did the Optum final round in March 2026 for a senior software engineer role in their security/platform space. here's the actual structure because the JD gives you nothing.
mine was fully remote (Teams). they scheduled four 60-minute blocks with a 30-minute break in the middle. rough breakdown:
block 1: system design (60 min, two interviewers) told to design a secure API gateway for healthcare data exchange. i knew HIPAA would come up so I led with authentication (OAuth2/PKCE for external consumers, mTLS for internal services), then rate limiting, then audit logging. they pushed on how i'd detect anomalous access patterns, which is basically asking whether i know about SIEM integration. i do, so that went well. if you're coming from a non-security background, at least brush up on basic auth patterns and know what a WAF is.
block 2: coding (60 min, one interviewer) started by reviewing my HackerRank submission from the OA. asked me to explain a choice I made. then a new problem: something around parsing nested JSON with possible nulls and returning a flat list. medium difficulty. this interviewer asked me to narrate as I coded, which i actually prefer.
block 3: behavioral (60 min, eng manager) same STAR questions you'd expect. two that stood out: "tell me about a time you had to make a decision with incomplete information and it turned out you were wrong" "describe a situation where a team member was resistant to a security control you were implementing"
that second one is very specific to security roles. if your role isn't security-focused the behavioral topics will probably shift.
block 4: cross-functional panel (60 min, stakeholder from product + compliance) this was more like a conversation. they wanted to understand how I communicate technical risk to non-technical people. pretty low-pressure after the first three.
total from application to verbal offer: 38 days. debrief took about a week after the final round, which felt long but was within what the recruiter told me to expect.
overall the process was well-organized, which I was honestly not expecting.