Interview guides · JOHN LEONARD

JOHN LEONARD Software Engineer Interview Guide

JOHN LEONARD Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

A Software Engineer at JOHN LEONARD plays a pivotal role in maintaining the technical infrastructure that supports our core business operations. You are not just writing code; you are building robust, scalable systems that ensure high availability and efficiency. This position is critical to our mission of providing seamless service, requiring a blend of strong technical acumen and the ability to solve complex problems under pressure. You will contribute to a variety of initiatives, ranging from the optimization of backend microservices to the development of user-centric features. The work is challenging and intellectually stimulating, often requiring you to navigate legacy systems while integrating modern technologies.

This guide is scoped to a Software Engineer candidate at JOHN LEONARD.

Focus areas

Behavioral Interviews (STAR format)
Coding Challenges (algorithmic problem solving)
Java (Spring Boot focus)

The JOHN LEONARD interview process

JOHN LEONARD candidates report 2 rounds over 2-4 weeks. The stages below are what candidates describe, not a published process.

Asynchronous Virtual Assessment

Begin with a mix of behavioral video responses and technical coding tasks.

What to demonstrate

Begin with a mix of behavioral video responses and technical coding tasks
Depth in Behavioral Interviews (STAR format)

How to prepare

Answer aloud and timed: Tell me about yourself and your professional background.
Answer aloud and timed: Describe a time when something went wrong in a project; how did you handle it?

Live Technical Discussions

Engage in discussions with hiring managers and senior engineering staff.

What to demonstrate

Engage in discussions with hiring managers and senior engineering staff
Depth in Behavioral Interviews (STAR format)

How to prepare

Answer aloud and timed: How do you balance competing priorities when you have multiple urgent tasks?
Answer aloud and timed: Why do you want to work for JOHN LEONARD?

Where candidates lose points

Master the STAR Method

Practice answering behavioral questions out loud until your stories are concise and impactful.

Explain Your Code

During coding tasks, narrate your thoughts. An interviewer—or the review team—wants to understand your logic, not just see the result.

Research the Tech Stack

If the job posting mentions specific technologies like Spring Boot, ensure you are comfortable discussing their core components.

Stay Positive

Even in asynchronous video interviews, maintain an enthusiastic and professional demeanor; it reflects your potential as a team player.

Questions & practice

Explain the core principles of OOP and provide real-world examples of how you have applied them.

Medium · Technical & Coding

Approach

Restate the input: its shape, its size, and what is guaranteed about it.
Name the brute-force solution and its complexity before improving on it.
Choose the data structure from the access pattern, not from familiarity.
State the target complexity and say which constraint rules the naive version out.

Follow-up

How does this change if the input no longer fits in memory?
What is the worst case, and how likely is it on real data?

Walk me through your thought process for solving a complex coding problem.

Medium · Technical & Coding

Approach

Restate the input: its shape, its size, and what is guaranteed about it.
Name the brute-force solution and its complexity before improving on it.
Choose the data structure from the access pattern, not from familiarity.
State the target complexity and say which constraint rules the naive version out.

Follow-up

How does this change if the input no longer fits in memory?
What is the worst case, and how likely is it on real data?

Describe a challenging technical bug you encountered and the steps you took to resolve it.

Medium · Technical & Coding

Approach

Restate the input: its shape, its size, and what is guaranteed about it.
Name the brute-force solution and its complexity before improving on it.
Choose the data structure from the access pattern, not from familiarity.
State the target complexity and say which constraint rules the naive version out.

Follow-up

How does this change if the input no longer fits in memory?
What is the worst case, and how likely is it on real data?

Given a specific code snippet, what would the output be and why?

Medium · Technical & Coding

Approach

Restate the input: its shape, its size, and what is guaranteed about it.
Name the brute-force solution and its complexity before improving on it.
Choose the data structure from the access pattern, not from familiarity.
State the target complexity and say which constraint rules the naive version out.

Follow-up

How does this change if the input no longer fits in memory?
What is the worst case, and how likely is it on real data?

How would you optimize a database query for a high-traffic application?

Medium · Technical & Coding

Approach

Name the grain you start from and join outward from it.
Check whether any join is one-to-many before aggregating, or the sums inflate.
Say which index the query would use, and what makes it unusable.
Handle the rows that do not match: that is usually the actual question.

