cswork / libraryOpen practice workspace

Interview guides · SmartBiz

SmartBiz Software Engineer Interview Guide

SmartBiz Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

A Software Engineer at SmartBiz plays a critical role in shaping the financial technology solutions that empower small businesses. SmartBiz is dedicated to simplifying the complex world of small business lending, particularly through SBA loans and alternative financing. As an engineer here, you are not just writing code; you are building the secure, scalable, and highly performant infrastructure that automates complex financial underwriting, risk assessment, and application workflows. Your work directly impacts the survival and growth of thousands of small businesses by reducing loan processing times from weeks to days. The engineering team at SmartBiz balances robust backend processing with intuitive, high-conversion frontend user interfaces.

This guide is scoped to a Software Engineer candidate at SmartBiz.

Focus areas

  • REST APIs
  • Quality Assurance (QA) Experience
  • Take-Home Projects

The SmartBiz interview process

SmartBiz candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Virtual Open House

Meet engineering team leads and learn about the company's mission in a low-pressure setting.

What to demonstrate

  • Meet engineering team leads and learn about the company's mission in a low-pressure setting
  • Depth in REST APIs

How to prepare

  • Answer aloud and timed: How do you design a secure, versioned RESTful API that handles sensitive financial payloads?
  • Answer aloud and timed: Explain the difference between REST and gRPC, and when you would choose one over the other for internal microservices.

Technical Screening

Brief discussion with an engineering manager or CTO about your technical background and experience.

What to demonstrate

  • Brief discussion with an engineering manager or CTO about your technical background and experience
  • Depth in REST APIs

How to prepare

  • Answer aloud and timed: How would you handle rate limiting and idempotent requests on an API endpoint processing payments?
  • Answer aloud and timed: Describe how you would design a system to integrate a third-party credit-scoring API that is frequently slow or unreliable.

Take-Home Project

Complete a mini-project focused on frontend or backend development based on your track.

What to demonstrate

  • Complete a mini-project focused on frontend or backend development based on your track
  • Depth in REST APIs

How to prepare

  • Answer aloud and timed: What strategies do you use to ensure data consistency across multiple distributed databases during a multi-step transaction?
  • Answer aloud and timed: Walk me through the architectural decisions you made in your take-home mini-project. Why did you choose this specific directory structure?

1:1 Conversational Interviews

Review your project, discuss system design, and engage with engineering leadership.

What to demonstrate

  • Review your project, discuss system design, and engage with engineering leadership
  • Depth in REST APIs

How to prepare

  • Answer aloud and timed: How did you approach writing unit tests for the asynchronous components of your project?
  • Answer aloud and timed: If you had another 10 hours to work on this take-home assignment, what performance optimizations or architectural changes would you implement?

Where candidates lose points

Emphasize API Practicality

Since RESTful experience is a key requirement, make sure to highlight your experience building and securing APIs in your past roles. Be ready to discuss real-world integration challenges you have solved.

Prioritize Take-Home Code Quality

Treat the take-home project as your primary opportunity to showcase your engineering standards. Write clean code, document your assumptions, and ensure your test suite is comprehensive and easy to run.

If you receive a take-home project, don't hesitate to ask clarifying questions about the requirements

The team values proactive communication and collaborative problem-solving.

Questions & practice

How did you approach writing unit tests for the asynchronous components of your project?

Medium · Practical Coding & Take-Home Review

Approach

  1. Say what the runtime actually does before reasoning about the code.
  2. Name what is shared across threads and what owns each piece of state.
  3. Identify the window where an invariant is briefly untrue.
  4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

  • What happens if two callers reach this at the same time?
  • Where could this allocate more than you expect?

How does your code handle edge cases, such as network timeouts or malformed inputs from the client?

Medium · Practical Coding & Take-Home Review

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Explain your choice of state management or data fetching libraries in the frontend portion of your submission.

Medium · Practical Coding & Take-Home Review

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Replace offset paging on the resource feed with keyset

Easy · keyset pagination · composite index · sort order

resource holds resource_id, tenant_id, owner_user_id, title, body_ref, version, status ('draft','active','archived','deleted'), created_at, updated_at, deleted_at, with an index on (tenant_id, status, updated_at DESC, resource_id DESC). The listing endpoint returns active resources for one tenant, newest update first, 50 per page, today with LIMIT 50 OFFSET n. Tenants reach page 400 and rows are created while they read. Write the keyset query, define what the cursor carries and how it is encoded, and say which part of the index each predicate uses. Assume PostgreSQL 16.

