cswork / libraryOpen practice workspace

Interview guides · Palmetto

Palmetto Software Engineer Interview Guide

Palmetto Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

A Software Engineer at Palmetto is responsible for building and scaling the technological backbone of the clean energy transition. Palmetto operates at the unique intersection of B2B and D2C, providing a clean-tech platform that empowers homeowners, solar sales professionals, and installation companies to adopt and manage renewable energy solutions. As a Software Engineer, your work directly impacts the democratization of residential solar power, energy storage, and whole-home electrification. You will join a team that owns critical software systems, ranging from the Palmetto Home Financing Platform—which manages underwriting, origination, onboarding, and servicing—to the Intelligence Platform, which leverages applied AI and complex energy data models to optimize clean energy distribution.

This guide is scoped to a Software Engineer candidate at Palmetto.

Focus areas

  • Servicing workflows
  • Web application development
  • Origination workflow (fintech/financial platform)

The Palmetto interview process

Palmetto candidates report 5 rounds over 4-6 weeks. The stages below are what candidates describe, not a published process.

Recruiter Screening

Initial discussion about your background and interest in clean-tech.

What to demonstrate

  • Initial discussion about your background and interest in clean-tech
  • Depth in Servicing workflows

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Screen

Interview with engineering leadership focusing on high-level architecture and stack-specific questions.

What to demonstrate

  • Interview with engineering leadership focusing on high-level architecture and stack-specific questions
  • Depth in Servicing workflows

How to prepare

  • Answer aloud and timed: Explain the concept of database indexing. How do you identify which columns to index in a high-write versus a high-read application?
  • Answer aloud and timed: What are some common security vulnerabilities in REST APIs, and how do you mitigate them?

Take-Home Technical Task

Assignment to complete a technical task that serves as the foundation for further evaluation.

What to demonstrate

  • Assignment to complete a technical task that serves as the foundation for further evaluation
  • Depth in Servicing workflows

How to prepare

  • Answer aloud and timed: Describe your experience working with containerization tools like Docker and how they fit into your local development workflow.
  • Answer aloud and timed: Walk me through the architecture of a platform that integrates with multiple external third-party APIs (e.g., financial capital providers or utility data services). How do you handle rate limits and API failures?

Live Code Review

Session with peer engineers to review and extend the take-home technical task.

What to demonstrate

  • Session with peer engineers to review and extend the take-home technical task
  • Depth in Servicing workflows

How to prepare

  • Answer aloud and timed: How would you design a data schema to handle complex, fragmented consumer energy usage data that updates in real-time?
  • Answer aloud and timed: What strategies would you use to identify, measure, and address performance bottlenecks in a distributed data system?

Culture and Values Interview

Final interview to assess alignment with company culture and values.

What to demonstrate

  • Final interview to assess alignment with company culture and values
  • Depth in Servicing workflows

How to prepare

  • Prepare three examples from your own work, each with a decision you made and an outcome you can quantify.
  • Re-read the description of the culture and values interview above and write down what you would ask to confirm before it.

Where candidates lose points

Treat the Take-Home Task Like Production Code

Do not cut corners on your take-home assignment. Write comprehensive unit tests, organize your files logically, and include a highly detailed README. Your code will be reviewed by senior leadership, and a polished submission sets a strong positive tone for the rest of the process.

Practice Live Code Modification

Before your live technical interview, practice taking an existing codebase and adding new features under a time constraint. Focus on writing extensible code during your take-home so that making live modifications during the interview is seamless and stress-free.

Finishing a solution without stating its complexity

Give time and space in the same breath as the code, and define n explicitly when there are two sizes, since n nodes and m edges are not interchangeable. Space is the half that gets skipped: count the auxiliary structures you allocate and the recursion stack at its deepest, not only the answer you hand back.

Questions & practice

Write a function that parses a nested JSON payload of energy metrics and returns a structured summary, handlin

Medium · Live Coding & Problem Solving

Write a function that parses a nested JSON payload of energy metrics and returns a structured summary, handling missing or malformed data gracefully.

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Walk through a live refactoring of a piece of code to improve its time complexity and readability.

