Wedbush Securities Software Engineer Interview Guide

The 60-second brief

As a Software Engineer at Wedbush Securities, you play a vital role in maintaining and modernizing the financial technology infrastructure of one of the nation's premier independent financial services firms. Unlike modern tech startups, Wedbush Securities operates within a highly regulated, traditional financial environment where system reliability, transactional accuracy, and data security are paramount. Your work directly impacts the tools used by financial advisors, wealth managers, and clearing operations, ensuring that trades are executed seamlessly and client data remains secure. This role requires a unique balance of technical capability and professional adaptability. You will be responsible for supporting core financial platforms, integrating legacy systems with newer technologies, and building internal tools that streamline complex business processes.

This guide is scoped to a Software Engineer candidate at Wedbush Securities.

Focus areas

• Basic Data Structures
• Technical phone screening
• Logic / logical reasoning tests

The Wedbush Securities interview process

Wedbush Securities candidates report 3 rounds over 3-5 weeks. The stages below are what candidates describe, not a published process.

Initial Screening

Screening by an HR recruiter to discuss background, salary expectations, and interest in the firm.

What to demonstrate

• Screening by an HR recruiter to discuss background, salary expectations, and interest in the firm
• Depth in Basic Data Structures

How to prepare

• Be able to walk your CV end to end in two minutes, and say why this company specifically.
• Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.

Technical Evaluations

Includes online logic and technical assessments, followed by structured conversations with engineering managers.

What to demonstrate

• Includes online logic and technical assessments, followed by structured conversations with engineering managers
• Depth in Basic Data Structures

How to prepare

• Answer aloud and timed: Can you explain the concept of object-oriented programming (OOP) and how you have applied inheritance and polymorphism in your past projects?
• Answer aloud and timed: What are the primary differences between abstract classes and interfaces?

Senior IT Leadership Interview

Conversations with senior IT leadership to assess technical skills and cultural fit.

What to demonstrate

• Conversations with senior IT leadership to assess technical skills and cultural fit
• Depth in Basic Data Structures

How to prepare

• Answer aloud and timed: How do you handle exception handling and resource management in your preferred programming language?
• Answer aloud and timed: Walk me through a logical puzzle or scenario where you had to find an anomaly in a dataset with limited information.

Where candidates lose points

Embrace the traditional culture

Do not try to pitch a "move fast and break things" startup mentality. Show that you value stability, security, thorough testing, and structured change-management processes.

Over-prepare for database questions

A significant portion of the firm's core systems rely heavily on robust database management. Be ready to write clean SQL, explain indexing strategies, and discuss transaction isolation levels.

Showcase your logical thinking

If you are asked to take an online logic or aptitude test, take your time and approach each question systematically. The firm highly values structured, analytical thinkers.

Questions & practice

Explain the difference between an array and a linked list. In what scenarios would you choose one over the oth

Medium · Core Data Structures & Programming Funda

Explain the difference between an array and a linked list. In what scenarios would you choose one over the other?

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

How does a hash map resolve collisions, and what is the worst-case time complexity of its operations?

Medium · Core Data Structures & Programming Funda

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Can you explain the concept of object-oriented programming (OOP) and how you have applied inheritance and poly

Medium · Core Data Structures & Programming Funda

Can you explain the concept of object-oriented programming (OOP) and how you have applied inheritance and polymorphism in your past projects?

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

What are the primary differences between abstract classes and interfaces?

Medium · Core Data Structures & Programming Funda

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Walk me through a logical puzzle or scenario where you had to find an anomaly in a dataset with limited inform

Medium · Logical Reasoning & Problem Solving

Walk me through a logical puzzle or scenario where you had to find an anomaly in a dataset with limited information.

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

How do you ensure data integrity when writing transactions that span multiple database tables?

