cswork / libraryOpen practice workspace

Interview guides · SurePrep

SurePrep Software Engineer Interview Guide

SurePrep Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

As a Software Engineer at SurePrep, you are at the forefront of transforming the tax industry through automation and intelligent software solutions. You will be responsible for building, maintaining, and scaling the platforms that allow tax professionals to process returns with unprecedented efficiency. Your work directly impacts how thousands of firms manage complex data, requiring a balance of robust backend architecture and intuitive frontend implementation. This role is critical to the SurePrep mission of reducing manual data entry and human error in tax preparation. You will likely work within a collaborative, supportive team environment, often engaging with architecture and lead engineers to solve complex technical challenges.

This guide is scoped to a Software Engineer candidate at SurePrep.

Focus areas

  • JavaScript
  • React
  • Coding Interviews (Algorithmic Problem Solving)

The SurePrep interview process

SurePrep candidates report 2 rounds over 2-4 weeks. The stages below are what candidates describe, not a published process.

Initial Screening

The process begins with an initial screening to assess your technical baseline.

What to demonstrate

  • The process begins with an initial screening to assess your technical baseline
  • Depth in JavaScript

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Dives

Following the screening, you will engage in deeper technical interviews to evaluate your skills.

What to demonstrate

  • Following the screening, you will engage in deeper technical interviews to evaluate your skills
  • Depth in JavaScript

How to prepare

  • Answer aloud and timed: Can you describe the differences between various MVC design patterns?
  • Answer aloud and timed: What are the advantages and drawbacks of using WCF versus modern web APIs?

Where candidates lose points

Understand the "Why

Don't just provide the correct answer during technical rounds; explain the trade-offs you considered.

Be Clear on the Role

Verify the exact title and expectations with HR early to ensure you and the hiring manager are aligned.

Prepare for Closures

If you are interviewing for a front-end role, brush up on JavaScript closures as they have been a common testing point.

Highlight Teamwork

Emphasize instances where you collaborated effectively to solve a difficult problem.

Use the Resources

Take advantage of any feedback loops offered by the company to improve your performance in subsequent rounds.

Questions & practice

Explain the concept of closures in JavaScript and provide a practical use case.

Medium · Technical & Domain Knowledge

Approach

  1. Say what the runtime actually does before reasoning about the code.
  2. Name what is shared across threads and what owns each piece of state.
  3. Identify the window where an invariant is briefly untrue.
  4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

  • What happens if two callers reach this at the same time?
  • Where could this allocate more than you expect?

Describe how you would build a React text-formatting function from scratch.

Medium · Problem-Solving & Algorithms

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Walk me through the time complexity of your proposed solution for this algorithm.

Medium · Problem-Solving & Algorithms

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

How would you structure a data model to handle complex tax return documents?

Medium · Problem-Solving & Algorithms

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Given a specific UI requirement, how would you manage component state effectively?

Medium · Problem-Solving & Algorithms

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

  1. Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
  2. Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
  3. For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
  4. State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

  • A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
  • How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Hold a per-tenant active cap against concurrent creates

Hard · write skew · isolation levels · constraints

A tenant on the standard plan may hold at most 50 resources with status='active'. The create handler runs SELECT count(*) FROM resource WHERE tenant_id = $1 AND status = 'active', compares to 50, then inserts. Two creates arrive 3 ms apart on different instances and the tenant lands at 51. Name the anomaly, say whether PostgreSQL 16 READ COMMITTED or REPEATABLE READ prevents it and why, then give an implementation that holds the cap at READ COMMITTED with the exact statements. Finally, say what changes when the cap is 'at most one running export per tenant' on job_run.

Approach

  1. Name it: write skew. The two transactions read an overlapping set and write disjoint rows, so there is no row-level conflict for the engine to detect and each commit is individually legal.
  2. Rule out the levels precisely. READ COMMITTED takes a fresh snapshot per statement and takes no lock on the counted rows, so both see 49. PostgreSQL's REPEATABLE READ is snapshot isolation: it removes non-repeatable reads and phantoms within the snapshot but still admits write skew, because the anomaly is not a re-read of a changed row, it is a read of a set that a concurrent transaction invalidates. Only SERIALIZABLE closes it, by tracking the read dependency and aborting one transaction with SQLSTATE 40001 — a guarantee that exists only if the application re-runs the whole transaction from the read.
  3. Convert the set predicate into a single-row conflict: keep tenant.active_resource_count and run UPDATE tenant SET active_resource_count = active_resource_count + 1 WHERE tenant_id = $1 AND active_resource_count < 50 in the same transaction as the INSERT. Zero affected rows is the cap, returned as 409. The row lock serialises the decision at any isolation level, and contention is bounded to one tenant's row — which is also the fair-scheduling unit, unlike a global counter that would convoy every tenant behind one row.
  4. State the cost you just took on: a counter is a second source of truth that can drift, so every path that changes status must adjust it inside the same transaction, and a periodic reconciliation has to exist, with resource_revision as the authority for what the count should have been.

