Google Security Engineer Interview Questions

I would start with a threat model, then apply layered controls such as strong authentication, authorization, input validation, secure session handling, encryption in transit and at rest, and logging. I would also review common attack paths like XSS, CSRF, SQL injection, SSRF, and privilege escalation. A strong answer shows that security is built into the design, not added at the end.

I would first contain the impact, preserve evidence, and determine the scope of the incident. Then I would coordinate communication, eradicate the root cause, and verify recovery before returning the system to normal operation. After that, I would focus on lessons learned so the same failure is less likely to happen again.

I would identify assets, trust boundaries, entry points, and likely attacker goals. Then I would rank risks by impact and likelihood, verify existing controls, and recommend concrete mitigations. The key is to turn a vague security review into a prioritized set of actionable findings.

Symmetric encryption uses the same key to encrypt and decrypt data, while asymmetric encryption uses a public-private key pair. I would use symmetric cryptography for efficient bulk data protection and asymmetric cryptography for key exchange, identity, and signatures. The trade-off is speed versus flexibility and trust management.

HMAC is a keyed message authentication method built from a cryptographic hash function. It is useful because it lets you verify integrity and authenticity of a message when both sides share a secret key. In practice, it is a common building block for secure APIs and signed requests.