cswork / libraryOpen practice workspace

Interview guides · Varo Bank

Varo Bank Software Engineer Interview Guide

Varo Bank Software Engineer interview guide: reported rounds, questions and how candidates describe the process.

The 60-second brief

A Software Engineer at Varo Bank plays a pivotal role in redefining the modern banking experience. As the first consumer fintech in the United States to secure a national bank charter, Varo Bank operates at the unique intersection of a technology startup and a fully regulated financial institution. This means engineers do not just build features; they design, deploy, and maintain highly secure, scalable, and compliant systems that impact the financial lives of millions of everyday consumers. In this role, you will contribute to core banking platforms, transactional ledgers, payment processing pipelines, and mobile-first user experiences. The engineering team is tasked with solving complex problems around real-time data processing, distributed systems consistency, and high-availability infrastructure.

This guide is scoped to a Software Engineer candidate at Varo Bank.

Focus areas

  • System Design
  • Coding (Algorithms)
  • Leadership

The Varo Bank interview process

Varo Bank candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Recruiter Screen

Initial contact with a recruiter to discuss the role and assess fit.

What to demonstrate

  • Initial contact with a recruiter to discuss the role and assess fit
  • Depth in System Design

How to prepare

  • Be able to walk your CV end to end in two minutes, and say why this company specifically.
  • Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Hiring Manager Conversation

Discussion with the hiring manager or an engineering leader about the role and expectations.

What to demonstrate

  • Discussion with the hiring manager or an engineering leader about the role and expectations
  • Depth in System Design

How to prepare

  • Prepare two projects you led end to end, each with the decision you owned and what it cost.
  • Have three questions about the team's roadmap and how success is measured in the first six months.

Technical Assessment

Candidates may complete a take-home coding challenge or participate in a live technical screening.

What to demonstrate

  • Candidates may complete a take-home coding challenge or participate in a live technical screening
  • Depth in System Design

How to prepare

  • Answer aloud and timed: Design a real-time peer-to-peer payment transfer system (like Venmo or Zelle).
  • Answer aloud and timed: How would you architect a transaction ledger system that guarantees consistency and idempotency across multiple distributed databases?

Virtual Onsite Panel

Multiple rounds covering coding, system design, and behavioral leadership in a virtual setting.

What to demonstrate

  • Multiple rounds covering coding, system design, and behavioral leadership in a virtual setting
  • Depth in System Design

How to prepare

  • Answer aloud and timed: Design a notification service that can reliably send push notifications, SMS, and emails to millions of users daily.
  • Answer aloud and timed: Explain how you would migrate a legacy monolithic banking service to a modern microservices architecture with minimal downtime.

Where candidates lose points

Clarify take-home requirements early

If your pipeline includes a take-home coding challenge, make sure to read the instructions thoroughly and ask clarifying questions immediately if any requirements seem ambiguous.

Focus on data integrity

When designing systems, always address how you will handle partial failures, network retries, and data consistency. In fintech, losing or duplicating a transaction is not an option.

Over-communicate during coding

Do not code in silence. Talk through your approach, explain why you are choosing a specific data structure, and discuss trade-offs before you start typing.

Questions & practice

Write an algorithm to detect duplicate transactions within a specific time window.

Medium · Coding & Algorithmic Problem Solving

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Given a list of account balances and transaction histories, reconstruct the ledger and identify any inconsiste

Medium · Coding & Algorithmic Problem Solving

Given a list of account balances and transaction histories, reconstruct the ledger and identify any inconsistencies.

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Implement a standard data structure operation, such as balancing a binary search tree or reversing a linked li

Medium · Coding & Algorithmic Problem Solving

Implement a standard data structure operation, such as balancing a binary search tree or reversing a linked list, and discuss its complexity.

Approach

  1. Restate the input: its shape, its size, and what is guaranteed about it.
  2. Name the brute-force solution and its complexity before improving on it.
  3. Choose the data structure from the access pattern, not from familiarity.
  4. State the target complexity and say which constraint rules the naive version out.

Follow-up

  • How does this change if the input no longer fits in memory?
  • What is the worst case, and how likely is it on real data?

