5 October — Senior Python Backend Engineer — prep map

Checklist format: tick what you can explain and defend under questioning, not what you have used. Bold is the primary note; the rest add depth.

Priority: 🔴 core (in the ad, will be probed) · 🟡 important (in the ad, lighter) · 🟢 breadth (implied by the product)

The ad decoded, your best evidence and the refresh plan are in 5 October, version 1 — Senior Python Backend Engineer, digital healthcare. Spoken versions of the likely questions are in Answers — say these out loud.

🔴 Python at senior depth — “5+ years of commercial experience”

• Concurrency models and the GIL — threads vs processes vs asyncio; free-threading official in 3.14 but opt-in↳The GIL and free-threaded Python·CPU-bound vs I/O-bound·Threads and processes·When to use processes
• asyncio internals — the event loop, coroutine vs task vs future, await as a yield point↳Async Python and coroutines·Event loop internals·asyncio vs threads
• Blocking the loop — a sync driver or bcrypt inside async def, and how it looks in metrics↳Blocking calls in async def·FastAPI and the event loop·run_in_executor / to_thread
• TaskGroup, cancellation, timeouts, backpressure↳TaskGroup and structured concurrency·Cancellation, timeouts, errors·Synchronization primitives
• Memory — refcounting and the cycle collector, __slots__, why RSS does not drop↳Memory model and GC·__slots__·weakref·Memory profiling
• The data model — __eq__ / __hash__, is vs ==, mutability, __new__ vs __init__↳__eq__ and __hash__·Mutable vs immutable·is vs ==·__init__ vs __new__
• Generators, decorators, context managers — be ready to write each one live↳Iterators and generators·Decorators and context managers·Decorator with arguments·contextlib
• Typing — Protocol vs ABC, generics and PEP 695, mypy or pyright in CI↳Protocol and structural typing·TypeVar and generics·mypy and pyright strictness
• What’s new — 3.12 to 3.14, and 3.15 landing this week↳What’s new in Python 3.12-3.14
• Tricky questions sweep — read the folder once; these get asked verbatim↳Tricky questions·Mutable default arguments·Late-binding closures·super() and the MRO

Python 3.15 is not out yet. 3.15.0rc3 shipped on 2 October and the final moved a week, to 9 October 2026, over lazy-import release blockers. Say “3.14 is current, 3.15 lands this week”, then name the headlines: explicit lazy imports (PEP 810), a frozendict built-in (PEP 814), UTF-8 as the default encoding (PEP 686). The corpus has no 3.15 note yet; the source is the python.org announcement.

🔴 Web frameworks — “modern Python web frameworks”

• FastAPI end to end — Starlette plus Pydantic, lifespan, routers, where it fits↳FastAPI overview·Project structure·WSGI vs ASGI
• Dependency injection — the per-request cache, yield dependencies, dependency_overrides↳Dependencies and injection·Dependency injection, the pattern·DI containers
• async def vs def routes — where the code runs, the 40-thread pool, why you still need several workers↳FastAPI and the event loop·run_in_threadpool·Async and performance
• Validation, errors, OpenAPI — Pydantic v2, one error shape, the generated contract↳Exception handling·Pydantic models·Pydantic in practice·OpenAPI and docs
• Background work — BackgroundTasks vs Celery, and why the first has no durability↳BackgroundTasks vs Celery·Async I/O and background work
• Auth, middleware, deployment — security dependencies, workers, health checks↳Security and authentication·Middleware·Deployment
• Django and DRF — if their core is Django: ORM, N+1, serializers, migrations, the async story↳Django vs DRF·select_related vs prefetch_related·DRF performance and N+1·Django migrations·Async Django

Ask which framework early — the ad does not name one, so it is a fair question while they describe the project. Answer in FastAPI by default and give the Django equivalent in one clause: selectinload is prefetch_related, joinedload is select_related, an Alembic revision is a Django migration, a Pydantic model is a DRF serializer.