Medium · Live Coding & Problem Solving

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Archive a resource graph without breaking live references or recursing

Medium · graph traversal · topological order · tenant isolation

Resources reference other resources within a tenant; for the largest tenant the reference table holds up to 2,000,000 nodes and 8,000,000 edges. Archiving a resource must archive everything reachable from it that nothing outside the set still references, refuse when a live external referrer exists, and terminate when references form cycles, which they legitimately do. Produce the archive order and the refusal list, targeting O(V+E). Say what stops the traversal crossing a tenant boundary, and why recursion is the wrong control structure at this size.

Approach

  1. Load the subgraph with the tenant predicate on both endpoints of the edge, not only on the side you started from. Scoping the left table alone is the classic cross-tenant leak: one mis-entered edge then pulls another tenant's resources into the traversal and, worse, into the archive.
  2. Traverse iteratively with an explicit stack. A 2,000,000-node graph can hold a chain deep enough to exhaust a native stack in the low tens of thousands of frames, and that failure is a process crash rather than an error you can return.
  3. Treat cycles as data rather than corruption: compute strongly connected components with Tarjan in O(V+E) using its own explicit stack, then condense. The condensation is a DAG, so a topological order over it gives the archive order, and every member of a component archives in one transaction because no order within a cycle is valid.
  4. Decide refusals with reverse edges. A candidate is archivable only if every in-edge originates inside the candidate set, so build the transpose or count in-degrees restricted to the visited set, and emit each blocked resource with the id of the external referrer, which is the only part of the answer an operator can act on.

Follow-up

  • The graph is read in one query and the archive writes a minute later. What can change in between, and how do you make the write safe?
  • The candidate set is 400,000 resources. Is that one transaction, and if not, what does a half-finished archive look like to a reader?

Explain the concept of database indexing. How do you identify which columns to index in a high-write versus a

Medium · Technical & Stack Alignment

Explain the concept of database indexing. How do you identify which columns to index in a high-write versus a high-read application?

Approach

  1. Name the grain you start from and join outward from it.
  2. Check whether any join is one-to-many before aggregating, or the sums inflate.
  3. Say which index the query would use, and what makes it unusable.
  4. Handle the rows that do not match: that is usually the actual question.

Follow-up

  • How does the query change if that join becomes one-to-many?
  • What happens to this when the table is ten times larger?

Explain why the owner filter ignores the listing index

Medium · composite index · query plans · sort elimination

The only index on resource is (tenant_id, status, updated_at DESC, resource_id DESC). A new endpoint returns one user's resources across all statuses, newest created first: WHERE tenant_id = $1 AND owner_user_id = $2 ORDER BY created_at DESC LIMIT 20. On a tenant with 2M rows it takes 900 ms and EXPLAIN shows a sort above a large scan. Explain precisely why the existing index cannot serve it, give the index that can, and state which of these the new index still will not help: owner_user_id alone across tenants; the same query ordered by updated_at. PostgreSQL 16.

Approach

  1. Separate the two jobs an index does. For filtering, a composite btree is seekable only on a left prefix, so with no predicate on status the scan can at best range over tenant_id and test owner_user_id per row; PostgreSQL 16 has no btree skip scan to jump the unconstrained column.
  2. For ordering, the index is sorted by (status, updated_at) within a tenant and not by created_at, so the LIMIT cannot stop early: every matching row is read and then sorted. That is the 'Sort Method: top-N heapsort' line, and it is why the plan reads 2M rows to answer with 20.
  3. Derive the replacement from the access path — equality, equality, then the ordering column: CREATE INDEX CONCURRENTLY ON resource (tenant_id, owner_user_id, created_at DESC). The scan seeks to the (tenant, owner) range and walks 20 entries in order, so the Sort node disappears along with the row-read.
  4. Treat INCLUDE (title, status) as conditional, not free. An index-only scan still visits the heap for any row whose page is not marked all-visible, so on a table taking 1.2k writes/second the win depends on autovacuum keeping the visibility map current, and the wider index costs more on every insert.

