Scope of this track
For: backend, fullstack, distributed systems, and data engineers in senior FAANG loops.
Not for: security engineer / pentester interviews. We skip exploit development, formal verification, and compliance audit deep dives.
Sibling tracks: Networking owns TLS handshakes and cert chains. Microservices owns mesh mTLS operations. AI Systems owns LLM-specific guardrails. This track fills application-security gaps across all paths.
CIA triad (know it cold)
| Pillar | Question | Engineer example |
|---|---|---|
| Confidentiality | Who can read it? | Encrypt PII; authZ on every read |
| Integrity | Who can change it? | HMAC webhooks; signed JWTs |
| Availability | Can attackers deny service? | Rate limits; DDoS at edge |
Principles interviewers expect
- Least privilege — IAM roles, DB users, API scopes minimal
- Defense in depth — no single gate; assume breach
- Fail secure — auth error → deny, not admin fallback
- Don't roll your own crypto — use libraries + platform KMS
- Validate at trust boundaries — every external input
Who owns what at FAANG scale
| App team | Platform / security team |
|---|---|
| AuthZ logic, input validation | WAF, SOC, pentest program |
| Secure API design | HSM, enterprise SSO integration |
| Secrets in app config (via vault) | KMS policies, cert rotation |
| Threat model for feature | Company-wide security standards |
Senior signal: "We'd use the platform vault and OAuth library — I'd focus on authorization bugs and IDOR in our domain model."
OWASP Top 10 — engineer view
Not memorizing CVEs — knowing categories that appear in code review:
- Broken access control
- Cryptographic failures
- Injection
- Insecure design
- Security misconfiguration
- Vulnerable components
- Auth failures
- Data integrity failures
- Logging failures
- SSRF
Path-specific topics below expand each area relevant to your role.
When security appears in interviews
- System design: "How do you secure this?" — 5–10 min thread, not whole round
- LLD: auth on public API, rate limiter abuse
- Behavioral: incident you handled, security trade-off you made
Cross-reference topics by path: Auth (all), Web (fullstack), API (backend), Distributed (platform), Data (DE).
Further Reading
Hands-On Tasks (Optional)
Security design drills — threat modeling, auth flows, and incident playbooks. Assumes Networking (TLS) fundamentals.
- Prioritize threats for a B2B SaaS API15m
List top 5 threats (not 50): credential theft, IDOR, data leak, DDoS, insider. For each: one mitigation an app team owns vs one for security/platform team.