Weber Shandwick Software Engineer Interview Guide

The 60-second brief

A Software Engineer at Weber Shandwick plays a unique and pivotal role at the intersection of technology, data, and creative storytelling. As one of the world's leading communications and marketing solutions firms, Weber Shandwick relies heavily on custom digital platforms, data analytics engines, and innovative marketing technologies (MarTech) to deliver high-impact campaigns for global clients. In this role, you will build and optimize scalable web applications, secure internal systems, and design tools that enable creative teams to execute data-driven strategies with precision. The engineering team at Weber Shandwick tackles complex problems ranging from high-performance frontend interfaces to secure data pipelines. Because the company serves high-profile clients with strict compliance standards, your work will directly impact system reliability, data privacy, and user engagement.

This guide is scoped to a Software Engineer candidate at Weber Shandwick.

Focus areas

• React JS
• Security Analysis (Cryptographic Evaluation)
• Python

The Weber Shandwick interview process

Weber Shandwick candidates report 4 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

HR Screening Call

Initial call to discuss your background and align on administrative details.

What to demonstrate

• Initial call to discuss your background and align on administrative details
• Depth in React JS

How to prepare

• Be able to walk your CV end to end in two minutes, and say why this company specifically.
• Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Phone Screen

Discussion with the hiring manager about your resume, past projects, and core technical concepts.

What to demonstrate

• Discussion with the hiring manager about your resume, past projects, and core technical concepts
• Depth in React JS

How to prepare

• Be able to walk your CV end to end in two minutes, and say why this company specifically.
• Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Test

Rigorous technical evaluation, often a hands-on coding challenge or deep-dive live session.

What to demonstrate

• Rigorous technical evaluation, often a hands-on coding challenge or deep-dive live session
• Depth in React JS

How to prepare

• Answer aloud and timed: Given an unsorted array, find the longest consecutive sequence of elements in O(n) time.
• Answer aloud and timed: Implement a function to detect cycles in a directed graph.

Final Round Panel Interviews

Interviews with the cross-functional team to assess overall fit and technical skills.

What to demonstrate

• Interviews with the cross-functional team to assess overall fit and technical skills
• Depth in React JS

How to prepare

• Answer aloud and timed: Solve a classic string manipulation or sliding window problem within a strict 45-minute window.
• Answer aloud and timed: How would you optimize a search algorithm to run in logarithmic time instead of linear time?

Where candidates lose points

Align on compensation early

Candidates have reported that salary expectations are sometimes vetted very early in the chat or screening phase. Ensure you have a clear, realistic expectation ready to avoid early dropouts.

Master React JS fundamentals

If you are interviewing for a frontend-heavy role, expect a highly detailed discussion on React JS. Be ready to write code, explain hooks, and discuss state optimization strategies in depth.

Choosing a schema before the access patterns are known

Write the queries first, with their filters, sort orders, cardinalities and which ones sit on the latency-critical path, then design tables and indexes to serve them. An index nothing queries still costs write throughput and storage, and a hot query with no supporting index becomes a full scan that only hurts once the table is big.

Questions & practice

Given an unsorted array, find the longest consecutive sequence of elements in O(n) time.

Medium · Data Structures & Algorithms

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Implement a function to detect cycles in a directed graph.

Medium · Data Structures & Algorithms

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Solve a classic string manipulation or sliding window problem within a strict 45-minute window.

Medium · Data Structures & Algorithms

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

How would you optimize a search algorithm to run in logarithmic time instead of linear time?

Medium · Data Structures & Algorithms

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

1. Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
2. Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
3. For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
4. State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

• A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
• How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Replace offset paging on the resource feed with keyset

Easy · keyset pagination · composite index · sort order

resource holds resource_id, tenant_id, owner_user_id, title, body_ref, version, status ('draft','active','archived','deleted'), created_at, updated_at, deleted_at, with an index on (tenant_id, status, updated_at DESC, resource_id DESC). The listing endpoint returns active resources for one tenant, newest update first, 50 per page, today with LIMIT 50 OFFSET n. Tenants reach page 400 and rows are created while they read. Write the keyset query, define what the cursor carries and how it is encoded, and say which part of the index each predicate uses. Assume PostgreSQL 16.

