cswork / libraryOpen practice workspace

Interview guides · Mastercard

Mastercard Software Engineer Interview Guide

Mastercard Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

As a Software Engineer at Mastercard, you will build and support the digital backbone that powers global commerce across more than 200 countries and territories. Engineers at Mastercard design, implement, and maintain mission-critical applications that handle billions of secure financial transactions every day. The systems you work on require near-zero latency, massive horizontal scalability, and uncompromised security. In this role, you will work within cross-functional engineering teams driving core platforms such as the Commercial Connect API, Identity Verification Platform, Global File Transfer, and high-throughput transaction processing networks. You will leverage modern software paradigms—including Java microservices, cloud-native deployments, asynchronous event streaming with Kafka, and automated CI/CD pipelines—to solve complex technical challenges at a global scale.

This guide is scoped to a Software Engineer candidate at Mastercard.

Focus areas

  • Authentication (SSO, SAML, OIDC, OAuth 2.0)
  • Core Java
  • Java 8 Stream API

The Mastercard interview process

Mastercard candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

HR Screening Call

Initial call with HR or recruiter to assess candidate's background and fit for the role.

What to demonstrate

  • Initial call with HR or recruiter to assess candidate's background and fit for the role
  • Depth in Authentication (SSO, SAML, OIDC, OAuth 2.0)

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Online Technical Assessment

Assessment testing core data structures, algorithms, or language-specific concepts.

What to demonstrate

  • Assessment testing core data structures, algorithms, or language-specific concepts
  • Depth in Authentication (SSO, SAML, OIDC, OAuth 2.0)

How to prepare

  • Answer aloud and timed: How does the Java Stream API work under the hood, and what are the performance trade-offs between sequential and parallel streams?
  • Answer aloud and timed: What are SOLID principles, and how do you apply them to design maintainable backend services?

Technical Rounds

Live coding and discussions on low-level object-oriented design, framework fundamentals, and distributed system design.

What to demonstrate

  • Live coding and discussions on low-level object-oriented design, framework fundamentals, and distributed system design
  • Depth in Authentication (SSO, SAML, OIDC, OAuth 2.0)

How to prepare

  • Answer aloud and timed: How do you diagnose and resolve a thread deadlock or race condition in a high-concurrency Java application?
  • Answer aloud and timed: Given an array or string of integers, repeatedly sum its digits until a single digit remains. Implement both iterative and recursive solutions and analyze their time and space complexity.

Panel/Super Day Loop

In-depth technical discussion, managerial review, and Bar Raiser interview focusing on culture and problem-solving.

What to demonstrate

  • In-depth technical discussion, managerial review, and Bar Raiser interview focusing on culture and problem-solving
  • Depth in Authentication (SSO, SAML, OIDC, OAuth 2.0)

How to prepare

  • Answer aloud and timed: How would you find the median element across multiple distributed data servers where individual datasets cannot fit entirely in local RAM?
  • Answer aloud and timed: Implement a algorithm to search for a word in a 2D grid of characters (matrix traversal) and count matching anagram occurrences.

Where candidates lose points

Master Core Java & Spring Boot Concepts

Be ready to code without relying heavily on IDE auto-completion. Practice explaining core concepts like Streams, Garbage Collection, Spring Beans, Multithreading, and RESTful API conventions out loud.

Focus on Clean Code and Edge Cases

During live coding tests, write clean, modular, and readable code. Always validate input constraints, talk through boundary conditions, and state your time and space complexities explicitly.

Designing for a scale nobody asked for

Ask for request rate, data size, read-to-write ratio and expected growth, then size the simplest option first; one relational instance on current hardware covers a large share of real workloads. Reaching for shards, queues and a cache tier before any number has been quoted reads as pattern-matching rather than judgement.

Questions & practice

What are the key differences between Java 8, 17, and 21, and how do modern features like Streams, Records, or

Medium · Core Java & Object-Oriented Programming

What are the key differences between Java 8, 17, and 21, and how do modern features like Streams, Records, or Virtual Threads improve performance?

Approach

  1. Say what the runtime actually does before reasoning about the code.
  2. Name what is shared across threads and what owns each piece of state.
  3. Identify the window where an invariant is briefly untrue.
  4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

  • What happens if two callers reach this at the same time?
  • Where could this allocate more than you expect?

Explain the Singleton design pattern. How do you implement thread safety and lazy initialization in a multithr

Medium · Core Java & Object-Oriented Programming

Explain the Singleton design pattern. How do you implement thread safety and lazy initialization in a multithreaded production environment?

Approach

  1. Say what the runtime actually does before reasoning about the code.
  2. Name what is shared across threads and what owns each piece of state.
  3. Identify the window where an invariant is briefly untrue.
  4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

  • What happens if two callers reach this at the same time?
  • Where could this allocate more than you expect?

How do you diagnose and resolve a thread deadlock or race condition in a high-concurrency Java application?

Medium · Core Java & Object-Oriented Programming

Approach

  1. Say what the runtime actually does before reasoning about the code.
  2. Name what is shared across threads and what owns each piece of state.
  3. Identify the window where an invariant is briefly untrue.
  4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

  • What happens if two callers reach this at the same time?
  • Where could this allocate more than you expect?

