Interview experience
Visa Interview Questions and Answers (2026)
Overview
Section titled “Overview”Visa’s new-grad process for its Bangalore engineering hub runs a CodeSignal OA into two increasingly backend/design-heavy technical interviews, closing with a noticeably relaxed lead/manager round.
Visa interview process at a glance
Section titled “Visa interview process at a glance”| Round | Duration | What it tests |
|---|---|---|
| Online Assessment (CodeSignal) | ~70 min | 4 coding problems (easy array logic to a harder DP/greedy question) |
| Technical Interview 1 | ~30 min | Project deep-dive, OOP, OS fundamentals |
| Technical Interview 2 | ~70 min | Backend/design (Spring Boot, caching, LRU cache), SQL schema design |
| Lead/Manager Round | ~30 min | Behavioral fit, AI-tool views, light technical concepts |
Online Assessment
Section titled “Online Assessment”Run on CodeSignal, roughly 70 minutes for 4 coding problems with real difficulty spread - reported examples include finding substrings containing all vowels, identifying peak-removal sequences, locating grid cells with uniform rows/columns, and a dynamic-programming problem.
Common questions
- Array/string problems with a vowel or pattern-matching twist
- HashMap/HashSet-based logic problems
- A grid or matrix-traversal problem
- One dynamic-programming or greedy problem to close out the set
Technical Interview 1
Section titled “Technical Interview 1”A shorter round (~30 minutes) that opens with your resume projects - candidates report deep questions on things like LLM integrations and React hooks - before moving into CS fundamentals.
Common questions
- Deep dive into a specific project: what you built, why, and trade-offs made
- Explain pointers and the four pillars of OOP
- OS fundamentals - multiprocessing vs multithreading, deadlock conditions, memory management
- Follow-up questions probing genuine understanding versus memorized definitions
Technical Interview 2
Section titled “Technical Interview 2”The longer, more intensive round (~70 minutes), weighted toward backend engineering and design.
Common questions
- Explain Spring Boot and the
@SpringBootApplicationannotation - How would you implement JWT-based authentication, and what caching strategy would you use?
- Design an LRU cache and analyze its time/space complexity
- Git branching strategy and how you resolve merge conflicts
- Design a database schema and write SQL queries for a scenario like an order-delivery system
Full round-by-round narratives are on the Visa interview experience page.
Lead/Manager Round
Section titled “Lead/Manager Round”Candidates consistently describe this as the most relaxed round of the loop - more conversation than evaluation, though it still probes technical judgment lightly.
Common questions
- How do you use AI coding tools in your workflow, and where do you draw the line?
- A general problem-solving or curriculum-related challenge you faced
- Explain encryption vs. hashing
- Why Visa, and what excites you about payments-network engineering specifically?
Sample answer frameworks for each of these are on the Visa HR interview questions page.
Common technical interview questions and answers
Section titled “Common technical interview questions and answers”Q: What does the @SpringBootApplication annotation actually do?
It is a convenience meta-annotation that bundles three others. @Configuration marks the class as a source of bean definitions. @EnableAutoConfiguration tells Spring Boot to inspect the classpath and auto-wire sensible beans - see spring-boot-starter-web and it configures an embedded Tomcat plus a DispatcherServlet, see an H2 jar and it configures a DataSource. @ComponentScan scans the annotated class’s package and everything below it for @Component, @Service, @Repository, and @Controller beans, which is why your main class should sit in the root package. You can exclude specific auto-configurations with the exclude attribute when a default gets in your way.
Q: How does JWT-based authentication work, and how do you invalidate a token?
A JWT has three base64url-encoded parts joined by dots: a header naming the algorithm, a payload of claims such as subject, issued-at, and expiry, and a signature over the first two parts. On login the server signs the token with a secret (HMAC) or private key (RSA/ECDSA) and returns it; on each later request the server verifies the signature and expiry locally, so no session lookup is needed - that statelessness is the whole point. The cost is that you cannot revoke a token before it expires, because nothing is stored server-side. The standard fixes are short-lived access tokens of five to fifteen minutes paired with a longer refresh token that is stored and revocable, plus a denylist of token IDs for emergency logout.
Q: Design an LRU cache and give its time and space complexity.
Use a hash map plus a doubly linked list. The map takes a key to its node, giving O(1) lookup; the list keeps nodes ordered by recency with most-recently-used at the head. On get, find the node, unlink it, and reinsert at the head. On put, insert at the head and, if over capacity, remove the tail node and delete its key from the map. Both get and put are O(1) because unlinking a node you already hold a pointer to needs no traversal, and space is O(capacity). In Java you can get this behaviour free from LinkedHashMap constructed with accessOrder = true and an overridden removeEldestEntry.
Q: What is the difference between encryption and hashing, and where does each belong in payments?
Encryption is two-way: with the key you can recover the plaintext, so it suits data you must read back, such as a stored card number encrypted with AES-256 or a TLS session protecting data in transit. Hashing is one-way: a fixed-length digest with no inverse, so it suits verification rather than retrieval - password storage and integrity checks. Passwords should use a slow, salted key-derivation hash such as bcrypt, scrypt, or Argon2, never a fast SHA-256, because speed helps the attacker brute-force. In a card flow the practical pattern is tokenisation - replacing the PAN with a surrogate token - combined with encryption at rest and a keyed HMAC to authenticate messages between services.