🔴 REST APIs — “build and maintain REST APIs”

• Resources and URLs — nouns, sub-resources, actions as state changes, why GET must be safe↳REST principles·Richardson maturity and HATEOAS·Stateful and stateless
• Status codes and methods — 400 vs 422, 401 vs 403, 404 for another tenant, PUT vs PATCH↳Status codes·PUT vs PATCH·HTTP semantics and caching
• Idempotency — which methods are, and making POST retryable with a key↳Idempotency keys·Idempotency·Idempotent payments
• Pagination, versioning, deprecation — cursor over offset, additive change over new versions↳Versioning and pagination·Contract-first API design
• Errors and HTTP caching — Problem Details, ETag and If-Match against lost updates↳Error handling and caching·Exception handling in FastAPI
• Authentication and authorisation — OAuth2 and OIDC, JWT trade-offs, RBAC plus ABAC↳OAuth 2.0 and OpenID Connect·JWT vs session·JWT pitfalls·RBAC and ABAC
• Rate limiting — the algorithms, and 429 with Retry-After↳Rate limiting algorithms·Design a rate limiter

Problem Details is RFC 9457 now. It obsoleted RFC 7807 in 2023. The error-handling note still cites 7807; naming the current number is a small senior tell.

🔴 Databases — “databases, migrations, and query optimization”

• The optimisation method — pg_stat_statements to find, EXPLAIN (ANALYZE, BUFFERS) to understand, one fix, measure↳Reading a query plan·How SQL is processed
• Indexes — B-tree mechanics, composite column order, partial and covering, the write cost↳How a B-tree index works·Why your index is not used·Index types
• N+1 — detecting it, and the fix in SQLAlchemy and Django↳N+1 query problem·Loading strategies·select_related vs prefetch_related
• Transactions, isolation, locking — Read Committed, lost updates, write skew, optimistic vs FOR UPDATE↳Transactions and isolation levels·Isolation anomalies across databases·Advisory locks
• Migrations without downtime — expand/contract, NOT VALID then VALIDATE, CREATE INDEX CONCURRENTLY, batched backfills, lock_timeout↳Zero-downtime migrations·Alembic·Django migrations
• Connection pooling — sizing, PgBouncer transaction mode, diagnosing exhaustion↳Connection pooling·SQLAlchemy pooling
• SQLAlchemy 2.0 — session lifecycle, the Unit of Work, async sessions, the classic pitfalls↳Session lifecycle·Unit of Work and identity map·Async SQLAlchemy·Common pitfalls
• Past one box — read replicas, partitioning, sharding, vacuum↳Sharding and partitioning·Replication and consistency·Partition lifecycle·VACUUM and autovacuum
• SQL fluency — joins, GROUP BY / HAVING, window functions, CTEs; a live SQL task is plausible↳Window functions and CTEs·SQL fundamentals·SQL vs NoSQL

Have one database war story with numbers. “[The endpoint] took [X] s. The plan showed [a sequential scan / an estimate off by a thousand times / an N+1]. I [added a composite index / rewrote the predicate / used selectinload] and it went to [Y] ms.” Every database answer lands better attached to it.

🔴 Integrations — “integrate internal and third-party services”

• Integration design — an adapter per provider behind a Protocol, the internal model at the boundary, error mapping↳Designing an external API integration·Schema and the internal model·Clean-architecture walkthrough
• The client — one httpx client per process, auth to the provider, retries only where safe↳Writing a client for an external API·External API auth·Follow-up questions
• Resilience — timeouts first, backoff with jitter, retry budgets, circuit breakers, bulkheads, fallbacks↳Timeouts, retries and backoff·Circuit breakers and bulkheads·Fallbacks and degradation
• Webhooks — HMAC over raw bytes, acknowledge fast, dedupe on event id, reconcile↳Webhooks·Webhook ingestion service
• Between internal services — sync or async, REST or gRPC, and the synchronous-chain anti-pattern↳Inter-service communication·API protocols compared·gRPC·Internal SDKs
• Reliable events — the dual-write problem, the transactional outbox, idempotent consumers↳The transactional outbox·Consumer idempotency·Event-driven architecture
• Queues and workers — Celery retries, acks_late, dead-letter queues; RabbitMQ vs Kafka↳Celery interview questions·Celery retries·Dead-letter queue·Kafka vs RabbitMQ
• Multi-step work across services — sagas, compensation, durable state↳Resilient orchestration·Event-driven saga·Data consistency patterns

Third parties in healthcare have their own shape. Expect EHRs, labs, pharmacies, insurers and identity providers. New ones speak FHIR R4 over REST, hospitals still speak HL7 v2 over MLLP, and both resend on timeout — so idempotency keyed on the message id is not optional. See Healthcare data standards. Your own integrations are the bridge: Salesforce and the OAuth2 services on the Automation Platform, and the auth, CRM and messaging clients on the Invest Planning Platform.