Find version gaps and relay lag with window functions

Medium · window functions · event tables · frame semantics

outbox_event holds event_id, aggregate_type, aggregate_id, aggregate_version, event_type, payload, status ('pending','published','dead'), attempts, created_at, published_at. A projection is missing rows and you must decide whether the relay skipped events or the consumer dropped them. Write three queries over the last seven days: one listing every aggregate_id whose published aggregate_version sequence has a hole, one giving per-day counts with a running total, and one returning the newest published event per aggregate. For each, say where the window function is evaluated relative to WHERE and LIMIT. PostgreSQL 16.

Approach

  1. Gaps: compute lead(aggregate_version) OVER (PARTITION BY aggregate_id ORDER BY aggregate_version) in a subquery, then filter next_version <> aggregate_version + 1 in the outer query. Window functions are evaluated after WHERE, GROUP BY and HAVING and before the outer ORDER BY and LIMIT, so the predicate cannot sit in the same WHERE clause and PostgreSQL 16 has no QUALIFY.
  2. Say what the seven-day filter does to the answer: it truncates every partition, so the first row per aggregate has no predecessor inside the window and a hole spanning the boundary is invisible. Widen the window, or join to resource.version as the authority for the true maximum.
  3. Running total: SELECT date_trunc('day', created_at) AS d, count() AS n, sum(count()) OVER (ORDER BY date_trunc('day', created_at) ROWS UNBOUNDED PRECEDING). An aggregate inside a window call is legal because grouping runs before windowing. The grouping key is unique per row here so ROWS and RANGE agree, but write the frame anyway — over ungrouped rows with tied timestamps the default RANGE frame pulls in every peer row and the total jumps.
  4. Newest per aggregate: DISTINCT ON (aggregate_id) ... ORDER BY aggregate_id, aggregate_version DESC is the cheap PostgreSQL-only form when an index matches that order; row_number() OVER (PARTITION BY aggregate_id ORDER BY aggregate_version DESC) = 1 is the portable form and needs a subquery for the same evaluation-order reason as the gap query.

Follow-up

  • Relay failover redelivers events. Does a duplicate break the gap query, and how would you detect one from this table alone?
  • Turn the gap check into a continuous monitor rather than a query someone runs after an incident. What does it watch?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

  1. Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
  2. Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
  3. For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
  4. State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

  • A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
  • How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Implement a basic rate-limiting algorithm to protect an API endpoint from excessive requests.

Medium · Coding & Algorithmic Problem Solving

Approach

  1. Say who the caller is and what they do when the call fails halfway.
  2. Define the identity of a request so a retry cannot double-apply it.
  3. Separate accepted, pending, failed and confirmed; they are different facts.
  4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

  • What happens if the caller retries after a timeout?
  • How does a client discover it is on an old version of this contract?

Design a real-time peer-to-peer payment transfer system (like Venmo or Zelle).

Medium · System Design & Architecture

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

How would you architect a transaction ledger system that guarantees consistency and idempotency across multipl

Medium · System Design & Architecture

How would you architect a transaction ledger system that guarantees consistency and idempotency across multiple distributed databases?

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Design a notification service that can reliably send push notifications, SMS, and emails to millions of users

Medium · System Design & Architecture

Design a notification service that can reliably send push notifications, SMS, and emails to millions of users daily.

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Explain how you would migrate a legacy monolithic banking service to a modern microservices architecture with

Medium · System Design & Architecture

Explain how you would migrate a legacy monolithic banking service to a modern microservices architecture with minimal downtime.

Approach

  1. Fix the scope first: who calls this, how often, and what they do when it fails.
  2. Name the read and write paths separately; they rarely have the same bottleneck.
  3. Choose a partition key and say what query it makes expensive.
  4. State the consistency you need, and where you are willing to be stale.

Follow-up

  • What breaks first when traffic grows ten times?
  • How does this behave when that dependency is down for an hour?

Edge instances grow 400 MB per hour until the nightly restart

Hard · memory leak · heap analysis · metric cardinality

Edge API instances start at 700 MB resident and grow about 400 MB/hour; a nightly rolling restart has hidden it for weeks. Growth continues unchanged when request rate halves overnight, p99 degrades in the last hours before an instance is recycled, and heap used immediately after a forced full GC rises monotonically. The service holds no product state. Name the discriminating measurement that separates the plausible causes, give the most likely cause, and give the fix and how you would verify it.

