cswork / libraryOpen practice workspace

Interview guides · Utmb Health

Utmb Health Software Engineer Interview Guide

Utmb Health Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

A Software Engineer at Utmb Health (University of Texas Medical Branch) plays a critical role in bridging the gap between cutting-edge technology and patient-centric healthcare operations. Within an academic medical center of this scale, software engineering is not just about writing code; it is about building, maintaining, and securing systems that directly impact patient care, clinical research, and hospital operations. From integrating Electronic Health Records (EHR) to developing custom clinical tools and managing secure data pipelines, your work ensures that medical professionals have reliable, high-performance technology at their fingertips. Working at Utmb Health offers a unique blend of enterprise-scale software development and mission-driven impact.

This guide is scoped to a Software Engineer candidate at Utmb Health.

Focus areas

  • Risk Management
  • Medical Device Regulations
  • SQL

The Utmb Health interview process

Utmb Health candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

HR Screening Call

Initial call to discuss your background, career goals, and basic alignment with the role.

What to demonstrate

  • Initial call to discuss your background, career goals, and basic alignment with the role
  • Depth in Risk Management

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical and Managerial Conversations

Series of discussions focusing on technical skills and managerial fit.

What to demonstrate

  • Series of discussions focusing on technical skills and managerial fit
  • Depth in Risk Management

How to prepare

  • Answer aloud and timed: How do you manage memory and handle resource disposal in a.NET application?
  • Answer aloud and timed: Walk me through a code snippet containing C# generics and validate its correctness.

Panel Interviews

Present to and converse with multiple stakeholders, including senior developers and managers.

What to demonstrate

  • Present to and converse with multiple stakeholders
  • Including senior developers and managers

How to prepare

  • Answer aloud and timed: How do you handle exceptions in a multi-layered.NET architecture?
  • Answer aloud and timed: Write a SQL query to join three tables and retrieve a specific set of aggregated patient records.

Technical Evaluations

Focus on practical application of.NET syntax, SQL queries, and architectural definitions.

What to demonstrate

  • Focus on practical application of.NET syntax, SQL queries, and architectural definitions
  • Depth in Risk Management

How to prepare

  • Answer aloud and timed: What is the difference between a clustered and a non-clustered index, and how do they affect query performance?
  • Answer aloud and timed: How do you optimize a slow-running SQL query in a production environment?

Where candidates lose points

Be prepared for a panel format

UTMB frequently uses multi-person panels with stakeholders from different departments, including security and operations, to evaluate candidates from multiple angles.

Brush up on OOP and.NET basics

Do not neglect the fundamentals. Be ready to define basic programming terms, explain OOP principles, and discuss standard.NET library behaviors clearly.

Prepare your SQL fundamentals

Expect to write or explain SQL queries on the fly. Focus on joins, aggregations, and query optimization techniques.

Highlight your compliance experience

If you have worked with HIPAA, ISO standards, or other highly regulated frameworks, make sure to highlight this experience. It is highly valued by the hiring team.

Questions & practice

How do you manage memory and handle resource disposal in a.NET application?

Medium · .NET and C# Development

Approach

  1. Say what the runtime actually does before reasoning about the code.
  2. Name what is shared across threads and what owns each piece of state.
  3. Identify the window where an invariant is briefly untrue.
  4. Distinguish a value from a reference to it, and say which one you handed out.

Follow-up

  • What happens if two callers reach this at the same time?
  • Where could this allocate more than you expect?

Diff a projection against the primary without per-row point reads

Hard · reconciliation · range hashing · throttling

The listing projection has drifted and some rows show a stale version. The primary holds 40,000,000 resource rows across 12,000 tenants while serving 1,200 writes and 14,000 reads per second. The obvious repair, reading each resource row and comparing its version against the projection, is correct and would eventually finish. Explain precisely why it is unacceptable here, then give a diff that finds the differing rows, state its complexity, and make it safe to run against a live primary. Replication lag is usually under 100 ms and is not bounded.

Approach

  1. Quantify the naive cost rather than calling it slow: 40,000,000 point reads at even 0.5 ms each is over five hours serialised, and the only lever is concurrency, which is exactly what you cannot spend. The primary's pool is sized for the write path, and 40,000,000 random reads evict the buffer cache that sustains the 85 percent cache hit rate, so the audit degrades the system it is auditing.
  2. Replace random access with one ordered pass per side. Both sides can be read in (tenant_id, resource_id) order, which is a sequential scan on each and a merge join in O(n) time and O(1) memory. For a dense diff that is the whole answer, and it reads the primary once instead of 40,000,000 times.
  3. For the expected sparse case, compare range hashes instead of rows: partition the key space, compute per range an order-independent aggregate over hash(resource_id, version), compare aggregates, and descend only into ranges that differ. With d differing rows and branching factor B, at most d ranges mismatch per level, so the drill-down examines O(d log_B(n/d)) ranges and reads full rows only in mismatching leaves.
  4. Aggregate with a sum modulo 2^64 or a multiset hash, never XOR. XOR is order-independent but self-cancelling, so two rows wrong in the same way, or a row duplicated on one side, leave the range aggregate matching and the range is declared clean.

