5 October, version 2 — Python Backend Engineer — prep map

Checklist format: tick what you can explain and defend under questioning, not what you have used. Bold is the primary note; the rest add depth.

Priority: 🔴 required (in the ad’s requirements, will be probed) · 🟡 preferred (likely a question each) · 🟢 preferred, lighter (a sentence is enough)

The ad decoded, your evidence and the gaps are in 5 October, version 2 — Python Backend Engineer, regulated healthcare. Version 1’s prep map covers the shared ground in more depth — databases, integrations, architecture and healthcare.

🔴 Python — “modern type hints, async patterns, and idiomatic project layout”

Type hints

• The everyday vocabulary — X | None, Callable, built-in generics, Literal, Final↳Optional, Union, Callable·TypedDict, Literal, Final·Annotated and TypeGuard
• Generics and PEP 695 — def first[T](...), class Box[T], type aliases, variance↳TypeVar and generics·ParamSpec and Concatenate
• Protocol vs ABC — structural seams for repositories, clients and fakes↳Protocol and structural typing·Protocols and interfaces
• Types as design — illegal states unrepresentable, assert_never, parse don’t validate↳Type-driven development·dataclass vs attrs vs Pydantic·Pydantic in practice
• Checking in CI — mypy vs pyright, strict mode, adopting it package by package↳mypy and pyright strictness·Type-checking strategy

Async patterns

• Structured concurrency — TaskGroup vs gather, ExceptionGroup and except*↳TaskGroup and structured concurrency·anyio and trio
• Timeouts and cancellation — asyncio.timeout(), re-raising CancelledError, shield↳Cancellation, timeouts, errors
• Bounded concurrency and backpressure — a semaphore in the right place, bounded queues↳Synchronization primitives·asyncio.Queue vs threading.Queue·Async optimisation
• Never block the loop — sync libraries to a thread, CPU work to a process↳Blocking calls in async def·run_in_executor / to_thread·FastAPI and the event loop

Project layout

• pyproject.toml and the src layout — PEP 621 metadata, tool config in one file, why src/↳pyproject.toml and building·Imports and the module system
• uv, environments, lockfiles — declare, resolve, lock, sync↳pip, Poetry, uv·Virtualenvs and lockfiles·Dependency resolution and supply chain
• Inside the package — organise by feature, thin routes, typed settings↳FastAPI project structure·Clean Architecture·The twelve-factor app
• The quality gates — Ruff, mypy, pre-commit, CI as the actual gate↳Linters·Formatters·Pre-commit and code review

🔴 Web frameworks — “FastAPI, Django, or Flask”

• FastAPI — DI and dependency_overrides, async def vs def, Pydantic v2↳FastAPI overview·Dependencies and injection·Testing a FastAPI app
• Django and DRF — the ORM, N+1, serializers, the async story↳Django vs DRF·select_related vs prefetch_related·Async Django
• Flask — what it gives you, what you add yourself, when it is the right size↳Flask·WSGI vs ASGI

🔴 APIs — “designing, building, and evolving REST APIs (OpenAPI / Swagger)”

• Evolving without breaking — additive change, tolerant readers, what counts as breaking↳Versioning and pagination(§ When to bump the version, § Deprecation flow)Contract-first API design
• OpenAPI as the contract — code-first vs contract-first, a spec diff in CI↳Contract-first API design·OpenAPI in FastAPI·OpenAPI in DRF
• Pagination — cursor vs offset, the response shape, page-size limits↳Versioning and pagination(§ Pagination — three styles)
• Error conventions — Problem Details (RFC 9457), one shape everywhere↳Error handling and caching·Exception handling in FastAPI·Status codes
• The basics, fluently — resources, methods, idempotency, PUT vs PATCH↳REST principles·Idempotency keys·PUT vs PATCH

🔴 Databases — “PostgreSQL or MySQL, migrations, tuning queries”

• Tuning — pg_stat_statements, EXPLAIN (ANALYZE, BUFFERS), indexes, N+1↳Reading a query plan·How a B-tree index works·Why your index is not used·N+1
• Migrations — expand/contract, CONCURRENTLY, NOT VALID, lock_timeout, Alembic and Django↳Zero-downtime migrations·Alembic·Django migrations
• PostgreSQL vs MySQL — clustered index, transactional DDL, default isolation, utf8mb4↳MySQL·Isolation anomalies across databases
• SQL fluency — joins, GROUP BY / HAVING, window functions, CTEs; a live task is plausible↳Window functions and CTEs·SQL fundamentals·Transactions and isolation