Approach

1. Name the two failures separately. OFFSET 20000 makes the server produce and discard 20,000 rows, so page cost grows with depth rather than with page size. Independently, any write that changes how many rows sort above the offset moves the window between two fetches, and the direction decides which anomaly you get: an insert lands at the head of updated_at DESC and pushes already-returned rows down past the boundary, so they are returned a second time; a delete above the offset, or a row whose updated_at is bumped above the cursor, pulls rows up and one is never returned at all. Nothing in the response reveals either.
2. Write the seek: WHERE tenant_id = $1 AND status = 'active' AND (updated_at, resource_id) < ($2, $3) ORDER BY updated_at DESC, resource_id DESC LIMIT 50. The row-value comparison is one index range rather than a disjunction, and both columns are NOT NULL, which is what makes that comparison well defined.
3. Map each predicate onto the index: tenant_id and status are equality on the leading columns, (updated_at, resource_id) is the range, and the ORDER BY matches the index order so no Sort node appears and the scan stops after 50 rows. The DESC in the definition only matters for mixed directions — a plain ascending btree on the same columns is read backwards for this query.
4. Put both sort columns in the cursor and nothing the client can tamper with into another tenant: base64 of (updated_at, resource_id), validated server-side, with tenant_id taken from the principal.

Follow-up

• The client asks for 'jump to page 400'. What do you offer instead, and what does the honest version cost?
• Sort order becomes user-selectable across four columns. How many indexes is that, and which would you refuse to add?

Explain the virtual DOM in React JS and how it optimizes rendering performance.

Medium · Frontend & UI Engineering

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

How do you manage global state in a complex React JS application, and when would you choose Context API over R

Medium · Frontend & UI Engineering

How do you manage global state in a complex React JS application, and when would you choose Context API over Redux?

Approach

1. Say who the caller is and what they do when the call fails halfway.
2. Define the identity of a request so a retry cannot double-apply it.
3. Separate accepted, pending, failed and confirmed; they are different facts.
4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

• What happens if the caller retries after a timeout?
• How does a client discover it is on an old version of this contract?

Describe the lifecycle hooks in React JS and how you would replicate them using Functional Components.

Medium · Frontend & UI Engineering

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

How would you optimize a web application to ensure fast load times and high accessibility scores?

Medium · Frontend & UI Engineering

Approach

1. Clarify what is being asked and what a complete answer contains.
2. State your assumptions explicitly before working the problem.
3. Say what you would check first and why it is the highest-information step.
4. Work from the requirement backwards to the design.

Follow-up

• What assumption would you test first?
• How would you know your answer was wrong?

Explain how you would design and implement an image encryption system using chaotic maps (such as Logistic and

Medium · Security & System Architecture

Explain how you would design and implement an image encryption system using chaotic maps (such as Logistic and Arnold-Cat maps) in Python.

Approach

1. Fix the scope first: who calls this, how often, and what they do when it fails.
2. Name the read and write paths separately; they rarely have the same bottleneck.
3. Choose a partition key and say what query it makes expensive.
4. State the consistency you need, and where you are willing to be stale.

Follow-up

• What breaks first when traffic grows ten times?
• How does this behave when that dependency is down for an hour?

How do you conduct statistical security analyses, such as NPCR and UACI tests, to prove resistance to differen

Medium · Security & System Architecture

How do you conduct statistical security analyses, such as NPCR and UACI tests, to prove resistance to differential attacks?

Approach

1. Fix the scope first: who calls this, how often, and what they do when it fails.
2. Name the read and write paths separately; they rarely have the same bottleneck.
3. Choose a partition key and say what query it makes expensive.
4. State the consistency you need, and where you are willing to be stale.

Follow-up

• What breaks first when traffic grows ten times?
• How does this behave when that dependency is down for an hour?

Describe the process of securing API endpoints against common vulnerabilities like SQL injection and cross-sit

Medium · Security & System Architecture

Describe the process of securing API endpoints against common vulnerabilities like SQL injection and cross-site scripting (XSS).

Approach

1. Say who the caller is and what they do when the call fails halfway.
2. Define the identity of a request so a retry cannot double-apply it.
3. Separate accepted, pending, failed and confirmed; they are different facts.
4. Design the error taxonomy before the success shape; callers branch on it.

Follow-up

• What happens if the caller retries after a timeout?
• How does a client discover it is on an old version of this contract?

How do you manage secure data storage and encryption for client-sensitive media assets?

Medium · Security & System Architecture

Approach

1. Fix the scope first: who calls this, how often, and what they do when it fails.
2. Name the read and write paths separately; they rarely have the same bottleneck.
3. Choose a partition key and say what query it makes expensive.
4. State the consistency you need, and where you are willing to be stale.