🔴 Testing — “write unit and integration tests”

• Strategy — pyramid vs trophy, behaviour over implementation, risk-driven, diff coverage↳Test strategy and the pyramid·Test data, flaky tests, CI
• Integration tests on real dependencies — testcontainers, a transaction rolled back per test↳Integration and contract testing·Integration tests·SQLAlchemy testing patterns
• Testing the API — TestClient vs httpx.AsyncClient, dependency_overrides, the real database↳Testing a FastAPI app·pytest-asyncio·Testing DRF
• Third parties in tests — stub at the transport, recorded fixtures, contract checks for drift↳Mocking external APIs·Test doubles taxonomy·Mock vs MagicMock vs patch
• pytest fluency — fixture scopes, yield fixtures, conftest.py, parametrize, property tests↳Fixtures deep dive·pytest concepts·Parametrize patterns·Hypothesis

🔴 Architecture and scale — “scalable Python backend services”

• Structuring a service — thin routes, services, repositories; the dependency rule↳Clean Architecture·Layered architecture·Hexagonal·Repository and Unit of Work
• Monolith vs microservices — modular monolith first, the microservices tax, strangler fig↳Monolith vs microservices·Microservices interview·Domain-driven design
• Scaling a stateless service — twelve-factor, horizontal scale, the database as the ceiling↳The twelve-factor app·Async and performance·Load balancing and CDN·Capacity estimation
• Caching — cache-aside, TTL with jitter, stampedes, invalidation↳What is Redis·Cache stampede·Redis patterns in Python
• CQRS and event sourcing — when they pay off, and why an audit requirement is the honest reason↳CQRS and event sourcing·Event-driven microservices
• Multi-tenancy — if the platform serves many clinics or countries from one deployment↳Multi-tenant isolation
• The vocabulary — SOLID, dependency inversion, composition over inheritance↳SOLID principles·Dependency inversion·Composition over inheritance

🟡 Decisions and review — “architectural decisions and code reviews”

• Making and recording a decision — options, trade-offs, reversibility, ADRs↳Architecture decision records·Leading technical direction·Disagreement with the team
• Code review — what you look for, labelling blocking vs nit, PR size↳Pre-commit hooks and code review·Leading a team(§ Code review is where most of your leverage is)
• Tech debt — making the business case for paying it down↳Tech debt and complexity·Advocating for tech debt·Refactoring
• Tooling that holds the bar — Ruff, mypy, pre-commit, CI as the actual gate↳Linters·Type-checking strategy·CI/CD basics

🟡 Production — “support production services”

• Observability — logs, metrics, traces; RED; a trace id across async code and queues↳The three pillars·Observability in practice·Trace context in async Python·OpenTelemetry
• Logging and error tracking — structlog, Sentry, and keeping patient data out of both↳Structured logging·Sentry·PHI and secure coding(§ Technical controls that actually get checked)
• SLOs and alerting — alert on symptoms, error budgets, burn rate↳SLO, SLI, SLA and error budgets·Prometheus·Grafana
• Incidents — mitigate first, roles, runbooks, blameless postmortems↳Incident response and postmortems·Production debugging
• Shipping safely — rolling, blue-green, canary, feature flags, migrations in the deploy order↳Deployment strategies·Progressive delivery·Probes and HPA

🟡 Healthcare — “a digital healthcare project”, “millions of patients”

• What changes with patient data — HIPAA, GDPR special category, BAAs, the EU AI Act↳PHI, privacy and secure coding·Healthcare and regulated, overview·SOC 2 and ISO 27001
• The controls that get checked — encryption, per-request authorisation, an append-only audit log, minimisation, no PHI in logs or URLs↳PHI, privacy and secure coding(§ Technical controls that actually get checked)RBAC and ABAC(§ The audit requirement)OWASP Top 10
• Data standards — FHIR R4 resources and profiles, HL7 v2, LOINC / SNOMED / ICD-10, OMOP↳Healthcare data standards
• International data — residency, cross-border transfer, de-identification for analytics↳PII, privacy and the EU AI Act(§ Data residency)PHI, privacy and secure coding(§ De-identification)
• Regulated change — GxP, Part 11, why “no destructive updates” shapes the schema; only if they are in life sciences↳GxP and validation·CQRS and event sourcing

The three things that catch engineers out, from the healthcare overview: a BAA constrains tool choice before you write any code; audit logging is a functional requirement with years of retention, not observability; and regulated records are never destructively updated.