🔴 Testing — “pytest, including unit, integration, and contract tests”

• Contract tests — consumer-driven contracts vs schema checks vs end-to-end↳Integration and contract testing·Contract-first API design(§ Consumer-driven contracts, the other direction)API testing and schemathesis
• Integration tests — testcontainers, rollback per test, the database never mocked↳Integration tests·SQLAlchemy testing patterns·Testing a FastAPI app
• pytest fluency — fixture scopes, yield fixtures, conftest.py, parametrize, async tests↳Fixtures deep dive·Parametrize patterns·pytest-asyncio·Hypothesis
• Doubles and third parties — stub at the transport, fakes for stateful seams↳Mocking external APIs·Test doubles taxonomy
• Strategy and a healthy suite — pyramid vs trophy, flaky tests, diff coverage↳Test strategy and the pyramid·Test data, flaky tests, CI

🔴 Tooling — “Git, code review, and trunk-based or short-lived-branch workflows”

• Trunk-based development — short-lived branches, feature flags, branch protection, why not GitFlow↳Branch strategies·Progressive delivery
• The PR workflow — small PRs, descriptions, squash vs merge vs rebase, --force-with-lease↳Pull request workflow·Merge vs rebase·Interactive rebase
• Code review — what you look for, labelling blocking vs nit↳Pre-commit and code review·Version 1’s spoken answer
• Getting out of trouble — conflicts, reflog, bisect, reset vs revert↳Conflict resolution·Reflog recovery·Bisect·Reset, revert, checkout

🟡 Regulated environments — “HIPAA, GDPR, ISO 27001, SOC 2, or medical-device software”

• Controls and evidence — SOC 2 Type I vs II, ISO 27001, controls that emit their own evidence↳SOC 2, ISO 27001 and GRC·OWASP Top 10
• HIPAA and GDPR — PHI, BAAs, audit logging, minimisation, no PHI in logs↳PHI, privacy and secure coding·Version 1’s spoken answer
• Validated systems — GxP, Part 11, validation alongside CI/CD↳GxP and validation

Medical-device software — no note in the corpus, so this is all of it. The standard is IEC 62304, the software lifecycle for medical devices. Each software system gets a safety class by the worst harm a failure could cause — A (no injury possible), B (non-serious injury), C (death or serious injury) — and the class sets how much process applies: documented requirements and architecture, verification, and traceability from each requirement to its tests. Every third-party component is SOUP (software of unknown provenance), listed with its version and assessed against its known anomalies — in Python terms, the lockfile is your SOUP inventory. Risk management runs under ISO 14971. Agile is compatible; the documentation is part of the work, not an afterthought.

🟡 Event-driven — “Kafka, RabbitMQ, SQS, Pub/Sub”

• Queue vs log — which broker for what, and running two side by side↳Kafka vs RabbitMQ·Event-driven architecture
• Kafka — partitions, consumer groups, offsets, delivery semantics↳What is Kafka·Delivery semantics
• RabbitMQ — exchanges, routing, dead-letter exchanges↳What is RabbitMQ·Exchanges, queues and DLX
• SQS, SNS, EventBridge, Step Functions — visibility timeout, FIFO, fan-out, orchestration↳SQS visibility timeout and consumers·SNS·EventBridge·Step Functions
• Pub/Sub — the GCP mapping↳GCP for an AWS-shaped brain
• Correctness on any broker — at-least-once, idempotent consumers, the outbox↳The transactional outbox·Consumer idempotency

🟡 Containers — “Docker, Kubernetes”

• A Python image — multi-stage, slim, non-root, layer order↳Docker·Multi-stage builds·Image layers
• Kubernetes — Deployments and Services, probes, requests and limits, HPA, Gateway API↳Kubernetes interview·Pods, services, deployments·Probes and HPA·Gateway API

🟡 Observability — “OpenTelemetry, Datadog, Grafana, Sentry”