Follow-up

  • The diff reports 900 stale rows. How do you decide between patching those rows and rebuilding the projection from resource_revision?
  • Same job, but the projection lives in a search index that cannot be scanned in key order. What changes?

Merge partitioned event streams into one ordered feed with bounded lateness

Hard · k-way merge · watermarks · out-of-order streams

The read-model service consumes 64 log partitions carrying about 4,000 events per second in total. Each partition is ordered within itself, but partitions drift by up to 30 seconds, and the activity feed must present a tenant's events in occurred_at order. Produce the merge. State its complexity, the buffer it requires in events and in bytes, what happens when one partition is idle, and what you do with an event that arrives after you have already emitted its position. Payloads average 1 KB.

Approach

  1. Merge with a min-heap over the 64 partition heads keyed on (occurred_at, event_id): O(log P) per event and O(n log P) overall. The tie-break on event_id is what makes the output deterministic when two partitions carry the same millisecond, which matters because the feed is paginated and a non-deterministic order reorders pages under the reader.
  2. Emitting the heap head is only correct once every partition has produced everything up to that timestamp, so the emit condition is a watermark: the minimum across partitions of the highest occurred_at seen, less the allowed lateness. Events are held until the watermark passes them, which is what turns individually ordered streams into a jointly ordered one.
  3. Size the buffer from the lateness rather than guessing: 4,000 events per second times 30 seconds is 120,000 buffered events, and at 1 KB each about 120 MB of heap. That number is the real price of the ordering guarantee and belongs in front of whoever asked for it.
  4. Handle the idle partition explicitly, because it fails the feed rather than corrupting it: a partition with no traffic never advances its own maximum, so the watermark freezes and output stops entirely. Either every partition emits a periodic idle marker carrying the broker's current time, or the watermark falls back to wall clock for a partition silent beyond a threshold.

Follow-up

  • The lateness budget is raised to five minutes. What is the new buffer, and what besides memory changes?
  • The consumer restarts. Where does it resume from, and what does the feed look like for the first 30 seconds?

Write a SQL query to join three tables and retrieve a specific set of aggregated patient records.

Medium · Database and SQL Engineering

Approach

  1. Name the grain you start from and join outward from it.
  2. Check whether any join is one-to-many before aggregating, or the sums inflate.
  3. Say which index the query would use, and what makes it unusable.
  4. Handle the rows that do not match: that is usually the actual question.

Follow-up

  • How does the query change if that join becomes one-to-many?
  • What happens to this when the table is ten times larger?

What is the difference between a clustered and a non-clustered index, and how do they affect query performance

Medium · Database and SQL Engineering

What is the difference between a clustered and a non-clustered index, and how do they affect query performance?

Approach

  1. Name the grain you start from and join outward from it.
  2. Check whether any join is one-to-many before aggregating, or the sums inflate.
  3. Say which index the query would use, and what makes it unusable.
  4. Handle the rows that do not match: that is usually the actual question.

Follow-up

  • How does the query change if that join becomes one-to-many?
  • What happens to this when the table is ten times larger?

How do you optimize a slow-running SQL query in a production environment?

Medium · Database and SQL Engineering

Approach

  1. Name the grain you start from and join outward from it.
  2. Check whether any join is one-to-many before aggregating, or the sums inflate.
  3. Say which index the query would use, and what makes it unusable.
  4. Handle the rows that do not match: that is usually the actual question.

Follow-up

  • How does the query change if that join becomes one-to-many?
  • What happens to this when the table is ten times larger?

Explain the concept of database normalization and when you might choose to denormalize a schema.

Medium · Database and SQL Engineering

Approach

  1. Name the grain you start from and join outward from it.
  2. Check whether any join is one-to-many before aggregating, or the sums inflate.
  3. Say which index the query would use, and what makes it unusable.
  4. Handle the rows that do not match: that is usually the actual question.

Follow-up

  • How does the query change if that join becomes one-to-many?
  • What happens to this when the table is ten times larger?

Explain the concept of generics in C# and provide a scenario where they are highly beneficial.

Medium · .NET and C# Development

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

What is the difference between an abstract class and an interface in C#?

Medium · .NET and C# Development

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

Walk me through a code snippet containing C# generics and validate its correctness.

Medium · .NET and C# Development

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How do you ensure data integrity when performing bulk updates across multiple relational tables?

