← Bloomberg Interview Insights

Bloomberg·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
Jun 2026

Summary

Bloomberg system design round for a software engineer role. Four connected questions all built around the same 'hello username' app, which sounds trivial until you realize they want full API specs, auth architecture, session security, and a scalable activity-tracking service before you're done.

Questions Asked (4)

Q1

Design the client-server APIs for sign-up, sign-in, sign-out, and fetching a personalized greeting. What are the request and response shapes, status codes, and how do you handle errors?

API & IntegrationsSystem DesignTechnical Trade-offs
Author's notes

Felt pretty comfortable here since REST API design is bread and butter.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and constraints (e.g., security, statelessness, token strategy) before diving into endpoint design. Then walk through each API with request/response shapes, status codes, and error handling, emphasizing consistency and security best practices. Finally, discuss trade-offs and how you would handle edge cases like token expiration or invalid credentials.

Pro tip: Demonstrate awareness of security best practices by using HTTPS, hashing passwords, and using short-lived tokens with refresh mechanisms. Also, mention idempotency for sign-out and how to handle concurrent sessions.

1. Clarify Requirements and Constraints

Ask about expected scale, security requirements, client types (web, mobile), and whether sessions should be stateful or stateless. This shows you think before coding.

2. Design Sign-Up API

Define POST /signup with request body containing email, password, and optional profile data. Response returns 201 Created with user ID and possibly a token. Handle errors like 400 for invalid input, 409 for duplicate email.

3. Design Sign-In and Sign-Out APIs

For sign-in, use POST /signin with credentials, returning 200 OK with an access token (and refresh token). For sign-out, use POST /signout with token, returning 204 No Content. Discuss token invalidation strategies.

4. Design Personalized Greeting API

Define GET /greeting with Authorization header. Return 200 OK with a JSON object containing the greeting message. Handle 401 Unauthorized if token is missing or invalid.

5. Discuss Error Handling and Trade-offs

Outline consistent error response format (e.g., {error: {code, message}}), appropriate status codes (400, 401, 403, 404, 409, 500), and trade-offs like JWT vs. session tokens, token expiration, and refresh strategies.

Key Points to Mention

  • Use HTTPS for all endpoints to ensure transport security.
  • Hash passwords with a strong algorithm like bcrypt before storing.
  • Use JWT or opaque tokens for authentication; consider short-lived access tokens with refresh tokens.
  • Return appropriate HTTP status codes: 201 for sign-up, 200 for sign-in, 204 for sign-out, 401 for unauthorized.
  • Implement rate limiting and account lockout to prevent brute-force attacks.
  • Ensure sign-out invalidates the token server-side if using stateful sessions, or use short expiration for stateless tokens.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q2

How would you handle authentication: stateful sessions vs. stateless tokens like JWT? Walk through password storage, TLS, CSRF protection, and XSS mitigations.

System DesignTechnical Trade-offsAPI & Integrations
Author's notes

This is where I spent the most time.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by comparing stateful sessions and stateless JWTs in terms of scalability, revocation, and complexity, then recommend a hybrid approach based on requirements. Walk through the security layers—password hashing, TLS, CSRF, and XSS—showing how they complement the chosen authentication method. Emphasize defense-in-depth and practical trade-offs relevant to Bloomberg's high-security, low-latency environment.

Pro tip: Mention that JWTs should be short-lived and paired with refresh tokens stored in HttpOnly cookies to balance statelessness with revocation, and highlight that Bloomberg's strict security posture likely favors a hybrid model with server-side session invalidation for sensitive operations.

1. Compare stateful vs. stateless

Discuss trade-offs: stateful sessions offer easy revocation and server-side control but require shared storage; stateless JWTs scale horizontally and reduce DB lookups but complicate revocation and can grow large.

2. Recommend a hybrid approach

Propose using short-lived JWTs for most API calls and stateful sessions for sensitive actions (e.g., trading, account changes), or use refresh tokens with server-side revocation lists.

3. Secure password storage

Explain using adaptive hashing algorithms like bcrypt, scrypt, or Argon2 with per-user salts and appropriate work factors, and never storing plaintext or reversible encryption.

4. Enforce transport and session security

Mandate TLS 1.2+ with HSTS, secure and HttpOnly cookie flags, and SameSite attributes to mitigate CSRF and session hijacking.

5. Mitigate CSRF and XSS

For CSRF: use anti-CSRF tokens or SameSite cookies; for XSS: apply output encoding, Content Security Policy, and input validation, and avoid storing tokens in localStorage.