Follow-up

  • 90% of rows are status='active'. Would a partial index WHERE status = 'active' change your answer, and for which of the three queries?
  • A dashboard runs this for 40 owners in one page load. What changes about the design?

Have you used technology X, and what are the major pros and cons of using it over technology Y in production?

Medium · Technical & Stack Alignment

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

What are some common security vulnerabilities in REST APIs, and how do you mitigate them?

Medium · Technical & Stack Alignment

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

Walk me through the architecture of a platform that integrates with multiple external third-party APIs (e.g.,

Medium · Live Architecture & System Design

Walk me through the architecture of a platform that integrates with multiple external third-party APIs (e.g., financial capital providers or utility data services). How do you handle rate limits and API failures?

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

How would you design a data schema to handle complex, fragmented consumer energy usage data that updates in re

Medium · Live Architecture & System Design

How would you design a data schema to handle complex, fragmented consumer energy usage data that updates in real-time?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

What strategies would you use to identify, measure, and address performance bottlenecks in a distributed data

Medium · Live Architecture & System Design

What strategies would you use to identify, measure, and address performance bottlenecks in a distributed data system?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Design a system that supports a high-volume document upload and verification workflow for financing originatio

Medium · Live Architecture & System Design

Design a system that supports a high-volume document upload and verification workflow for financing origination.

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

How do you ensure data consistency across microservices when processing a multi-step transaction, such as a lo

Medium · Live Architecture & System Design

How do you ensure data consistency across microservices when processing a multi-step transaction, such as a loan underwriting approval?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Modify this existing weather application to support a new requirement: cache the API responses locally for 10

Medium · Live Coding & Problem Solving

Modify this existing weather application to support a new requirement: cache the API responses locally for 10 minutes and implement a manual refresh button.

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

Implement a basic rate-limiting algorithm to protect an API endpoint from being abused by client applications.

Medium · Live Coding & Problem Solving

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

Every query on one table stalls for forty seconds mid-deploy

Medium · lock contention · ddl · migrations

During a release on PostgreSQL, every query touching resource times out for about 40 seconds and then recovers with no intervention. The release ran one migration, ALTER TABLE resource ADD COLUMN archived_reason TEXT, and the migration log shows it completing in 6 ms. Unrelated tables showed no change in error rate. Explain how a 6 ms statement caused a 40-second stall, give the ordered checks you would run on a live system to confirm it, and give the migration procedure that prevents a repeat.

Approach

  1. Separate the statement's duration from the lock's duration. ADD COLUMN with no default is a catalogue-only change and genuinely runs in milliseconds, but it requires ACCESS EXCLUSIVE, and it cannot acquire that until every transaction already touching the table has finished.
  2. Account for the queueing, which is the part that surprises people. A lock request that is waiting blocks later requests for conflicting modes behind it rather than letting them overtake, so one long-open transaction holds the DDL and the DDL holds all the traffic. The stall length is set by the longest open transaction, not by the size of the change.
  3. Confirm on a live system in this order: pg_stat_activity for that table ordered by xact_start, looking for the oldest transaction and specifically for state = idle in transaction; then pg_locks where granted = false to find the waiter; then join them on pid to name blocker and blocked. pg_blocking_pids() does that join for you and is the fastest single call.
  4. Prevent rather than merely time it better. Set lock_timeout to a second or two on the migration session so the DDL abandons the queue after a bounded wait and is retried, instead of holding it for as long as the oldest transaction lives. Be exact about what that buys: queries arriving during the wait still queue behind the pending ACCESS EXCLUSIVE request, so each attempt costs them up to one lock_timeout of added latency. The outage goes from 40 seconds to about one second per attempt, not to zero. Also run migrations away from deploy-time peaks, and put a statement timeout and an idle-in-transaction timeout on the analytics role that opens the long transactions.

Follow-up

  • The same release also wants NOT NULL on that column. What is the sequence that gets there without a long lock?
  • Your lock_timeout retry fails ten times in a row because the analytics transaction is always open. What do you change?

Suggested practice checklist

Built from the rounds and topics Palmetto candidates report.