🟢 AI in the product — “a platform using AI”

• A model is an unreliable third-party dependency — timeouts, retries, fallbacks, pinned versions, cost↳Provider abstraction and resilience·LLM file-processing pipeline·Inference basics
• Patient data and models — a BAA with no retention, de-identification, or inference inside your own boundary↳PHI, privacy and secure coding(§ LLMs on clinical data)PII, privacy and the EU AI Act·Governance and responsible AI
• Knowing it works — evaluation sets, monitoring, drift↳Building eval sets·Monitoring and drift·LLM observability
• Clinical documents — if they mention summarisation, extraction or search↳Clinical document intelligence·What is RAG

🟢 Delivery — Docker, CI/CD, Kubernetes, cloud

• A Python service in a container — multi-stage, slim base, non-root, layer caching↳Docker·Multi-stage builds·Image layers·Compose
• CI/CD as the quality gate — pipeline stages, secrets, supply chain↳Pipeline design patterns·GitHub Actions·Secrets and supply chain
• Kubernetes basics — probes, HPA, scaling workers on queue depth↳Kubernetes interview·Probes and HPA·Kubernetes basics
• AWS — the resume lists the Solutions Architect Associate certification, so expect AWS questions; your last project ran on Lambda, Step Functions, DynamoDB, API Gateway, ECS and Cognito↳AWS interview essentials·Secrets and configuration

🟢 Live coding — in case

• Python-flavoured tasks — a retry decorator, an LRU cache, a rate limiter, grouping and dedup with dicts↳Algorithms and data structures·Counting and dedup·bisect, heapq, deque·functools
• The patterns that cover most screens — two pointers, sliding window, intervals, binary search↳Two pointers·Sliding window·Merge and sweep intervals·Binary search variants
• Complexity of the built-ins — what in costs on a list, a set and a dict↳Collection complexity

The design question to rehearse

“Design a service that receives patient data from partner clinics, runs it through an AI model, and shows clinicians the results through a REST API.” It touches every line of the ad. Walk it in this order, out loud:

1. Clarify — volume and peaks, how fresh results must be, which partners and formats, which countries the data may live in — Interview framework, Capacity estimation.
2. Ingest — a webhook or FHIR endpoint that verifies the signature, stores the raw payload append-only, dedupes on the partner’s message id with a unique constraint, and answers in milliseconds — Webhooks, Healthcare data standards.
3. Normalise at the boundary — an adapter per partner maps into one internal model, so partner shapes never leak inward — Integration design, Schema and the internal model.
4. Hand off reliably — an outbox row in the same transaction; workers call the model with timeouts, retries on transient errors, idempotency on the record id, and a dead-letter queue — The transactional outbox, Timeouts, retries and backoff.
5. Serve — results in Postgres with the indexes the read API needs, cursor pagination, authorisation per record, and every read of patient data in the audit log — Indexes, Versioning and pagination, RBAC and ABAC.
6. Operate — one trace id from webhook to worker to API, SLOs on freshness and errors, an alert on the oldest unprocessed record, logs with no PHI — Trace context in async Python, SLOs.
7. Test — adapter tests on recorded partner payloads, integration tests on real Postgres, a scheduled contract check against each partner’s sandbox — Integration and contract testing.

Then name the failure modes before they ask: a partner resending after a timeout, a model call with no timeout holding a worker forever, PHI in a log line or a Sentry traceback, an index built without CONCURRENTLY locking the results table mid-deploy, a cache key without the tenant serving one clinic’s data to another, and an outbox relay that died quietly.

Behavioural — the responsibilities, as stories

Every responsibility line comes back as a question. One story per row, with a number in it where you can; the spoken skeletons are in The call — everything except the technical answers.

• A story for every [fill in] row — your resume has no evidence for them, and the ad names every one↳Mentoring and feedback·Leading technical direction·A mistake you made
• The six signals — the frame every answer is scored against↳The six signals·Handling not knowing
• Your questions, and the red flags in your own answers↳Closing questions and red flags