Approach

  1. Name the two failures separately. OFFSET 20000 makes the server produce and discard 20,000 rows, so page cost grows with depth rather than with page size. Independently, any write that changes how many rows sort above the offset moves the window between two fetches, and the direction decides which anomaly you get: an insert lands at the head of updated_at DESC and pushes already-returned rows down past the boundary, so they are returned a second time; a delete above the offset, or a row whose updated_at is bumped above the cursor, pulls rows up and one is never returned at all. Nothing in the response reveals either.
  2. Write the seek: WHERE tenant_id = $1 AND status = 'active' AND (updated_at, resource_id) < ($2, $3) ORDER BY updated_at DESC, resource_id DESC LIMIT 50. The row-value comparison is one index range rather than a disjunction, and both columns are NOT NULL, which is what makes that comparison well defined.
  3. Map each predicate onto the index: tenant_id and status are equality on the leading columns, (updated_at, resource_id) is the range, and the ORDER BY matches the index order so no Sort node appears and the scan stops after 50 rows. The DESC in the definition only matters for mixed directions — a plain ascending btree on the same columns is read backwards for this query.
  4. Put both sort columns in the cursor and nothing the client can tamper with into another tenant: base64 of (updated_at, resource_id), validated server-side, with tenant_id taken from the principal.

Follow-up

  • The client asks for 'jump to page 400'. What do you offer instead, and what does the honest version cost?
  • Sort order becomes user-selectable across four columns. How many indexes is that, and which would you refuse to add?

Write the update path that detects a concurrent edit

Medium · optimistic concurrency · transactional outbox · audit history

resource carries version INT NOT NULL DEFAULT 1. resource_revision holds revision_id, resource_id, version, actor_user_id, change_kind, patch JSONB, request_id, created_at with UNIQUE (resource_id, version). outbox_event holds aggregate_type, aggregate_id, aggregate_version, event_type, payload, status. A PUT carries the version the client read. Write the exact statements for the single transaction that applies the edit, records the revision and enqueues 'resource.updated', and give the handler's branch on zero affected rows. Then say what PostgreSQL 16 does under READ COMMITTED when two of these updates hit one row at once.

Approach

  1. One transaction, three writes, no network call inside it: UPDATE resource SET title = $3, version = version + 1, updated_at = now() WHERE resource_id = $1 AND tenant_id = $4 AND version = $2; then INSERT the resource_revision row at version $2 + 1; then INSERT the outbox_event row at the same aggregate_version. The event goes to a table rather than a broker because no transaction spans both.
  2. Branch on the affected-row count before doing anything else. Zero has three causes — stale version, wrong tenant, row gone — so re-read once and map to 409 carrying the current version, or 404 for an id outside the caller's tenant, which also stops the endpoint confirming that another tenant's id exists.
  3. State the engine behaviour instead of assuming it. Under READ COMMITTED the second UPDATE blocks on the row lock, and when the first commits PostgreSQL re-evaluates the WHERE clause against the newly committed row, so the version predicate now fails and the statement reports zero rows. Under REPEATABLE READ the identical collision raises SQLSTATE 40001 instead, so the handler must fold both shapes into one conflict response.
  4. Keep UNIQUE (resource_id, version) even though the predicate already serialises writers. It is what makes a lost update unwritable if any other path ever reaches the revision table, and it converts a logic bug into 23505 rather than into a silently missing history row.

Follow-up

  • A client sends the version it read ten minutes ago and the resource has moved three versions. What is in your 409 so it can resolve the conflict without a full re-fetch?
  • Two editors, two disjoint fields, no overlap. Does your answer still refuse the second write, and should it?

How do you design a secure, versioned RESTful API that handles sensitive financial payloads?

Medium · RESTful API & System Design

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Explain the difference between REST and gRPC, and when you would choose one over the other for internal micros

Medium · RESTful API & System Design

Explain the difference between REST and gRPC, and when you would choose one over the other for internal microservices.

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

How would you handle rate limiting and idempotent requests on an API endpoint processing payments?

Medium · RESTful API & System Design

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

Describe how you would design a system to integrate a third-party credit-scoring API that is frequently slow o

Medium · RESTful API & System Design

Describe how you would design a system to integrate a third-party credit-scoring API that is frequently slow or unreliable.

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

What strategies do you use to ensure data consistency across multiple distributed databases during a multi-ste

Medium · RESTful API & System Design

What strategies do you use to ensure data consistency across multiple distributed databases during a multi-step transaction?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Walk me through the architectural decisions you made in your take-home mini-project. Why did you choose this s

Medium · Practical Coding & Take-Home Review

Walk me through the architectural decisions you made in your take-home mini-project. Why did you choose this specific directory structure?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

If you had another 10 hours to work on this take-home assignment, what performance optimizations or architectu

Medium · Practical Coding & Take-Home Review

If you had another 10 hours to work on this take-home assignment, what performance optimizations or architectural changes would you implement?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Listing latency scales with page size, not with filters

Easy · n+1 · latency · query batching

The tenant listing endpoint reads resource filtered by tenant_id and status, ordered by updated_at DESC, and returns each row plus the owner's display name from app_user and the actor of that resource's latest resource_revision. p99 is 55 ms at 10 rows per page and 1.4 s at 200. Database telemetry shows 401 statements per request, each under 1 ms, and nothing in the slow-query log. Diagnose the cause and give the fix, stating the statement count per request and the p99 you expect afterwards.