Day 1 — Map the Palmetto loop

  • Write out the reported sequence: Recruiter Screening, Technical Screen, Take-Home Technical Task, Live Code Review, Culture and Values Interview.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 5 reported rounds, with the weakest marked.

Day 2 — Work Servicing workflows

  • Spend the session on Servicing workflows, which Palmetto candidates report being tested on.
  • Write one worked example in Servicing workflows and time yourself on it.

Deliverable: One timed worked example in Servicing workflows.

Day 3 — Work Web application development

  • Spend the session on Web application development, which Palmetto candidates report being tested on.
  • Write one worked example in Web application development and time yourself on it.

Deliverable: One timed worked example in Web application development.

Day 4 — Work Origination workflow (fintech/financial platform)

  • Spend the session on Origination workflow (fintech/financial platform), which Palmetto candidates report being tested on.
  • Write one worked example in Origination workflow (fintech/financial platform) and time yourself on it.

Deliverable: One timed worked example in Origination workflow (fintech/financial platform).

Day 5 — Answer out loud: Technical & Stack Alignment

  • Answer aloud, timed: Have you used technology X, and what are the major pros and cons of using it over technology Y in production?
  • Answer aloud, timed: How do you handle state management in a modern frontend application, and when would you choose a global store over local component state?

Deliverable: Spoken answers to 2 reported Technical & Stack Alignment question(s), under time.

Day 6 — Answer out loud: Live Architecture & System Design

  • Answer aloud, timed: Walk me through the architecture of a platform that integrates with multiple external third-party APIs (e.g., financial capital providers or utility data services). How do you handle rate limits and API failures?
  • Answer aloud, timed: How would you design a data schema to handle complex, fragmented consumer energy usage data that updates in real-time?

Deliverable: Spoken answers to 2 reported Live Architecture & System Design question(s), under time.

Day 7 — Answer out loud: Live Coding & Problem Solving

  • Answer aloud, timed: Modify this existing weather application to support a new requirement: cache the API responses locally for 10 minutes and implement a manual refresh button.
  • Answer aloud, timed: Write a function that parses a nested JSON payload of energy metrics and returns a structured summary, handling missing or malformed data gracefully.

Deliverable: Spoken answers to 2 reported Live Coding & Problem Solving question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

How do you handle state management in a modern frontend application, and when would you choose a global store

Medium · Technical & Stack Alignment

How do you handle state management in a modern frontend application, and when would you choose a global store over local component state?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Describe your experience working with containerization tools like Docker and how they fit into your local deve

Medium · Technical & Stack Alignment

Describe your experience working with containerization tools like Docker and how they fit into your local development workflow.

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Narrate an outage you owned from page to postmortem

Hard · incident response · blast radius · postmortems

Pick an incident you personally drove, ideally one where writes were affected rather than reads. In six to eight minutes: state the symptom as it first appeared on a dashboard, the blast radius you established before you knew the cause, the mitigation you applied and when, the mechanism you eventually proved, and the follow-up that would prevent a repeat. Bring numbers: error rate, tenants affected, minutes to mitigate, minutes to resolve. If you cannot name what you measured, choose a different incident.

Approach

  1. Open on the signal rather than the cause: which metric at which percentile moved, on which service, at what time, so the listener follows the same evidence you had rather than a conclusion you already reached.
  2. Separate mitigation from diagnosis out loud. State what you did to stop the bleeding (flag off, shed traffic, drain a lease, roll back a deploy) and say plainly that you did it before the mechanism was known, because those are two jobs with different deadlines.
  3. Establish blast radius in countable terms: how many tenants, how many writes, and crucially whether the effect was loss or only delay. An append-only revision table or a pending outbox row means the change survived and the projection was merely behind, which is a repair rather than a data-loss incident.
  4. Prove the mechanism instead of asserting it. Name the trace span that grew, the plan that flipped to a sequential scan, the lease that expired, plus one alternative you ruled out and the signal that stayed flat while you ruled it out.

Follow-up

  • What would you do differently in the first five minutes, given the same dashboard and no more information?
  • Which follow-up action did you deliberately not take, and why was dropping it the right call?