Groww Product Security Intern Interview Experience | Offer Received
Summary
I interviewed for a Product Security Intern role at Groww. The process included a technical interview focusing on security vulnerabilities, code review, API hardening, and architectural security, followed by a final round with an Engineering Manager centered on decision-making and judgment. I received an offer but ultimately declined it.
Full Experience
I came across the opening on LinkedIn through a post by the hiring manager. I emailed them directly, filled out the required form, and reached out to a few people via cold DMs to put in a word for me.
Round 1: Technical Interview (1+ hour)
The first round lasted a little over an hour.
We started with a discussion about my past internships and the most meaningful work I had done there. The interviewer went deep into my contributions and asked follow up questions to test ownership and clarity.
Then the technical portion began:
- I was asked to explain a few vulnerabilities in detail including root cause, impact, remediation, and the reasoning behind each fix.
- The interviewer opened VS Code and showed me sample code snippets. I had to review the code, identify the vulnerability, explain why it was an issue, and suggest a secure fix.
- A scenario was framed around an API request. He wrote a deliberately weak request and asked me to step through it and progressively harden it. I had to explain each change and why it improved security.
- We discussed some product security work I had done including automation projects and internship contributions in that domain.
- There were 2 to 3 architecture based scenarios around rate limiting, authentication, and minimizing attack surface. These were open ended and required structured thinking.
I was not perfect. In two of the scenario discussions I could only partially answer some follow up questions. However I made sure my reasoning was clear and structured.
Shortly after, I received a call for the final round.
Final Round: Engineering Manager (30 to 45 mins)
This round focused more on decision making and judgment.
Topics included:
- Handling conflict or disagreement in a team
- How I prioritize vulnerabilities
- What I would do if a release had a medium severity issue
- Trade offs between business impact and security risk
We also revisited some of the earlier scenario based discussions, but this time in a more open ended way. Since I had prepared better, I was able to answer more confidently and with stronger structure.
I cleared the process and received an offer.
Offer Details
- Summer Internship
- ₹45,000 per month stipend
- 2 to 3 weeks accommodation + flights covered
- PPO ranging from 20 to 25 LPA depending on performance
I eventually declined the offer as I had other opportunities that aligned better with my plans.
Hope this breakdown helps anyone preparing for similar interviews.
Interview Questions (8)
Explain Security Vulnerabilities
Explain a few security vulnerabilities in detail, covering their root cause, impact, remediation steps, and the reasoning behind each fix.
Code Review for Security Vulnerabilities
Review provided code snippets, identify security vulnerabilities within them, explain why each identified issue is a vulnerability, and propose a secure fix.
Harden a Weak API Request
Given a deliberately weak API request, progressively harden it by stepping through changes and explaining why each modification improves security.
Architectural Security Scenarios (Rate Limiting, Authentication, Attack Surface)
Discuss architectural scenarios focusing on concepts like rate limiting, authentication mechanisms, and strategies for minimizing the attack surface. These were open-ended and required structured thinking.
Handling Team Conflict
Describe how I would handle conflict or disagreement within a team.
Vulnerability Prioritization
Explain my approach to prioritizing security vulnerabilities.
Handling Medium Severity Release Issue
Describe what I would do if a software release had a medium severity security issue.
Business Impact vs. Security Risk Trade-offs
Discuss the trade-offs between business impact and security risk.