Bloomberg·Software Engineer·Onsite - System Design / Architecture
Jun 2026
Bloomberg system design round for a software engineer role. Four connected questions all built around the same 'hello username' app, which sounds trivial until you realize they want full API specs, auth architecture, session security, and a scalable activity-tracking service before you're done.
- Design the client-server APIs for sign-up, sign-in, sign-out, and fetching a personalized greeting. What are the request and response shapes, status codes, and how do you handle errors?
- How would you handle authentication: stateful sessions vs. stateless tokens like JWT? Walk through password storage, TLS, CSRF protection, and XSS mitigations.
- After a user signs in, how do you prevent someone else from impersonating them by reusing or guessing their session identifier? Cover entropy, rotation, expiration, token storage, and defenses against fixation and replay attacks.
- Design a service that returns the top N most active users over a recent time window. Define what 'active' means, what signals you count, how you model the data, and how you compute it efficiently at scale. Include capacity planning.
“Felt pretty comfortable here since REST API design is bread and butter.” The rest of the author's notes on Software Engineer interview at Bloomberg, Onsite - System Design / Architecture round, covers how they worked through the question, what the panel pushed back on, and what they would do differently.
View Post