Medium · Logical Reasoning & Problem Solving

Approach

1. Restate the input: its shape, its size, and what is guaranteed about it.
2. Name the brute-force solution and its complexity before improving on it.
3. Choose the data structure from the access pattern, not from familiarity.
4. State the target complexity and say which constraint rules the naive version out.

Follow-up

• How does this change if the input no longer fits in memory?
• What is the worst case, and how likely is it on real data?

Denormalise tenant onto revisions and backfill it live

Hard · denormalisation · online migration · backfill

resource_revision (revision_id, resource_id, version, actor_user_id, change_kind, patch, request_id, created_at) has 400M rows and no tenant column; tenant_id lives only on resource. Two reads need it: a tenant-scoped audit feed ordered by created_at DESC, and an offboarding purge. Both join back to resource today. Justify adding tenant_id to resource_revision against those two reads, name the anomaly the copy introduces and the constraint that prevents it, then give the ordered migration for a live table taking 1.2k writes/second — the lock each step takes, how the backfill is batched, and where each step stops being reversible. PostgreSQL 16.

Approach

1. Justify from the access path rather than from taste. Without the column, the audit feed either scans resource_revision by created_at and discards other tenants' rows, or resolves the tenant's resource_ids first and probes with them — both proportional to the tenant's whole history rather than to one page. With (tenant_id, created_at DESC, revision_id DESC) it is a seek that stops at 50 rows, and the purge becomes a ranged delete instead of a join.
2. Name the cost exactly: a second copy of a fact can disagree with the first. Make the disagreement unwritable rather than documented — add UNIQUE (resource_id, tenant_id) on resource so it can serve as a foreign-key target, then FOREIGN KEY (resource_id, tenant_id) REFERENCES resource (resource_id, tenant_id) on the revision table. A revision can then only ever carry its parent's tenant.
3. Step one, expand: ALTER TABLE resource_revision ADD COLUMN tenant_id BIGINT NULL, with no default, so it is a catalogue change and no rewrite. It still needs ACCESS EXCLUSIVE for an instant, and that instant queues behind the longest open transaction on the table while every later query queues behind it — set lock_timeout to 2s and retry rather than wait.
4. Step two, dual-write: deploy the writer that populates tenant_id on every new revision while reads still use the join. Reversible by redeploying the previous build, because nothing reads the column yet.

Follow-up

• The backfill is half finished and a rollback is required. What state is the table in, and what does the previous build do with a half-populated column?
• How do you verify the backfill actually finished, given rows are still being inserted while it runs?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

1. Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
2. Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
3. For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
4. State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

• A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
• How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Specify the outbound webhook contract a customer endpoint can verify

Medium · webhooks · hmac · at-least-once

Egress delivery sends resource.created, resource.updated and resource.archived to roughly 40k customer endpoints at about 1.5k deliveries/second, with a per-destination concurrency cap of 4 and a 10 second connect-plus-read timeout, at-least-once from the relay. The receiver is code you do not control, often behind a proxy that may re-encode JSON. Specify the payload envelope, how the receiver verifies authenticity and rejects replays, what ordering it may assume, how it deduplicates, which status codes it should return and what each means to us, and the retry, circuit and replay behaviour.

