cswork / libraryOpen practice workspace

Interview guides · REDLattice

REDLattice Software Engineer Interview Guide

REDLattice Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

As a Software Engineer at REDLattice, you are at the forefront of national security and advanced cybersecurity. This role is not just about writing code; it is about developing high-impact technical solutions that address complex challenges in vulnerability research, reverse engineering, and embedded systems. You will work on mission-critical projects that protect vital infrastructure, requiring a blend of creativity, technical precision, and a deep-seated commitment to mission success. The work you perform contributes directly to the development of tailored cyber solutions for rapidly evolving environments. Whether you are analyzing wireless communication protocols or debugging complex hardware-software interactions, your contributions directly impact the efficacy of REDLattice products.

This guide is scoped to a Software Engineer candidate at REDLattice.

Focus areas

  • Vulnerability research
  • Reverse engineering
  • Hardware/software/wireless vulnerability analysis

The REDLattice interview process

REDLattice candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Initial Screening

The process begins with an initial screening to assess your fit for the role.

What to demonstrate

  • The process begins with an initial screening to assess your fit for the role
  • Depth in Vulnerability research

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Dives

Engage in deeper technical discussions to evaluate your technical capabilities.

What to demonstrate

  • Engage in deeper technical discussions to evaluate your technical capabilities
  • Depth in Vulnerability research

How to prepare

  • Answer aloud and timed: How have you utilized tools like Wireshark or disassemblers to identify vulnerabilities in a network-connected device?
  • Answer aloud and timed: Describe a time you had to optimize code for a resource-constrained environment.

Hands-on Assessments

Participate in hands-on assessments or scenario-based whiteboarding exercises.

What to demonstrate

  • Participate in hands-on assessments or scenario-based whiteboarding exercises
  • Depth in Vulnerability research

How to prepare

  • Answer aloud and timed: What is your experience with wireless communication protocols such as Bluetooth or LTE?
  • Answer aloud and timed: How do you leverage scripting languages like Python or Bash to automate repetitive security analysis tasks?

Final Evaluation

Conclude with a final evaluation to determine your overall fit for the team.

What to demonstrate

  • Conclude with a final evaluation to determine your overall fit for the team
  • Depth in Vulnerability research

How to prepare

  • Answer aloud and timed: Explain your process for ensuring code quality and effective configuration management when working in a collaborative Git environment.
  • Answer aloud and timed: How do you handle exceptions and edge cases when developing software for mobile or desktop platforms?

Where candidates lose points

Show Your Work

When answering technical questions, explain your reasoning process aloud. It is often more important to show how you approach a problem than to provide the perfect answer immediately.

Focus on the "Why

Don't just list the tools you’ve used; explain why you chose them and the specific challenges they helped you solve in past projects.

Stay Current

Keep up to date with recent developments in cybersecurity and wireless protocols, as these are frequently discussed topics.

Questions & practice

How do you leverage scripting languages like Python or Bash to automate repetitive security analysis tasks?

Medium · Coding & Scripting Proficiency

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Explain your process for ensuring code quality and effective configuration management when working in a collab

Medium · Coding & Scripting Proficiency

Explain your process for ensuring code quality and effective configuration management when working in a collaborative Git environment.

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Collapse a redelivered event batch into per-aggregate high-water marks

Easy · hashing · at-least-once · aggregation

You drain a batch of up to 5,000,000 events, each (aggregate_id BIGINT, aggregate_version INT, event_type, payload). The log guarantees order within one aggregate only; the batch merges 64 partitions, and a relay failover has redelivered a range, so an older version for an aggregate can appear after a newer one. Given a map of last_applied_version per aggregate, produce the events worth applying, at most one per (aggregate_id, version), plus the count discarded. Target O(n) time. State the memory for 2,000,000 distinct aggregates and what you do when it does not fit.

Approach

  1. One pass, one hash map from aggregate_id to the highest version kept, and a discard counter. An event whose version is at or below last_applied_version for its aggregate is dropped without further work, which is the whole reason the event carries its version rather than a delta. O(n) expected time, O(d) space in distinct aggregates.
  2. Keep the maximum, never the last occurrence. The redelivered range means the final appearance of an aggregate in the batch can be an older version than one seen earlier in the same batch, so last-wins applies stale state over newer state and the projection regresses with no error anywhere.
  3. Cost the memory instead of calling it large: an 8-byte key plus a 4-byte version is 12 bytes of payload, and an open-addressed table held at a 0.7 load factor costs roughly 17 bytes per entry before per-slot metadata, so 2,000,000 aggregates is tens of megabytes in a native layout and several times that in a runtime that boxes both key and value.
  4. If the distinct set exceeds memory, partition on hash(aggregate_id) mod P and reduce each partition independently. Every event for one aggregate hashes to the same partition, so the per-partition result is exact and the merge is concatenation rather than a second reduction.