Q: What are the four necessary conditions for deadlock, and how do you break one?
Coffman’s four conditions must all hold simultaneously: mutual exclusion (a resource is non-shareable), hold and wait (a thread holds one resource while requesting another), no preemption (a resource cannot be forcibly taken), and circular wait (a cycle exists in the wait-for graph). Break any one and deadlock cannot occur. The most practical technique in application code is eliminating circular wait by imposing a global lock ordering - always acquire account A’s lock before account B’s by comparing IDs, which is the classic fix in a money-transfer routine. Alternatives are timeouts with backoff and retry (attacking hold-and-wait) or requesting all resources atomically up front.
Q: What is the difference between multiprocessing and multithreading?
Processes have separate address spaces, so a crash or memory corruption in one does not touch another, and they communicate only through explicit IPC - pipes, sockets, shared-memory segments. Threads within a process share the heap and open file descriptors, so communication is just reading a shared variable, which is far cheaper but requires synchronisation to avoid race conditions. Context switching between threads is cheaper because the memory mappings and TLB stay valid, whereas a process switch flushes more state. Choose processes for isolation and fault containment (and in CPython, to escape the GIL for CPU-bound work), threads for I/O-bound concurrency inside one service.
Q: Design a schema and write a query for an order-delivery system’s late orders.
A minimal schema: customers(id PK, name, city); orders(id PK, customer_id FK, placed_at, promised_at, status); deliveries(id PK, order_id FK, agent_id, delivered_at). Index orders on customer_id and on status plus placed_at, because those drive the common lookups. To list orders delivered after their promised time: SELECT o.id, c.name, d.delivered_at FROM orders o JOIN customers c ON c.id = o.customer_id JOIN deliveries d ON d.order_id = o.id WHERE d.delivered_at > o.promised_at ORDER BY d.delivered_at DESC;. If the interviewer asks for orders never delivered, switch to a LEFT JOIN on deliveries with a WHERE d.id IS NULL anti-join instead.
Q: How do you resolve a Git merge conflict, and when would you rebase instead of merge?
Git marks conflicting regions in the file with markers separating your branch’s version from the incoming one; you edit the file to the intended final content, delete the markers, git add the file, and then commit (or git rebase --continue if you were rebasing). Use merge when the branch is shared, because it preserves the true history and does not rewrite commits others have pulled. Use rebase on your own local feature branch to replay your commits on top of the latest main, which gives a linear history and a cleaner review diff. The rule Visa interviewers look for is never rebase a branch that has already been pushed and is being used by someone else.
Frequently asked questions about Visa interviews
Section titled “Frequently asked questions about Visa interviews”What is the Visa interview process for freshers/new grads?
Visa’s new-grad software engineering process typically has 3 stages spread over roughly six weeks: an online coding assessment on CodeSignal, two back-to-back technical interviews (sometimes on the same day), and a lead/manager round. The first technical round leans on project depth and CS fundamentals, the second on backend/system design and DSA, and the final round is a lighter behavioral and team-fit conversation.
What does the Visa online assessment involve?
The OA is run on the CodeSignal platform, roughly 70 minutes for 4 coding questions - reported examples include finding substrings with vowels, identifying peak-removal sequences, locating grid cells with uniform rows/columns, and a dynamic-programming problem. Expect a genuine spread from easy array logic to one harder DP or greedy question.
What happens in Visa’s technical interviews?
Technical Round 1 (~30 minutes) covers your resume projects in depth - candidates report questions on LLM integrations and React hooks - plus CS fundamentals: pointers, the four pillars of OOP, and OS topics like multiprocessing, multithreading, deadlock, and memory management. Technical Round 2 (~70 minutes) goes heavier on backend and design: Spring Boot annotations, JWT-based auth, caching strategy, designing an LRU cache with complexity analysis, Git branching/merge-conflict workflows, and writing a database schema plus SQL queries for a scenario like an order-delivery system.
How many rounds are in the Visa interview process?
Most new-grad candidates go through 3 stages: the online assessment, two technical interviews (which may be scheduled together), and a final lead/manager round. The exact count and rhythm can vary by location and seniority level.
What is the Visa lead/manager round like?
Candidates describe it as noticeably more relaxed than the technical rounds - roughly 30 minutes covering your views on using AI coding tools, general problem-solving and curriculum-related challenges, and a technical concept question or two (encryption vs. hashing is a reported example). Interviewers say they’re evaluating thought process over a perfect answer.
How should I prepare for Visa interviews?
Practice DSA (arrays, HashMap/HashSet-based problems, DP) and be ready to design an LRU cache with complexity analysis for the OA and Round 2. Revise OOP fundamentals and OS basics (deadlock, multithreading) for Round 1, and brush up backend concepts - Spring Boot, JWT, caching, and SQL schema design - for Round 2. As a payments network processing transactions at global scale, Visa also frames some questions around reliability and security, so have an example ready where you prioritized correctness or security over speed.