Follow-up

• What breaks first when traffic grows ten times?
• How does this behave when that dependency is down for an hour?

p99 jumped on one listing filter while p50 stayed flat

Medium · query planning · composite index · percentiles

After a release that added an owner_user_id filter to the resource listing, p99 rose from 90 ms to 1.9 s while p50 stayed at 40 ms. Traffic and row counts are unchanged. resource carries the index (tenant_id, status, updated_at DESC, resource_id DESC). The new query filters tenant_id and owner_user_id, orders by updated_at DESC, resource_id DESC, and takes 20 rows. On PostgreSQL, explain the shape of the regression, prove it from a query plan, and give the index you would add.

Approach

1. Start from the shape. A flat p50 with a moved p99 means a subset of requests changed cost, not all of them, so the first job is naming the subset. Bucket the endpoint's latency by the tenant's row count; the natural hypothesis is that large tenants are a small share of requests and all of the tail.
2. Get the plan for the new query on a large tenant with EXPLAIN (ANALYZE, BUFFERS). Expect an index scan over the tenant's range, a filter discarding most of it, then a Sort feeding the Limit, possibly reporting Sort Method: external merge Disk. Read actual rows on the scan node, not estimated.
3. Explain why the existing index cannot serve it. A composite B-tree is seekable only as a left prefix, and with no equality predicate on status the scan cannot treat updated_at as an ordering, because rows in the tenant's range are ordered by status first. Everything matching must be read and sorted before LIMIT 20 can apply, so a tenant with 400,000 rows pays 400,000 rows to return 20.
4. Add (tenant_id, owner_user_id, updated_at DESC, resource_id DESC). Equality on the first two columns leaves the index ordered by updated_at within that pair, so the plan becomes an index scan that stops after 20 rows with no Sort node. PostgreSQL can scan a B-tree backwards, so the DESC markers matter only if the two sort columns ever disagree in direction; keeping them explicit documents the order the keyset cursor depends on.

Follow-up

• The endpoint paginates with OFFSET. What does page 500 cost with your index, and what does the keyset version cost?
• How would you have caught this before release, given that a 10,000-row seed database produces the same plan shape at an unnoticeable cost?

Suggested practice checklist

Built from the rounds and topics Weber Shandwick candidates report.

Day 1 — Map the Weber Shandwick loop

• Write out the reported sequence: HR Screening Call, Technical Phone Screen, Technical Test, Final Round Panel Interviews.
• For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 4 reported rounds, with the weakest marked.

Day 2 — Work React JS

• Spend the session on React JS, which Weber Shandwick candidates report being tested on.
• Write one worked example in React JS and time yourself on it.

Deliverable: One timed worked example in React JS.

Day 3 — Work Security Analysis (Cryptographic Evaluation)

• Spend the session on Security Analysis (Cryptographic Evaluation), which Weber Shandwick candidates report being tested on.
• Write one worked example in Security Analysis (Cryptographic Evaluation) and time yourself on it.

Deliverable: One timed worked example in Security Analysis (Cryptographic Evaluation).

Day 4 — Work Python

• Spend the session on Python, which Weber Shandwick candidates report being tested on.
• Write one worked example in Python and time yourself on it.

Deliverable: One timed worked example in Python.

Day 5 — Answer out loud: Frontend & UI Engineering

• Answer aloud, timed: Explain the virtual DOM in React JS and how it optimizes rendering performance.
• Answer aloud, timed: How do you manage global state in a complex React JS application, and when would you choose Context API over Redux?

Deliverable: Spoken answers to 2 reported Frontend & UI Engineering question(s), under time.

Day 6 — Answer out loud: Data Structures & Algorithms

• Answer aloud, timed: Given an unsorted array, find the longest consecutive sequence of elements in O(n) time.
• Answer aloud, timed: Implement a function to detect cycles in a directed graph.

Deliverable: Spoken answers to 2 reported Data Structures & Algorithms question(s), under time.

Day 7 — Answer out loud: Security & System Architecture

• Answer aloud, timed: Explain how you would design and implement an image encryption system using chaotic maps (such as Logistic and Arnold-Cat maps) in Python.
• Answer aloud, timed: How do you conduct statistical security analyses, such as NPCR and UACI tests, to prove resistance to differential attacks?

Deliverable: Spoken answers to 2 reported Security & System Architecture question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

Ship under a deadline and bound the debt you chose

Medium · pagination · technical debt · tradeoffs

You have four days to ship a tenant-facing listing endpoint. The version you would defend uses keyset pagination over (tenant_id, status, updated_at DESC, resource_id DESC); the version you can finish uses LIMIT/OFFSET with no matching index. Describe a deadline call you actually made of this shape: what you shipped, what you knowingly deferred, how you bounded the damage with a mechanism rather than an intention, and the specific numeric condition that would force the follow-up. Name who you told and where you wrote it down.

