encountered a major challenge on a project and how you resolved it.

Medium · Behavioral & Experience Deep Dives

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

How do you deal with a difficult situation or project setback in your career?

Medium · Behavioral & Experience Deep Dives

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

Tell me about something complex you made on a personal or work project from start to finish.

Medium · Behavioral & Experience Deep Dives

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?