• OpenTelemetry — SDK, auto-instrumentation, OTLP, the collector↳OpenTelemetry·Trace context in async Python
• Sampling and cardinality — head vs tail, and why metrics are never sampled↳Sampling strategies·The three pillars
• The named tools — Datadog, Grafana with Prometheus, Sentry↳Datadog·Grafana·Prometheus·Sentry·Choosing
• Logs that help — structured, a trace id on every line, no PHI↳Structured logging·SLOs and error budgets

🟡 AI-assisted development — “to accelerate delivery”

• How you use it, and where you don’t — with a failure story↳How do you work with AI tools?·What AI tools do you use?·How do you apply AI in your work?
• Keeping it safe — tests first, small diffs, CI as the gate↳TDD with coding agents·AI-assisted development and AI-DLC·Spec-driven development

🟡 Performance — “high-throughput or low-latency systems”

• Measure first — p99 rather than the average, profiling with cProfile and py-spy↳Profiling basics·Production debugging·Memory profiling
• Where the time goes in a service — the database, blocking calls, serialisation, pools↳Async and performance·Connection pooling·Why Python is slow
• Proving it — load tests, soak tests, latency numbers↳Load and performance testing·Latency numbers·Cache stampede

🟡 Shipping — “deploying to AWS, GCP, or Azure through a CI/CD pipeline”

• The pipeline — stages, caching, one image promoted across environments↳Pipeline design patterns·CI/CD basics·GitHub Actions
• Deploying safely — rolling, blue-green, canary, flags, rollback↳Deployment strategies·Progressive delivery
• Secrets and supply chain — OIDC to the cloud, pinned actions, scanned images↳Secrets and supply chain·Secrets and configuration
• The clouds — AWS in depth (the resume’s certification invites it), GCP and Azure by mapping↳AWS interview essentials·GCP for an AWS-shaped brain

🟢 Infrastructure as code — “Terraform, Pulumi, CloudFormation”

• Terraform vs CloudFormation — state, ecosystem, rollback, licensing↳CloudFormation vs Terraform·OpenTofu and licensing
• Terraform in practice — remote state and locking, plan in CI, drift, import↳Terraform state·Plan, apply, drift, import·Modules

Pulumi — no note in the corpus, so this is all of it. The same declare-preview-apply model as Terraform, written in a general-purpose language — Python, TypeScript, Go — instead of HCL, so loops, functions and unit tests come for free. pulumi preview is the plan, pulumi up the apply, a stack is an environment, and state lives in Pulumi Cloud or a backend you run (S3, Azure Blob, GCS). Many providers are bridged from Terraform’s, so coverage is similar. The trade: real code is more powerful, and easier to make too clever.

🟢 Healthcare — “healthcare background, FHIR, HL7”

• FHIR R4 and HL7 v2, honestly — resources, profiles, MLLP, idempotency on message ids↳Healthcare data standards·Version 1’s spoken answer
• The data-sensitive bridge — your regulated-finance work, framed for health data↳Healthcare and regulated, overview·Version 1’s evidence

The walk-through to rehearse

“Walk me through how a change gets from your laptop to production.” It covers the ad’s whole tooling line in one answer, and every step is a place they can push. Say it out loud in this order:

1. Branch — off main, short-lived, tests written first — Branch strategies, TDD with coding agents.
2. Local gates — Ruff, mypy and fast tests through pre-commit — Pre-commit and code review.
3. Pull request — small, described, reviewed; CI runs unit tests, integration tests on real Postgres, contract tests and an OpenAPI diff — Pull request workflow, Integration and contract testing.
4. Build once — squash-merge to main; one image, tagged with the commit, pushed to the registry — Pipeline design patterns, Multi-stage builds.
5. Schema first — migrations backward-compatible, expanded before the code that needs them ships — Zero-downtime migrations.
6. Deploy — staging, smoke tests, then production rolling or canary, with risky behaviour behind a flag; infrastructure changes go through a reviewed plan, never from a laptop — Deployment strategies, Plan, apply, drift.
7. Watch, and roll back — traces, error rate and latency against the SLO; rollback is redeploying the previous image — OpenTelemetry, SLOs and error budgets.

Then name the failure modes before they ask: a long-lived branch drifting from main, a migration the old code cannot survive, a flaky test retried until green, an image rebuilt per environment so staging tested something else, an infrastructure change applied from a laptop, and patient data slipping into a new log line.

Behavioural — what this ad asks about you

• A story for every [fill in] row — code review, performance and a broken deploy↳A mistake you made·Disagreement with the team·The six signals