Given an array or string of integers, repeatedly sum its digits until a single digit remains. Implement both i

Medium · Data Structures & Algorithmic Problem-So

Given an array or string of integers, repeatedly sum its digits until a single digit remains. Implement both iterative and recursive solutions and analyze their time and space complexity.

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Implement a algorithm to search for a word in a 2D grid of characters (matrix traversal) and count matching an

Medium · Data Structures & Algorithmic Problem-So

Implement a algorithm to search for a word in a 2D grid of characters (matrix traversal) and count matching anagram occurrences.

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Given a set of time intervals, merge all overlapping intervals and return an array of non-overlapping time win

Medium · Data Structures & Algorithmic Problem-So

Given a set of time intervals, merge all overlapping intervals and return an array of non-overlapping time windows.

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Explain the internal workings of a HashMap in Java. How are hash collisions resolved, and how does dynamic res

Medium · Data Structures & Algorithmic Problem-So

Explain the internal workings of a HashMap in Java. How are hash collisions resolved, and how does dynamic resizing impact runtime efficiency?

Approach

  1. Say what the runtime actually does before reasoning about the code.
  2. Name what is shared across threads and what owns each piece of state.
  3. Identify the window where an invariant is briefly untrue.
  4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

  • What happens if two callers reach this at the same time?
  • Where could this allocate more than you expect?

Write the update path that detects a concurrent edit

Medium · optimistic concurrency · transactional outbox · audit history

resource carries version INT NOT NULL DEFAULT 1. resource_revision holds revision_id, resource_id, version, actor_user_id, change_kind, patch JSONB, request_id, created_at with UNIQUE (resource_id, version). outbox_event holds aggregate_type, aggregate_id, aggregate_version, event_type, payload, status. A PUT carries the version the client read. Write the exact statements for the single transaction that applies the edit, records the revision and enqueues 'resource.updated', and give the handler's branch on zero affected rows. Then say what PostgreSQL 16 does under READ COMMITTED when two of these updates hit one row at once.

Approach

  1. One transaction, three writes, no network call inside it: UPDATE resource SET title = $3, version = version + 1, updated_at = now() WHERE resource_id = $1 AND tenant_id = $4 AND version = $2; then INSERT the resource_revision row at version $2 + 1; then INSERT the outbox_event row at the same aggregate_version. The event goes to a table rather than a broker because no transaction spans both.
  2. Branch on the affected-row count before doing anything else. Zero has three causes — stale version, wrong tenant, row gone — so re-read once and map to 409 carrying the current version, or 404 for an id outside the caller's tenant, which also stops the endpoint confirming that another tenant's id exists.
  3. State the engine behaviour instead of assuming it. Under READ COMMITTED the second UPDATE blocks on the row lock, and when the first commits PostgreSQL re-evaluates the WHERE clause against the newly committed row, so the version predicate now fails and the statement reports zero rows. Under REPEATABLE READ the identical collision raises SQLSTATE 40001 instead, so the handler must fold both shapes into one conflict response.
  4. Keep UNIQUE (resource_id, version) even though the predicate already serialises writers. It is what makes a lost update unwritable if any other path ever reaches the revision table, and it converts a logic bug into 23505 rather than into a silently missing history row.

Follow-up

  • A client sends the version it read ten minutes ago and the resource has moved three versions. What is in your 409 so it can resolve the conflict without a full re-fetch?
  • Two editors, two disjoint fields, no overlap. Does your answer still refuse the second write, and should it?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

  1. Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
  2. Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
  3. For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
  4. State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

  • A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
  • How do you honour an erasure request while resource_revision.actor_user_id still references this table?

How does the Java Stream API work under the hood, and what are the performance trade-offs between sequential a

Medium · Core Java & Object-Oriented Programming

How does the Java Stream API work under the hood, and what are the performance trade-offs between sequential and parallel streams?

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

What are SOLID principles, and how do you apply them to design maintainable backend services?

Medium · Core Java & Object-Oriented Programming

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How would you find the median element across multiple distributed data servers where individual datasets canno

Medium · Data Structures & Algorithmic Problem-So

How would you find the median element across multiple distributed data servers where individual datasets cannot fit entirely in local RAM?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

How would you design a high-throughput API gateway capable of managing authentication, rate limiting, and requ

Medium · System Design & Microservices Architectu

How would you design a high-throughput API gateway capable of managing authentication, rate limiting, and request routing across hundreds of microservices?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Explain the key principles of the 12-Factor App methodology and how they guide cloud-native application deploy

Medium · System Design & Microservices Architectu

Explain the key principles of the 12-Factor App methodology and how they guide cloud-native application deployment.