Follow-up

  • The payload is a patch rather than a snapshot, so applying only the highest version loses the intermediate changes. What changes in your reduction?
  • How do you detect that version 7 arrived while version 6 was never delivered, and what should the consumer do about the gap?

Denormalise tenant onto revisions and backfill it live

Hard · denormalisation · online migration · backfill

resource_revision (revision_id, resource_id, version, actor_user_id, change_kind, patch, request_id, created_at) has 400M rows and no tenant column; tenant_id lives only on resource. Two reads need it: a tenant-scoped audit feed ordered by created_at DESC, and an offboarding purge. Both join back to resource today. Justify adding tenant_id to resource_revision against those two reads, name the anomaly the copy introduces and the constraint that prevents it, then give the ordered migration for a live table taking 1.2k writes/second — the lock each step takes, how the backfill is batched, and where each step stops being reversible. PostgreSQL 16.

Approach

  1. Justify from the access path rather than from taste. Without the column, the audit feed either scans resource_revision by created_at and discards other tenants' rows, or resolves the tenant's resource_ids first and probes with them — both proportional to the tenant's whole history rather than to one page. With (tenant_id, created_at DESC, revision_id DESC) it is a seek that stops at 50 rows, and the purge becomes a ranged delete instead of a join.
  2. Name the cost exactly: a second copy of a fact can disagree with the first. Make the disagreement unwritable rather than documented — add UNIQUE (resource_id, tenant_id) on resource so it can serve as a foreign-key target, then FOREIGN KEY (resource_id, tenant_id) REFERENCES resource (resource_id, tenant_id) on the revision table. A revision can then only ever carry its parent's tenant.
  3. Step one, expand: ALTER TABLE resource_revision ADD COLUMN tenant_id BIGINT NULL, with no default, so it is a catalogue change and no rewrite. It still needs ACCESS EXCLUSIVE for an instant, and that instant queues behind the longest open transaction on the table while every later query queues behind it — set lock_timeout to 2s and retry rather than wait.
  4. Step two, dual-write: deploy the writer that populates tenant_id on every new revision while reads still use the join. Reversible by redeploying the previous build, because nothing reads the column yet.

Follow-up

  • The backfill is half finished and a rollback is required. What state is the table in, and what does the previous build do with a half-populated column?
  • How do you verify the backfill actually finished, given rows are still being inserted while it runs?

Stop tag and share joins from fanning out a page

Medium · join fan-out · semi-joins · many-to-many

resource_tag is (resource_id, tag_id) with PK (resource_id, tag_id); resource_share is (resource_id, shared_with_user_id, permission). The tagged-and-shared listing inner-joins resource to both, filters tenant_id, tag_id = ANY($2) and shared_with_user_id = $3, orders by updated_at DESC and takes 50. Pages come back with fewer than 50 distinct resources and the total in the header is far too high. Explain the row multiplication, rewrite both the page query and the count query so each is correct, and name the index each one needs. PostgreSQL 16.

Approach

  1. Do the arithmetic against the predicates that are actually there. An inner join emits one row per matching child row, and both joins are filtered: tag_id = ANY($2) admits only the requested tags, shared_with_user_id = $3 admits one user's share rows. So a resource holding three of the requested tags and shared with $3 once yields three rows, not one — the multiplier is its count of matching tags times its share rows for that single user, and that second factor is 1 unless the table admits duplicate (resource_id, shared_with_user_id) pairs. LIMIT 50 then limits rows rather than resources, and COUNT(*) counts pairs — the header is the product, not the population.
  2. Reject DISTINCT as the fix. It deduplicates after the product has been built, so the planner must materialise and sort the fanned-out set before the LIMIT can apply, and it leaves any SUM or AVG in the same select list wrong.
  3. Rewrite both filters as semi-joins, keeping resource as the only row source: AND EXISTS (SELECT 1 FROM resource_tag rt WHERE rt.resource_id = r.resource_id AND rt.tag_id = ANY($2)) and the same shape against resource_share. A semi-join stops at the first match per resource and preserves the driving index order, so ORDER BY updated_at DESC, resource_id DESC LIMIT 50 still stops after 50 rows.
  4. Count with the same predicates and no join at all: SELECT count(*) FROM resource r WHERE r.tenant_id = $1 AND r.status = 'active' AND EXISTS (...) AND EXISTS (...). Nothing multiplies a resource, so the number is the population.