Approach

1. Send the fact, not a pointer: event_id, event_type, aggregate_type, aggregate_id, aggregate_version, occurred_at and the payload copied from outbox_event. A receiver told only that resource 42 changed has to call back, and the call back returns a newer state than the event describes - that is precisely how a consumer applies changes out of order while believing it is following them.
2. Sign the exact bytes on the wire: HMAC-SHA256 over the timestamp, a separator, and the raw body, in a header, compared in constant time before the body is parsed. Instruct receivers to verify the raw bytes, never a re-serialised copy, since a proxy that reorders keys or changes whitespace invalidates a signature computed over re-encoded JSON. Reject a timestamp outside a tolerance - five minutes is typical - and keep a short seen-set of event_ids, because a capture replayed inside the tolerance still verifies.
3. Support key rotation by sending several signature values in one header during the overlap window and publishing that any one that verifies is sufficient. Without that rule a key rotation is a synchronised outage across every destination at once.
4. State the guarantee as it actually is: at-least-once and unordered, including within a single aggregate_id. The outbox is ordered per aggregate at the source, but the relay holds up to 4 requests in flight per destination and backs off each retry independently, so a version 6 delivery that needs one retry lands after a version 7 that succeeded on its first attempt. Publishing per-aggregate ordering we do not enforce is worse than publishing none, because a receiver that trusts it overwrites new state with old. Receivers deduplicate on event_id and apply conditionally - UPDATE ... WHERE aggregate_version < :incoming, or the same comparison under a row lock on the aggregate - which discards stale redeliveries and stays correct when two deliveries for one aggregate are processed at the same time. A duplicate and an out-of-order delivery then have the same outcome: no-op.

Follow-up

• A customer insists an event never arrived. What do you check, in order, and which table settles the argument?
• A receiver cannot store a version and asks us to deliver their events in order. What would the relay have to give up to offer that, and what does one failing event then do to the rest of their stream?

Relay committed events to the log without gaps or reordering

Medium · transactional outbox · at-least-once · ordering

outbox_event rows are written in the same transaction as the state change and carry aggregate_type, aggregate_id, aggregate_version, payload and status, with a partial index on (created_at, event_id) WHERE status = 'pending'. The relay publishes about 4k events/second to a partitioned append-only log keyed by aggregate_id, with one leader per partition range holding a lease. Consumers must never miss an event; they may see one twice. Design the claim-publish-mark loop, and state exactly what consumers observe when a leader's lease expires while it is mid-batch.

Approach

1. Claim with SELECT ... WHERE status='pending' ORDER BY created_at, event_id LIMIT $batch FOR UPDATE SKIP LOCKED inside a transaction. SKIP LOCKED lets several relay workers share a range without serialising on each other's rows, and the partial index keeps the claim proportional to the backlog rather than to a table that is overwhelmingly published rows. At 4k/second a batch of 500 is eight claims per second, each an index scan of 500 entries.
2. Publish before marking, never the reverse, and say why it is a choice. Marking first loses the event outright if the process dies in the gap, and the loss is silent - nothing remains to retry, and it surfaces later as a projection missing a row. Publishing first can repeat the event, and repetition is what every consumer is already built to survive. That single ordering is the whole at-least-once guarantee.
3. Preserve the only ordering on offer. Partition by aggregate_id and never publish two events for one aggregate concurrently: claim in (created_at, event_id) order and publish sequentially within an aggregate, or hash aggregate_id to a worker slot. Order across aggregates is not available at any price here, which is why the event carries aggregate_version and the full fact rather than a delta - a consumer can then discard what it has already applied without coordinating with anyone.
4. State the failover behaviour precisely, because it is the consistency-versus-availability decision in this design. A lease expires because the holder is slow, and no mechanism distinguishes that from dead, so for the length of the lease window two leaders can publish the same claimed batch. The system accepts duplicates to avoid stalling publication for every aggregate in the range whenever one worker pauses. Consumers deduplicate on (aggregate_id, aggregate_version) and drop anything at or below what they have applied.

Follow-up

• The relay is down 40 minutes and 9.6 million rows are pending. What does catch-up do to the primary, and what changes in the claim loop to survive it?
• A consumer insists it never received an event. Which single query settles whether the relay lost it, and what does each answer look like?

How do you approach debugging a legacy codebase when there is little to no documentation available?

Medium · Logical Reasoning & Problem Solving

Approach

1. Establish what changed and when, before forming any theory.
2. Pick a bisection that eliminates candidates whichever way it turns out.
3. Check the instrumentation before believing the symptom.
4. Separate the trigger from the cause; the deploy is rarely the bug.

Follow-up

• What would you look at first, and what would it rule out?
• How would you tell a cause from a coincidence here?