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Compare embedded caching strategies (e.g., local in-memory cache) with external distributed caches (e.g., Redi

Medium · System Design & Microservices Architectu

Compare embedded caching strategies (e.g., local in-memory cache) with external distributed caches (e.g., Redis). When should each be utilized?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

How do you manage database transactions, ACID guarantees, rollbacks, and savepoints across distributed microse

Medium · System Design & Microservices Architectu

How do you manage database transactions, ACID guarantees, rollbacks, and savepoints across distributed microservices?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Describe an event-driven architecture using Apache Kafka. How do you handle message ordering, partition scalin

Medium · System Design & Microservices Architectu

Describe an event-driven architecture using Apache Kafka. How do you handle message ordering, partition scaling, and dead-letter queues?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

What are the structural components of a JSON Web Token (JWT), and how do you ensure secure transmission and ve

Medium · Security & Authentication Protocols

What are the structural components of a JSON Web Token (JWT), and how do you ensure secure transmission and verification without exposing sensitive payloads?

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

Explain the differences between OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0, along with their respective re

Medium · Security & Authentication Protocols

Explain the differences between OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0, along with their respective real-world use cases.

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How do you implement secure communication channels and data encryption both in transit (TLS/mTLS) and at rest

Medium · Security & Authentication Protocols

How do you implement secure communication channels and data encryption both in transit (TLS/mTLS) and at rest across cloud services?

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

What is System for Cross-domain Identity Management (SCIM), and how does it integrate with enterprise Single S

Medium · Security & Authentication Protocols

What is System for Cross-domain Identity Management (SCIM), and how does it integrate with enterprise Single Sign-On (SSO) frameworks?

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

Tell me about a time when a critical production issue or bug occurred under tight deadlines. What steps did yo

Medium · Behavioral & Leadership Scenarios

Tell me about a time when a critical production issue or bug occurred under tight deadlines. What steps did you take to triage, debug, and implement a long-term fix?

Approach

  1. Establish what changed and when, before forming any theory.
  2. Pick a bisection that eliminates candidates whichever way it turns out.
  3. Check the instrumentation before believing the symptom.
  4. Separate the trigger from the cause; the deploy is rarely the bug.

Follow-up

  • What would you look at first, and what would it rule out?
  • How would you tell a cause from a coincidence here?

Suggested practice checklist

Built from the rounds and topics Mastercard candidates report.

Day 1 — Map the Mastercard loop

  • Write out the reported sequence: HR Screening Call, Online Technical Assessment, Technical Rounds, Panel/Super Day Loop.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work Authentication (SSO, SAML, OIDC, OAuth 2.0)

  • Spend the session on Authentication (SSO, SAML, OIDC, OAuth 2.0), which Mastercard candidates report being tested on.
  • Write one worked example in Authentication (SSO, SAML, OIDC, OAuth 2.0) and time yourself on it.

Deliverable: One timed worked example in Authentication (SSO, SAML, OIDC, OAuth 2.0).

Day 3 — Work Core Java

  • Spend the session on Core Java, which Mastercard candidates report being tested on.
  • Write one worked example in Core Java and time yourself on it.

Deliverable: One timed worked example in Core Java.

Day 4 — Work Java 8 Stream API

  • Spend the session on Java 8 Stream API, which Mastercard candidates report being tested on.
  • Write one worked example in Java 8 Stream API and time yourself on it.

Deliverable: One timed worked example in Java 8 Stream API.

Day 5 — Answer out loud: Core Java & Object-Oriented Programming

  • Answer aloud, timed: What are the key differences between Java 8, 17, and 21, and how do modern features like Streams, Records, or Virtual Threads improve performance?
  • Answer aloud, timed: Explain the Singleton design pattern. How do you implement thread safety and lazy initialization in a multithreaded production environment?

Deliverable: Spoken answers to 2 reported Core Java & Object-Oriented Programming question(s), under time.

Day 6 — Answer out loud: Data Structures & Algorithmic Problem-Solving

  • Answer aloud, timed: Given an array or string of integers, repeatedly sum its digits until a single digit remains. Implement both iterative and recursive solutions and analyze their time and space complexity.
  • Answer aloud, timed: How would you find the median element across multiple distributed data servers where individual datasets cannot fit entirely in local RAM?

Deliverable: Spoken answers to 2 reported Data Structures & Algorithmic Problem-Solving question(s), under time.

Day 7 — Answer out loud: System Design & Microservices Architecture

  • Answer aloud, timed: How would you design a high-throughput API gateway capable of managing authentication, rate limiting, and request routing across hundreds of microservices?
  • Answer aloud, timed: Explain the key principles of the 12-Factor App methodology and how they guide cloud-native application deployment.

Deliverable: Spoken answers to 2 reported System Design & Microservices Architecture question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

Describe a situation where you had a significant technical disagreement with a team member or architect regard

Medium · Behavioral & Leadership Scenarios

Describe a situation where you had a significant technical disagreement with a team member or architect regarding project design. How did you resolve it?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you prioritize non-functional requirements—such as security, monitoring, and performance—alongside fast

Medium · Behavioral & Leadership Scenarios

How do you prioritize non-functional requirements—such as security, monitoring, and performance—alongside fast-paced feature delivery?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Describe a project where you had to learn a completely new technology or framework independently to meet tight

Medium · Behavioral & Leadership Scenarios

Describe a project where you had to learn a completely new technology or framework independently to meet tight delivery milestones.

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?