Sign in Sign up

Interview questions · DevOps Engineer

DevOps Engineer interview questions

Recruiters hiring DevOps engineers look for candidates who can bridge development and operations by building reliable CI/CD pipelines, managing infrastructure as code, and embedding a culture of observability and shared ownership. They want evidence of hands-on experience with cloud platforms, containerisation, and incident response under pressure. Equally important is the ability to collaborate across engineering teams, reduce toil through automation, and make trade-offs between speed and stability.

Walk me through a CI/CD pipeline you designed from scratch. What were the key decisions you made?

This reveals architectural thinking, tooling choices, and whether the candidate understands the full software delivery lifecycle.

Model answerI built a pipeline for a microservices platform with 15 services on GitHub Actions. Key decisions included running unit tests in parallel to cut feedback time from 18 minutes to 6, using Docker layer caching to halve build times, and enforcing semantic versioning with automatic tagging on merge to main. I added a mandatory security scan (Trivy for container images, Snyk for dependencies) before any push to staging. Deployment frequency went from twice a week to multiple times per day with zero increase in rollback rate.

Describe how you have implemented infrastructure as code. What problems did it solve?

IaC is foundational to modern DevOps; this tests whether the candidate can reason about reproducibility and drift prevention.

Model answerI migrated 40 manually provisioned AWS resources to Terraform modules organised by environment. The immediate win was eliminating configuration drift — we had three incidents in the prior quarter caused by someone SSH-ing into a prod server to quick-fix a setting. Post-migration, our disaster-recovery drill went from four hours of manual rebuilding to 22 minutes of automated reprovisioning. I also set up Terraform Cloud for remote state and plan approval, so no infrastructure change could reach production without a peer review.

Tell me about the most complex incident you handled. Walk me through your approach.

Incident response under pressure tests technical depth, communication skills, and post-mortem culture.

Model answerOur payment service had a cascading failure at 2 a.m. that took down checkout for 40 minutes during a flash sale. I joined the bridge call, identified from Datadog traces that a Redis connection pool exhaustion was causing timeouts that queued up and overwhelmed the downstream database. I increased the connection pool limit as a hotfix, which restored service in eight minutes. The post-mortem identified that a recent code change had not updated the pool size to match the new replica count — we added a config validation step to the pipeline and the same failure mode has not recurred in 14 months.

How do you approach Kubernetes resource management to balance performance and cost?

Kubernetes is ubiquitous; recruiters want to see practical cost-performance trade-off reasoning, not just YAML familiarity.

Model answerI conduct quarterly right-sizing audits using Goldilocks to compare actual resource usage against requests and limits. On our last audit I identified 12 deployments with memory requests 3x their actual P95 usage — reducing those freed roughly 40 nodes in our cluster and cut our EKS bill by 18k per month. I also implemented Karpenter for node autoscaling with spot-instance prioritisation for non-critical workloads, achieving a further 30% compute saving with no SLA breach.

How do you build and enforce a secrets management strategy across multiple services?

Leaked credentials are a leading cause of breaches; this tests whether the candidate has a systematic approach beyond using environment variables.

Model answerI standardised on HashiCorp Vault with dynamic secrets for database credentials — each service gets a short-lived credential that expires after the deployment window, so there are no long-lived passwords to rotate manually. For AWS-native services I use IAM roles with least-privilege policies and IRSA in Kubernetes. I also ran a secret-scanning pipeline (Gitleaks pre-commit hook plus TruffleHog in CI) that caught three accidentally committed API keys before they ever reached the repository history.

Describe how you have implemented observability across a distributed system.

Observability (logs, metrics, traces) is what separates teams that detect failures early from those that learn about them from customers.

Model answerI introduced the three-pillar approach across 20 microservices: structured JSON logging shipped to OpenSearch, Prometheus metrics scraped into Grafana dashboards with SLO-based alerting, and distributed tracing via OpenTelemetry to Jaeger. I defined four golden signals per service (error rate, latency P99, saturation, traffic) and set alert thresholds derived from six months of baseline data. Mean time to detect fell from 22 minutes to 4 minutes in the quarter following rollout.

How do you handle database schema migrations in a zero-downtime deployment?

Schema migrations are a common cause of deployment risk; this tests practical knowledge of backward-compatible migration patterns.

Model answerI enforce a three-phase migration pattern: expand, contract, and clean up. In the expand phase I add the new column as nullable so old code still writes successfully. After deploying the new code that writes to the new column, I run a background backfill job and then make the column non-nullable in the contract phase. Only in the next release do I drop the old column. This approach has allowed us to release schema changes to a 50-million-row table with zero downtime and zero rollback.

Tell me about a time you reduced toil significantly for your engineering team through automation.

Reducing operational toil is a core DevOps principle; this tests initiative, scripting skills, and impact measurement.

Model answerEngineers were spending roughly 3 hours per week manually promoting Docker image tags across dev, staging, and production by editing YAML files and opening PRs. I wrote a small CLI tool in Go that reads the approved image tag from the CI artifact store and opens a GitOps PR automatically, triggering ArgoCD to sync. After rollout, promotion time dropped to under 90 seconds per service, saving the team approximately 150 person-hours per quarter and eliminating the copy-paste errors that caused two previous rollbacks.

Tips for this role

Practise for THIS role

Paste your job offer, pick a recruiter, and run a mock interview with a detailed coaching report.

🎤 Start an interview

Everything you can do

Simulated interview

Practice out loud with an AI recruiter, in real conditions.

7 AI recruiters

From the friendly HR to the tough manager: pick your challenge.

ATS-ready CV

Generate a clean PDF CV that gets past automated filters.

Video interview

Facing a realistic video avatar: also work on your posture and presence.

Coaching report

A score out of 100, your strengths, areas to improve and quotes from your answers.

Personality analysis

Assess your Big Five traits with the IPIP-NEO test and get a summary to share with HR.

CV / job match

Measure how well your CV matches a job before applying.

Cover letter

A tailored cover letter, matched to the job and your CV, ready to send as PDF.

Prep brief

Likely questions, angles to prepare and recent info about the company.

Tailored CV for the offer

Your CV reworked for each offer: skills and experience prioritized to match what the role asks for.

Model answers (STAR)

Your interview questions rewritten as exemplary STAR answers.

Thank-you email

The perfect follow-up message, based on your interview strengths.

Retake & improve

Replay the interview as much as you like: each report tracks your progress.