Follow-up

How does the query change if that join becomes one-to-many?
What happens to this when the table is ten times larger?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Make resource creation safe for a client that retried a timeout

Medium · idempotency · retries · race conditions

POST /v1/resources creates a resource row and, in the same transaction, a resource_revision and an outbox_event. A partner's HTTP client times out at 2 seconds and retries twice; under load the first request is still executing when the retry arrives, and duplicate resources are appearing. Using idempotency_key (tenant_id, idempotency_key, request_fingerprint, state, response_status, response_body, resource_id, locked_until, expires_at), specify the whole contract: first call, concurrent retry, retry after completion, a key reused with a different body, and what the client does with each response.

Approach

Name why the plain REST shape fails here. POST is not idempotent, a timeout leaves the client unable to distinguish a lost request from a lost response, so it must retry - and the retry is a second create. Checking whether the key exists and then inserting it is check-then-act: under exactly the concurrency that caused the timeout, both attempts look, both see nothing, both proceed.
Let the unique constraint arbitrate instead. INSERT the key row with state 'in_flight' and locked_until set to now plus the request deadline, and commit that reservation on its own before any work is attempted - an uncommitted row is invisible to the concurrent retry, which is the entire point of writing it first. One caller wins the insert and proceeds; the other takes the unique violation and reads the row rather than falling through to the work.
Branch the loser on what it found. 'succeeded' replays response_status and response_body verbatim, with a header marking it a replay. 'in_flight' with locked_until in the future returns 409 and a Retry-After - do not park a request thread waiting on another request, that is how a concurrency bound is consumed by retries. 'in_flight' past locked_until is reclaimable by a conditional UPDATE predicated on the old locked_until, so exactly one reclaimer wins. A fingerprint mismatch is 422 and never the stored response: a different body under the same key is a client defect, and serving the old response hides it forever.
Commit the effect and the key's completion together - resource insert, revision row, outbox row, and the UPDATE of the reserved key to 'succeeded' with the stored response, in one transaction. That makes a crash binary: either all of it is durable and the key reads 'succeeded', or the transaction rolls back and the only durable trace is the reservation row, still 'in_flight', with no resource behind it. The reclaim branch finishes that case - once locked_until passes, one retry takes the row by conditional UPDATE and runs the work for the first time. Splitting the two commits is what creates the window with no recovery: the effect durable, the key still 'in_flight', and a reclaimer that cannot distinguish that from work never started, so it creates a second resource.

Follow-up

Response bodies are pruned at 24 hours but resource_id is kept. What do you return to a replay that arrives after pruning?
The endpoint now also sends a welcome email. Which part of this contract prevents a second send, and which part cannot?

Design the async export contract a client can resume safely

Hard · async operations · idempotency · leases

A tenant asks for a CSV of every resource. The work runs for minutes on the worker fleet through a job_run row carrying a lease, an attempt count and a dedupe_key, far past the edge's 400 ms budget. Callers are a browser that polls and a script that walks away and checks later. Specify what the submit call returns, the operation resource and its states, how a duplicate submit is handled, how a client learns about completion, what cancellation means given that a lease can expire mid-run, and how the result is fetched and when it expires.

Approach

Split the API in two. Submit returns 202 with an operation id and a location to poll, and never blocks on the work. The operation is a real resource with its own lifecycle - queued, running, succeeded, failed, cancelled - plus attempt, a monotonic progress figure, and a terminal error drawn from the same code taxonomy the synchronous endpoints use, so a client needs one error vocabulary rather than two.
Deduplicate at submit using job_run.dedupe_key, unique over (job_type, dedupe_key) while status is 'queued' or 'running': a repeat submit of the same logical export returns 200 with the existing operation instead of 202 with a new one, and the partial index deliberately permits a legitimate re-run once the first has finished. Pair it with the request's idempotency key so an HTTP-level retry of the submit is exact rather than merely similar.
Tell the poller how to poll: Retry-After on the polling response, a minimum interval enforced at the edge, and a documented maximum lifetime after which an operation is reaped. Polling is the contract of record; the webhook is the fast path, and both must lead to the same terminal state, so a client that receives the completion event and then polls anyway sees no contradiction.
Be exact about cancellation. A cancel request records intent; it cannot stop work already executing. The handler reads the flag at checkpoints, and because a lease expires on a clock that cannot distinguish a dead worker from a slow one, a second copy may start after the cancel was recorded - so the handler re-reads the flag immediately after claiming the lease. 'cancelled' becomes terminal only when no lease is outstanding; reporting it earlier shows a client a stopped job while a worker is still writing output.