Key Points to Mention

  • JWT structure (header, payload, signature) and signing algorithms (HMAC vs. RSA/ECDSA)
  • Token revocation strategies: blacklists, short expiry, refresh token rotation
  • Password hashing best practices: bcrypt/scrypt/Argon2, salting, work factor tuning
  • TLS configuration: certificate pinning, HSTS, perfect forward secrecy
  • CSRF defenses: synchronizer token pattern, double-submit cookie, SameSite cookies
  • XSS mitigations: output encoding, CSP, HttpOnly cookies, input sanitization

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q3

After a user signs in, how do you prevent someone else from impersonating them by reusing or guessing their session identifier? Cover entropy, rotation, expiration, token storage, and defenses against fixation and replay attacks.

System DesignTechnical Trade-offs
Author's notes

Honestly my weakest answer.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by defining the threat model: session hijacking via token theft, guessing, fixation, and replay. Then walk through the session lifecycle—generation, storage, transmission, rotation, and expiration—explaining how each control (entropy, HttpOnly/Secure cookies, rotation, timeouts, binding) mitigates specific attacks. Conclude with trade-offs between security and usability, and mention additional defenses like TLS and CSRF protection.

Pro tip: Emphasize that session security is defense-in-depth: no single control is sufficient. Mention that you would combine high-entropy tokens, secure cookie attributes, rotation on privilege change, and server-side validation to make impersonation impractical.

1. Define the threat model

Identify the main risks: session guessing, theft, fixation, and replay. This sets the context for why each control is necessary.

2. Generate strong session identifiers

Use a cryptographically secure random number generator with at least 128 bits of entropy to make guessing infeasible.

3. Store and transmit tokens securely

Store session IDs in HttpOnly, Secure, SameSite cookies to prevent XSS theft and CSRF. Avoid URL or local storage. Always use TLS.

4. Rotate and expire sessions

Rotate the session ID after login and privilege changes to prevent fixation. Set idle and absolute timeouts to limit the window for replay.

5. Add additional binding and validation

Bind sessions to client attributes (e.g., IP, user agent) and validate on each request. Use server-side revocation and monitor for anomalies.

Key Points to Mention

  • Entropy: use CSPRNG with ≥128 bits to prevent brute-force guessing.
  • Rotation: regenerate session ID after authentication and privilege elevation to thwart fixation.
  • Expiration: implement idle and absolute timeouts to reduce replay window.
  • Token storage: use HttpOnly, Secure, SameSite cookies; avoid client-side storage.
  • Defenses against fixation: invalidate old session and issue new one upon login.
  • Defenses against replay: bind session to client context, use one-time tokens for sensitive actions, and employ TLS.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q4

Design a service that returns the top N most active users over a recent time window. Define what 'active' means, what signals you count, how you model the data, and how you compute it efficiently at scale. Include capacity planning.

System DesignData ModelingProduct Analytics & Metrics
Author's notes

My favorite part of the whole interview.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and defining 'active' with specific signals and time window. Then design a scalable data pipeline and computation layer, and finally discuss capacity planning and trade-offs.

Pro tip: Emphasize the importance of defining 'active' in collaboration with product stakeholders and consider using approximate algorithms like Count-Min Sketch for efficiency at scale.

1. Clarify Requirements and Define 'Active'

Ask questions to understand the scale, latency, and accuracy needs. Define 'active' based on product context, e.g., a user who performs at least one action (login, trade, view) within the time window.

2. Identify Signals and Data Sources

List the events that count as activity (e.g., logins, trades, page views) and their sources (application logs, message queues). Consider weighting signals if some actions are more meaningful.

3. Design Data Model and Storage

Choose a schema to store user activity events with timestamps. Use a time-series database or a distributed store like Cassandra for high write throughput, and consider pre-aggregation for efficiency.

4. Compute Top N Efficiently

Use a streaming or batch approach: for real-time, maintain a sliding window with a priority queue or use approximate algorithms (e.g., Count-Min Sketch) to handle high cardinality. For batch, use MapReduce or Spark to aggregate counts per user and then sort.

5. Capacity Planning and Scalability

Estimate data volume (events per second, storage per day), compute resources needed, and design for horizontal scaling. Discuss partitioning, replication, and caching to meet latency and throughput requirements.

Key Points to Mention

  • Definition of 'active' should be product-driven and may include multiple signals with weights.
  • Use of approximate algorithms (e.g., Count-Min Sketch, HyperLogLog) for memory-efficient counting at scale.
  • Data partitioning by time and user to enable parallel processing and efficient queries.
  • Trade-offs between accuracy, latency, and cost; consider batch vs. streaming processing.
  • Capacity planning: estimate QPS, storage, and compute resources; plan for peak loads and scalability.
  • Monitoring and validation: ensure the system's output aligns with business metrics and can be audited.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.