Approach

  1. Read the counters before forming a theory. 401 statements for 200 rows is one driver query plus two per row, and sub-millisecond execution with an empty slow-query log rules out a bad plan. The time is round trips, which is why it is invisible in every per-query metric and scales with rows returned rather than with filter selectivity.
  2. Name the two per-row statements from their normalised text: a single-row app_user lookup by user_id, and a resource_revision lookup by resource_id ordered by version DESC LIMIT 1. Confirm by dropping those two response fields and watching the statement count fall to one. That locates the calls in the serialisation layer, not the repository.
  3. Check that the arithmetic accounts for the whole gap. Measure one round trip to the replica in isolation; 400 trips at roughly 3 ms of network plus 0.2 ms of execution is about 1.3 s on top of a 55 ms baseline, which matches. If the multiplication had fallen short, the N+1 would only be part of the story and you would keep looking.
  4. Batch both lookups. Collect owner_user_ids and resource_ids from the driver query, then issue WHERE tenant_id = $1 AND user_id = ANY($2) for the users, and PostgreSQL's SELECT DISTINCT ON (resource_id) ... WHERE resource_id = ANY($2) ORDER BY resource_id, version DESC for the latest revision, which the UNIQUE (resource_id, version) index serves directly. On an engine without DISTINCT ON, use a lateral join or a row_number window. Three statements per request at any page size.

Follow-up

  • The page size is capped at 200 today. What breaks first if it is raised to 2,000, and is it still this bug?
  • How do you stop the next N+1 from reaching production, given that no individual query is slow and the endpoint's tests pass?

Suggested practice checklist

Built from the rounds and topics SmartBiz candidates report.

Day 1 — Map the SmartBiz loop

  • Write out the reported sequence: Virtual Open House, Technical Screening, Take-Home Project, 1:1 Conversational Interviews.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work REST APIs

  • Spend the session on REST APIs, which SmartBiz candidates report being tested on.
  • Write one worked example in REST APIs and time yourself on it.

Deliverable: One timed worked example in REST APIs.

Day 3 — Work Quality Assurance (QA) Experience

  • Spend the session on Quality Assurance (QA) Experience, which SmartBiz candidates report being tested on.
  • Write one worked example in Quality Assurance (QA) Experience and time yourself on it.

Deliverable: One timed worked example in Quality Assurance (QA) Experience.

Day 4 — Work Take-Home Projects

  • Spend the session on Take-Home Projects, which SmartBiz candidates report being tested on.
  • Write one worked example in Take-Home Projects and time yourself on it.

Deliverable: One timed worked example in Take-Home Projects.

Day 5 — Answer out loud: RESTful API & System Design

  • Answer aloud, timed: How do you design a secure, versioned RESTful API that handles sensitive financial payloads?
  • Answer aloud, timed: Explain the difference between REST and gRPC, and when you would choose one over the other for internal microservices.

Deliverable: Spoken answers to 2 reported RESTful API & System Design question(s), under time.

Day 6 — Answer out loud: Practical Coding & Take-Home Review

  • Answer aloud, timed: Walk me through the architectural decisions you made in your take-home mini-project. Why did you choose this specific directory structure?
  • Answer aloud, timed: How did you approach writing unit tests for the asynchronous components of your project?

Deliverable: Spoken answers to 2 reported Practical Coding & Take-Home Review question(s), under time.

Day 7 — Answer out loud: Behavioral & Team Collaboration

  • Answer aloud, timed: Describe a time when you had to collaborate with a product manager who had a different opinion on how a feature should be implemented. How did you reach a resolution?
  • Answer aloud, timed: Tell me about a complex technical bug you encountered in production. How did you diagnose it, and what did you do to prevent it from happening again?

Deliverable: Spoken answers to 2 reported Behavioral & Team Collaboration question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

Describe a time when you had to collaborate with a product manager who had a different opinion on how a featur

Medium · Behavioral & Team Collaboration

Describe a time when you had to collaborate with a product manager who had a different opinion on how a feature should be implemented. How did you reach a resolution?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Tell me about a complex technical bug you encountered in production. How did you diagnose it, and what did you

Medium · Behavioral & Team Collaboration

Tell me about a complex technical bug you encountered in production. How did you diagnose it, and what did you do to prevent it from happening again?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you handle constructive feedback during a code review, especially when you disagree with the reviewer’s

Medium · Behavioral & Team Collaboration

How do you handle constructive feedback during a code review, especially when you disagree with the reviewer’s approach?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Can you share an experience where you had to quickly learn a new technology or framework to deliver a critical

Medium · Behavioral & Team Collaboration

Can you share an experience where you had to quickly learn a new technology or framework to deliver a critical business feature?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

What steps do you take to ensure your code is accessible, readable, and easy for other developers on your team

Medium · Behavioral & Team Collaboration

What steps do you take to ensure your code is accessible, readable, and easy for other developers on your team to maintain?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?