Follow-up

  • A resource moves from archived back to active. Which statements change, and what breaks if the counter update and the status change land in different transactions?
  • The cap becomes plan-dependent and a plan can change mid-month. Where does the number 50 live, and who reads it?

Can you describe the differences between various MVC design patterns?

Medium · Technical & Domain Knowledge

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

What are the advantages and drawbacks of using WCF versus modern web APIs?

Medium · Technical & Domain Knowledge

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

Explain how you debug a performance bottleneck in a production-level application.

Medium · Problem-Solving & Algorithms

Approach

  1. Establish what changed and when, before forming any theory.
  2. Pick a bisection that eliminates candidates whichever way it turns out.
  3. Check the instrumentation before believing the symptom.
  4. Separate the trigger from the cause; the deploy is rarely the bug.

Follow-up

  • What would you look at first, and what would it rule out?
  • How would you tell a cause from a coincidence here?

Suggested practice checklist

Built from the rounds and topics SurePrep candidates report.

Day 1 — Map the SurePrep loop

  • Write out the reported sequence: Initial Screening, Technical Dives.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 2 reported rounds, with the weakest marked.

Day 2 — Work JavaScript

  • Spend the session on JavaScript, which SurePrep candidates report being tested on.
  • Write one worked example in JavaScript and time yourself on it.

Deliverable: One timed worked example in JavaScript.

Day 3 — Work React

  • Spend the session on React, which SurePrep candidates report being tested on.
  • Write one worked example in React and time yourself on it.

Deliverable: One timed worked example in React.

Day 4 — Work Coding Interviews (Algorithmic Problem Solving)

  • Spend the session on Coding Interviews (Algorithmic Problem Solving), which SurePrep candidates report being tested on.
  • Write one worked example in Coding Interviews (Algorithmic Problem Solving) and time yourself on it.

Deliverable: One timed worked example in Coding Interviews (Algorithmic Problem Solving).

Day 5 — Answer out loud: Technical & Domain Knowledge

  • Answer aloud, timed: Explain the concept of closures in JavaScript and provide a practical use case.
  • Answer aloud, timed: How do you handle database optimization for high-volume, transactional data?

Deliverable: Spoken answers to 2 reported Technical & Domain Knowledge question(s), under time.

Day 6 — Answer out loud: Problem-Solving & Algorithms

  • Answer aloud, timed: Describe how you would build a React text-formatting function from scratch.
  • Answer aloud, timed: Walk me through the time complexity of your proposed solution for this algorithm.

Deliverable: Spoken answers to 2 reported Problem-Solving & Algorithms question(s), under time.

Day 7 — Dry run for SurePrep

  • Run one full mock under time, then write down the two questions you most want to ask your interviewers.

Deliverable: A completed timed mock and two questions to ask.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

How do you handle database optimization for high-volume, transactional data?

Medium · Technical & Domain Knowledge

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you approach code reviews to ensure maintainability and scalability?

Medium · Technical & Domain Knowledge

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Tell callers you do not own that their integration breaks

Medium · deprecation · compatibility · stakeholders

A field in a write endpoint's response must change shape. You own the endpoint; you do not own the four internal callers or the outbound webhook consumers who read it. Describe a deprecation you were responsible for: what you shipped first, how you established who was actually reading the field, the window you gave and what set its length, what you did about the consumer who never moved, and how you decided removal was safe. Name the signal you used, not the announcement you sent.

Approach

  1. Establish the reader set empirically rather than from a wiki of owners: per-field usage counters keyed by principal, or access logs attributed to a consumer. State the blind spot of whichever you pick, since a consumer that reads the field only on a monthly job will not appear in a week of logs.
  2. Ship additive first. Populate the new field alongside the old one so no reader is forced to move, which is also what keeps a rolling deploy safe, because old and new instances answer the same requests at the same time and a rollback must still find the old shape present.
  3. Set the window from the slowest legitimate consumer's release cadence, not from your calendar, and decide separately what to do for a consumer with no release process at all, such as an external webhook endpoint you can only email.
  4. Convert silence into evidence before you rely on it: a short, low-traffic removal window that makes a still-dependent consumer fail visibly and loudly while you are watching, rather than at three in the morning after you have moved on.

Follow-up

  • How would you detect a consumer that reads the field only during a monthly export?
  • One caller refuses to move and has a commercial relationship behind it. What changes in your plan and what does not?