Approach

  1. Separate resident memory from live heap first, because they fail differently. Resident size can grow from fragmentation, native buffers or thread stacks while the heap is flat; heap used after a full GC rising monotonically is the measurement that says objects are reachable and not being released. You already have it, so this is retention, not fragmentation, and that closes off half the candidate list.
  2. Use the rate's independence from traffic as the discriminator. Growth that continues at half the request rate rules out per-request objects that are merely slow to collect and points at a structure that grows with distinct values observed rather than with call volume. Write the candidates that have that property: a metrics registry keyed on a high-cardinality label, an unevicted cache, an interner, a per-key lock map.
  3. Take two heap snapshots an hour apart and diff by retained size, reading the dominator tree, not by allocation count or instance count. Expect one root holding a map with millions of entries, then follow the reference chain to the code that inserts and never removes. Allocation profilers point at churn, which is the wrong signal here.
  4. The candidate that fits this service is an observability label carrying an identifier, such as a request path recorded before templating so that /v1/resources/48213 becomes its own metric series. That grows with distinct ids seen, is independent of rate, and explains the late p99 degradation, since GC cost rises with the size of the live set.

Follow-up

  • Post-GC heap is now flat but resident size still creeps. What are you looking at, and does it matter?
  • How would you have detected this before an OOM, given the nightly restart masked the trend?

Suggested practice checklist

Built from the rounds and topics Varo Bank candidates report.

Day 1 — Map the Varo Bank loop

  • Write out the reported sequence: Recruiter Screen, Hiring Manager Conversation, Technical Assessment, Virtual Onsite Panel.
  • For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work System Design

  • Spend the session on System Design, which Varo Bank candidates report being tested on.
  • Write one worked example in System Design and time yourself on it.

Deliverable: One timed worked example in System Design.

Day 3 — Work Coding (Algorithms)

  • Spend the session on Coding (Algorithms), which Varo Bank candidates report being tested on.
  • Write one worked example in Coding (Algorithms) and time yourself on it.

Deliverable: One timed worked example in Coding (Algorithms).

Day 4 — Work Leadership

  • Spend the session on Leadership, which Varo Bank candidates report being tested on.
  • Write one worked example in Leadership and time yourself on it.

Deliverable: One timed worked example in Leadership.

Day 5 — Answer out loud: Coding & Algorithmic Problem Solving

  • Answer aloud, timed: Write an algorithm to detect duplicate transactions within a specific time window.
  • Answer aloud, timed: Implement a basic rate-limiting algorithm to protect an API endpoint from excessive requests.

Deliverable: Spoken answers to 2 reported Coding & Algorithmic Problem Solving question(s), under time.

Day 6 — Answer out loud: System Design & Architecture

  • Answer aloud, timed: Design a real-time peer-to-peer payment transfer system (like Venmo or Zelle).
  • Answer aloud, timed: How would you architect a transaction ledger system that guarantees consistency and idempotency across multiple distributed databases?

Deliverable: Spoken answers to 2 reported System Design & Architecture question(s), under time.

Day 7 — Answer out loud: Behavioral & Leadership

  • Answer aloud, timed: Describe a time when you had to make a technical decision that went against the preference of your peers or manager. How did you resolve the conflict?
  • Answer aloud, timed: Tell me about a time you had to work on a boring or highly administrative task. How did you maintain your motivation and ensure high-quality delivery?

Deliverable: Spoken answers to 2 reported Behavioral & Leadership question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

Describe a time when you had to make a technical decision that went against the preference of your peers or ma

Medium · Behavioral & Leadership

Describe a time when you had to make a technical decision that went against the preference of your peers or manager. How did you resolve the conflict?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Tell me about a time you had to work on a boring or highly administrative task. How did you maintain your moti

Medium · Behavioral & Leadership

Tell me about a time you had to work on a boring or highly administrative task. How did you maintain your motivation and ensure high-quality delivery?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

Give an example of a project that failed or fell short of expectations. What did you learn, and how did you ap

Medium · Behavioral & Leadership

Give an example of a project that failed or fell short of expectations. What did you learn, and how did you apply those lessons to future work?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?

How do you balance the pressure to deliver features quickly with the need to maintain code quality and address

Medium · Behavioral & Leadership

How do you balance the pressure to deliver features quickly with the need to maintain code quality and address technical debt?

Approach

  1. Pick a story where you made the decision, not one where you watched it.
  2. State the situation in two sentences and spend the rest on the reasoning.
  3. Give the blast radius: what could have broken, and what you measured.
  4. Name the disagreement and how you resolved it with evidence.

Follow-up

  • What would you do differently if you ran that again?
  • How did you know your change caused the improvement?