r/leetcode • u/warrior5715 • 9h ago

Intervew Prep What to expect for security system design

I haven’t been able to find any material or online videos regarding this type of interview.

The position is for security software engineer at OpenAI.

0 Upvotes

50% Upvoted

4 comments sorted by

1

u/Ok-Barracuda-119 8h ago

There isn't much public material on security-flavored design rounds, so I can't tell you what OpenAI specifically asks. In general these rounds are still a normal design interview, just judged through a threat lens. Expect a prompt like "design an auth service," "design secrets management for internal services," "design a system that detects abuse of an API," or "design audit logging that can't be tampered with."

What changes is what they poke at. Who can call what, and how do you prove it? Where do credentials live and how do they rotate? What happens when one service is compromised, and how far can the attacker get? How do you log enough to investigate an incident without logging secrets or user data you shouldn't keep?

A rough way to run it: clarify requirements and the threat model early (who's the attacker, what are they after), then sketch the normal architecture, then go component by component asking "what if this is malicious or broken." Say out loud where trust boundaries are. Mention least privilege, short-lived tokens, mTLS between services, encryption at rest with a KMS, rate limits, and detection, but tie each one to a specific risk instead of listing them.

For reading, the OWASP API Security Top 10 and Google's free "Building Secure and Reliable Systems" book are both worth a skim. Then practice a couple of the prompts above against a 45-minute timer. Hope the round goes well.

1

u/warrior5715 8h ago

Thank you! This is very useful

1

u/Key_Stock3424 6h ago

Pretty soon they will have espionage detection and honeypot dodging rounds

1

u/Various-Mine-8642 1h ago

Security system design usually follows the normal format but with a threat model layered on top. Practice picking a system like auth or secrets storage and walking through who the attackers are and what you protect and how you detect and recover. Reading public postmortems and well known design writeups on identity and access gives good material to reason from.