Follow-up

An operation has said 'running' for 40 minutes and the worker is gone. What does the client see, and which columns in job_run decide that?
Two tenants each submit 50 exports at once. What in this contract stops one of them delaying the other?

One customer endpoint stalls deliveries to every other destination

Medium · bulkhead · timeouts · saturation

The egress service delivers about 1.5k webhooks/second across 40,000 destinations, with a per-destination concurrency cap of 4 and a 10-second connect-plus-read timeout. Throughput falls to 300/second, queue depth climbs, and p99 delivery latency for unaffected destinations goes from 200 ms to minutes, while the error rate barely moves. One tenant holds 900 destination rows whose URLs share a hostname that now answers in 9.5 seconds. Explain the mechanism with the arithmetic, then give the containment in the order you would apply it.

Approach

Look at saturation before errors. A flat error rate with collapsing throughput says nothing is failing, things are waiting, so the first signal to pull is in-flight request count or pool wait time rather than the error counter. This is the distinction that decides the whole investigation.
Group in-flight work by resolved host, not by destination id. The cap is keyed per destination row, so 900 rows sharing one hostname buy 3,600 concurrent slots against a single host, each held for 9.5 seconds. The bulkhead was never a bulkhead for that host, and grouping by the wrong dimension is why the dashboard looked healthy.
Do the arithmetic in both directions. Required concurrency is arrival rate times latency, so 1.5k/second at 200 ms needs about 300 in flight, which is entirely consumed by 3,600 slow slots; conversely whatever concurrency is left sustains rate equals concurrency divided by 9.5 seconds, which is the 300/second you are seeing. Matching both numbers is what promotes this from a plausible story to the mechanism.
Explain why the circuit breaker never helped. It opens on consecutive failures, and a 9.5-second response inside a 10-second timeout is a success. Slow is not failing, so an error-rate breaker cannot see this; you need a slow-call ratio, a deadline propagated from the caller's remaining budget, or a concurrency limiter.

Follow-up

The host recovers to 80 ms. How long does the queue take to drain, and what does the drain do to the recovered host?
Where should the 10-second timeout number actually come from?

Suggested practice checklist

Built from the rounds and topics JOHN LEONARD candidates report.

Day 1 — Map the JOHN LEONARD loop

Write out the reported sequence: Asynchronous Virtual Assessment, Live Technical Discussions.
For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 2 reported rounds, with the weakest marked.

Day 2 — Work Behavioral Interviews (STAR format)

Spend the session on Behavioral Interviews (STAR format), which JOHN LEONARD candidates report being tested on.
Write one worked example in Behavioral Interviews (STAR format) and time yourself on it.

Deliverable: One timed worked example in Behavioral Interviews (STAR format).

Day 3 — Work Coding Challenges (algorithmic problem solving)

Spend the session on Coding Challenges (algorithmic problem solving), which JOHN LEONARD candidates report being tested on.
Write one worked example in Coding Challenges (algorithmic problem solving) and time yourself on it.

Deliverable: One timed worked example in Coding Challenges (algorithmic problem solving).

Day 4 — Work Java (Spring Boot focus)

Spend the session on Java (Spring Boot focus), which JOHN LEONARD candidates report being tested on.
Write one worked example in Java (Spring Boot focus) and time yourself on it.

Deliverable: One timed worked example in Java (Spring Boot focus).

Day 5 — Answer out loud: Behavioral & STAR Method

Answer aloud, timed: Tell me about yourself and your professional background.
Answer aloud, timed: Describe a time when something went wrong in a project; how did you handle it?

Deliverable: Spoken answers to 2 reported Behavioral & STAR Method question(s), under time.

Day 6 — Answer out loud: Technical & Coding

Answer aloud, timed: Explain the core principles of OOP and provide real-world examples of how you have applied them.
Answer aloud, timed: Walk me through your thought process for solving a complex coding problem.

Deliverable: Spoken answers to 2 reported Technical & Coding question(s), under time.

Day 7 — Dry run for JOHN LEONARD

Run one full mock under time, then write down the two questions you most want to ask your interviewers.

Deliverable: A completed timed mock and two questions to ask.