Medium · Database and SQL Engineering

Approach

  1. Clarify what is being asked and what a complete answer contains.
  2. State your assumptions explicitly before working the problem.
  3. Say what you would check first and why it is the highest-information step.
  4. Work from the requirement backwards to the design.

Follow-up

  • What assumption would you test first?
  • How would you know your answer was wrong?

How do you incorporate secure coding practices into your daily development workflow?

Medium · Security, Compliance, and Architecture

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

How do you approach risk management and risk control when deploying software updates to critical systems?

Medium · Security, Compliance, and Architecture

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

What steps do you take to ensure an API you are developing is secure against common vulnerabilities like SQL i

Medium · Security, Compliance, and Architecture

What steps do you take to ensure an API you are developing is secure against common vulnerabilities like SQL injection or cross-site scripting?

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

Read latency spikes on a sixty-second sawtooth

Medium · cache stampede · single-flight · ttl

The cached listing read path serves about 14k reads/second at an 85% hit rate. p99 sits at 35 ms for 57 seconds, jumps to 900 ms for 3, and repeats. During each spike the primary shows several hundred identical listing queries starting within the same millisecond, all carrying one large tenant's id. Cache entries use a 60-second TTL. Give the mechanism, the ordered checks, the fix, and the correctness hazard your fix must not introduce.

Approach

  1. Match the period to a configured number before theorising about load. A spike every 60 seconds against a 60-second TTL is an entry expiring, and you confirm it by correlating spike timestamps with the entry's write time rather than with the traffic curve. If the period had matched a cron or a GC interval instead, this is a different investigation.
  2. Establish the concurrency of the miss. Several hundred identical queries in one millisecond means the miss path has no coalescing: every request that arrives between expiry and repopulation recomputes. The herd size is that key's arrival rate times its recompute time, so at 1.2k reads/second for the hot key and a 250 ms recompute you expect about 300 concurrent misses, which matches what is observed.
  3. Add single-flight on the miss path so one caller per key recomputes under a short-lived lock while the rest wait for its result. Prefer stale-while-revalidate where the read tolerates it: return the expired value immediately and refresh asynchronously, which removes the latency spike rather than serialising it into a queue of waiters.
  4. De-synchronise the keys. Write TTLs with jitter, for example 60 seconds plus or minus 10%, so a deploy or a mass invalidation does not align every key on the same second and turn a per-key herd into a fleet-wide one.

Follow-up

  • The same sawtooth appears on a key that is invalidated on write rather than expired. Is that the same bug?
  • How does your answer change if the recompute takes 4 seconds instead of 250 ms?

Suggested practice checklist

Built from the rounds and topics Utmb Health candidates report.

Day 1 — Map the Utmb Health loop

  • Write out the reported sequence: HR Screening Call, Technical and Managerial Conversations, Panel Interviews, Technical Evaluations.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work Risk Management

  • Spend the session on Risk Management, which Utmb Health candidates report being tested on.
  • Write one worked example in Risk Management and time yourself on it.

Deliverable: One timed worked example in Risk Management.

Day 3 — Work Medical Device Regulations

  • Spend the session on Medical Device Regulations, which Utmb Health candidates report being tested on.
  • Write one worked example in Medical Device Regulations and time yourself on it.

Deliverable: One timed worked example in Medical Device Regulations.

Day 4 — Work SQL

  • Spend the session on SQL, which Utmb Health candidates report being tested on.
  • Write one worked example in SQL and time yourself on it.

Deliverable: One timed worked example in SQL.

Day 5 — Answer out loud: .NET and C# Development

  • Answer aloud, timed: Explain the concept of generics in C# and provide a scenario where they are highly beneficial.
  • Answer aloud, timed: What is the difference between an abstract class and an interface in C#?

Deliverable: Spoken answers to 2 reported .NET and C# Development question(s), under time.

Day 6 — Answer out loud: Database and SQL Engineering

  • Answer aloud, timed: Write a SQL query to join three tables and retrieve a specific set of aggregated patient records.
  • Answer aloud, timed: What is the difference between a clustered and a non-clustered index, and how do they affect query performance?

Deliverable: Spoken answers to 2 reported Database and SQL Engineering question(s), under time.

Day 7 — Answer out loud: Security, Compliance, and Architecture

  • Answer aloud, timed: How do you incorporate secure coding practices into your daily development workflow?
  • Answer aloud, timed: Describe your experience with system integration standards or handling sensitive data structures.

Deliverable: Spoken answers to 2 reported Security, Compliance, and Architecture question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

How do you handle exceptions in a multi-layered.NET architecture?

Medium · .NET and C# Development

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Describe your experience with system integration standards or handling sensitive data structures.

Medium · Security, Compliance, and Architecture

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Describe a time you had to design software under strict regulatory compliance or design controls.

Medium · Security, Compliance, and Architecture

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?