Suggested practice checklist

Built from the rounds and topics Wedbush Securities candidates report.

Day 1 — Map the Wedbush Securities loop

• Write out the reported sequence: Initial Screening, Technical Evaluations, Senior IT Leadership Interview.
• For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.

Deliverable: A one-page map of the 3 reported rounds, with the weakest marked.

Day 2 — Work Basic Data Structures

• Spend the session on Basic Data Structures, which Wedbush Securities candidates report being tested on.
• Write one worked example in Basic Data Structures and time yourself on it.

Deliverable: One timed worked example in Basic Data Structures.

Day 3 — Work Technical phone screening

• Spend the session on Technical phone screening, which Wedbush Securities candidates report being tested on.
• Write one worked example in Technical phone screening and time yourself on it.

Deliverable: One timed worked example in Technical phone screening.

Day 4 — Work Logic / logical reasoning tests

• Spend the session on Logic / logical reasoning tests, which Wedbush Securities candidates report being tested on.
• Write one worked example in Logic / logical reasoning tests and time yourself on it.

Deliverable: One timed worked example in Logic / logical reasoning tests.

Day 5 — Answer out loud: Core Data Structures & Programming Fundamentals

• Answer aloud, timed: Explain the difference between an array and a linked list. In what scenarios would you choose one over the other?
• Answer aloud, timed: How does a hash map resolve collisions, and what is the worst-case time complexity of its operations?

Deliverable: Spoken answers to 2 reported Core Data Structures & Programming Fundamentals question(s), under time.

Day 6 — Answer out loud: Logical Reasoning & Problem Solving

• Answer aloud, timed: Walk me through a logical puzzle or scenario where you had to find an anomaly in a dataset with limited information.
• Answer aloud, timed: How do you approach debugging a legacy codebase when there is little to no documentation available?

Deliverable: Spoken answers to 2 reported Logical Reasoning & Problem Solving question(s), under time.

Day 7 — Answer out loud: Behavioral & Environmental Fit

• Answer aloud, timed: Why do you want to work at a traditional financial firm like Wedbush Securities rather than a standard technology company?
• Answer aloud, timed: How do you handle working in a highly regulated environment where changes must go through strict approval processes?

Deliverable: Spoken answers to 2 reported Behavioral & Environmental Fit question(s), under time.

Behavioural preparation

Behavioural rounds judge the decision you made and what it cost.

How do you handle exception handling and resource management in your preferred programming language?

Medium · Core Data Structures & Programming Funda

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

Describe a time when you had to optimize a slow-performing database query. What steps did you take to identify

Medium · Logical Reasoning & Problem Solving

Describe a time when you had to optimize a slow-performing database query. What steps did you take to identify the bottleneck?

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

Why do you want to work at a traditional financial firm like Wedbush Securities rather than a standard technol

Medium · Behavioral & Environmental Fit

Why do you want to work at a traditional financial firm like Wedbush Securities rather than a standard technology company?

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

How do you handle working in a highly regulated environment where changes must go through strict approval proc

Medium · Behavioral & Environmental Fit

How do you handle working in a highly regulated environment where changes must go through strict approval processes?

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

Describe a situation where you had to explain a complex technical concept to a non-technical stakeholder or a

Medium · Behavioral & Environmental Fit

Describe a situation where you had to explain a complex technical concept to a non-technical stakeholder or a senior executive.

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?

How do you manage your time and prioritize tasks when working on multiple legacy systems with competing deadli

Medium · Behavioral & Environmental Fit

How do you manage your time and prioritize tasks when working on multiple legacy systems with competing deadlines?

Approach

1. Pick a story where you made the decision, not one where you watched it.
2. State the situation in two sentences and spend the rest on the reasoning.
3. Give the blast radius: what could have broken, and what you measured.
4. Name the disagreement and how you resolved it with evidence.

Follow-up

• What would you do differently if you ran that again?
• How did you know your change caused the improvement?