Follow-up

  • The filter changes from 'any of these tags' to 'all of these tags'. Rewrite it and state what it costs relative to the ANY form.
  • A resource can be shared with the same user twice under different permissions. Does your count change, and should it?

Can you explain the difference between static and dynamic analysis when reverse engineering a binary?

Medium · Technical & Domain Expertise

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How have you utilized tools like Wireshark or disassemblers to identify vulnerabilities in a network-connected

Medium · Technical & Domain Expertise

How have you utilized tools like Wireshark or disassemblers to identify vulnerabilities in a network-connected device?

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

Walk me through a challenging technical project where you had to learn a new technology or toolset on the fly

Medium · Problem-Solving & Methodology

Walk me through a challenging technical project where you had to learn a new technology or toolset on the fly to meet a deadline.

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How do you approach the reverse engineering of a system where documentation is sparse or unavailable?

Medium · Problem-Solving & Methodology

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

Describe a situation where you identified a security vulnerability; what steps did you take to document and re

Medium · Problem-Solving & Methodology

Describe a situation where you identified a security vulnerability; what steps did you take to document and report it?

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How would you approach debugging a complex issue in an embedded system with limited diagnostic feedback?

Medium · Technical & Domain Expertise

Approach

  1. Establish what changed and when, before forming any theory.
  2. Pick a bisection that eliminates candidates whichever way it turns out.
  3. Check the instrumentation before believing the symptom.
  4. Separate the trigger from the cause; the deploy is rarely the bug.

Follow-up

  • What would you look at first, and what would it rule out?
  • How would you tell a cause from a coincidence here?

Suggested practice checklist

Built from the rounds and topics REDLattice candidates report.

Day 1 — Map the REDLattice loop

  • Write out the reported sequence: Initial Screening, Technical Dives, Hands-on Assessments, Final Evaluation.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work Vulnerability research

  • Spend the session on Vulnerability research, which REDLattice candidates report being tested on.
  • Write one worked example in Vulnerability research and time yourself on it.

Deliverable: One timed worked example in Vulnerability research.

Day 3 — Work Reverse engineering

  • Spend the session on Reverse engineering, which REDLattice candidates report being tested on.
  • Write one worked example in Reverse engineering and time yourself on it.

Deliverable: One timed worked example in Reverse engineering.

Day 4 — Work Hardware/software/wireless vulnerability analysis

  • Spend the session on Hardware/software/wireless vulnerability analysis, which REDLattice candidates report being tested on.
  • Write one worked example in Hardware/software/wireless vulnerability analysis and time yourself on it.

Deliverable: One timed worked example in Hardware/software/wireless vulnerability analysis.

Day 5 — Answer out loud: Technical & Domain Expertise

  • Answer aloud, timed: How would you approach debugging a complex issue in an embedded system with limited diagnostic feedback?
  • Answer aloud, timed: Can you explain the difference between static and dynamic analysis when reverse engineering a binary?

Deliverable: Spoken answers to 2 reported Technical & Domain Expertise question(s), under time.

Day 6 — Answer out loud: Coding & Scripting Proficiency

  • Answer aloud, timed: How do you leverage scripting languages like Python or Bash to automate repetitive security analysis tasks?
  • Answer aloud, timed: Explain your process for ensuring code quality and effective configuration management when working in a collaborative Git environment.

Deliverable: Spoken answers to 2 reported Coding & Scripting Proficiency question(s), under time.

Day 7 — Answer out loud: Problem-Solving & Methodology

  • Answer aloud, timed: Walk me through a challenging technical project where you had to learn a new technology or toolset on the fly to meet a deadline.
  • Answer aloud, timed: How do you approach the reverse engineering of a system where documentation is sparse or unavailable?

Deliverable: Spoken answers to 2 reported Problem-Solving & Methodology question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

Describe a time you had to optimize code for a resource-constrained environment.

Medium · Technical & Domain Expertise

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

What is your experience with wireless communication protocols such as Bluetooth or LTE?

Medium · Technical & Domain Expertise

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you handle exceptions and edge cases when developing software for mobile or desktop platforms?

Medium · Coding & Scripting Proficiency

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?