Approach

1. Name the deferred failure precisely instead of calling it slow. OFFSET n makes the database produce and discard n rows, so cost grows with page depth; without an index matching the sort, every matching row is read and sorted before the limit applies; and rows inserted between two page fetches shift across the boundary so items are skipped or repeated with nothing in the response to signal it.
2. Bound the blast radius with something mechanical rather than a promise: cap maximum page depth, cap page size, restrict the endpoint to one internal caller, or keep it behind a flag. State which failure each cap removes and which it leaves standing.
3. Attach a number to the trigger and wire it to an alarm: the first tenant crossing N resources, or the endpoint's p99 crossing its share of the 400 ms budget, so the debt announces itself instead of waiting to be remembered.
4. Write it where the next engineer looks, which is the code and the ticket, not a chat message: what was deferred, why, the cap, and the trigger.

Follow-up

• At what page depth does the offset version breach your latency budget, given your page size and row counts?
• What breaks first when you switch to keyset pagination later, and what does a client holding an old page token see?

Estimate work you have never done and defend the range

Hard · estimation · backfills · expand-contract

You are asked to estimate a change you have never attempted: add a column to a 100-million-row table, populate it, move reads across, and drop the old shape. Give a range with the assumptions that generate it, including batch size, the signal your backfill throttles on, and wall-clock hours, and name the three unknowns that would move the number most. Then describe a real estimate you gave under comparable ignorance: how you expressed its uncertainty, what you committed to, and how wrong you turned out to be.

Approach

1. Decompose into independently deployable steps before estimating anything: add the column nullable, write both shapes, backfill in batches, verify, move reads, stop writing the old shape, drop it. That is four deploys spread over days, and the calendar estimate is dominated by them rather than by the loop's runtime.
2. Do the arithmetic aloud for the part that has arithmetic in it: batch size times number of batches times per-batch duration, at a write rate the primary can absorb alongside roughly 1.2k writes per second of production traffic. The loop is throttled by replication lag and lock waits, not by how fast it can issue statements.
3. Price the schema step by its lock rather than its statement duration. In PostgreSQL an ALTER TABLE taking ACCESS EXCLUSIVE waits for every open transaction on that table while later queries queue behind it, so a millisecond change issued during a thirty-second analytics query stalls that table for thirty seconds. Adding a nullable column with a non-volatile default avoids a rewrite from version 11; a new index wants CREATE INDEX CONCURRENTLY, which cannot run inside a transaction block and leaves an invalid index behind if it fails.
4. Express the answer as a range whose endpoints each trace to a stated assumption, then name the cheapest experiment that collapses it, which is almost always running one real batch against the real table and multiplying.

Follow-up

• How do you verify the backfill genuinely finished, given rows written by production traffic while it ran?
• Where does the backfill resume from after a worker is killed mid-batch, and what makes that resume point trustworthy?

Tell callers you do not own that their integration breaks

Medium · deprecation · compatibility · stakeholders

A field in a write endpoint's response must change shape. You own the endpoint; you do not own the four internal callers or the outbound webhook consumers who read it. Describe a deprecation you were responsible for: what you shipped first, how you established who was actually reading the field, the window you gave and what set its length, what you did about the consumer who never moved, and how you decided removal was safe. Name the signal you used, not the announcement you sent.

Approach

1. Establish the reader set empirically rather than from a wiki of owners: per-field usage counters keyed by principal, or access logs attributed to a consumer. State the blind spot of whichever you pick, since a consumer that reads the field only on a monthly job will not appear in a week of logs.
2. Ship additive first. Populate the new field alongside the old one so no reader is forced to move, which is also what keeps a rolling deploy safe, because old and new instances answer the same requests at the same time and a rollback must still find the old shape present.
3. Set the window from the slowest legitimate consumer's release cadence, not from your calendar, and decide separately what to do for a consumer with no release process at all, such as an external webhook endpoint you can only email.
4. Convert silence into evidence before you rely on it: a short, low-traffic removal window that makes a still-dependent consumer fail visibly and loudly while you are watching, rather than at three in the morning after you have moved on.

Follow-up

• How would you detect a consumer that reads the field only during a monthly export?
• One caller refuses to move and has a commercial relationship behind it. What changes in your plan and what does not?