Question 1Cloud, deployment and security
A bank wants our product inside their own cloud account, with no data leaving it. How do you approach it?
Self-hosted and private-cloud deployments are common in regulated industries.
“Strong background in on-premise, private cloud, and multi-cloud environments (AWS, Azure, GCP), including experience with containerization and orchestration (Docker, Kubernetes).”Forward Deployed Engineer (AI Applications) · Seekr
The answerFour steps
- 1
Learn their rules early: network limits, approved services, review process
Say it like this
“Before any code, I'd ask for an hour with their cloud security team: approved services, whether outbound internet is allowed, how images get scanned, how long review takes.”
Why it scores
Treats the security team as the critical path, which it usually is.
- 2
Package the product so it installs the same way each time (containers, Terraform)
Say it like this
“We ship signed container images, a Helm chart and a Terraform module, mirrored into their registry, so every install is identical.”
Why it scores
The same artifact every time, in their registry. No hand-built servers.
- 3
Plan how you'll get logs and updates without touching their data
Say it like this
“For support, nothing leaves: we get a health page and redacted logs they choose to share, and updates are new image versions they pull.”
Why it scores
Answers the hard part: how you support a system you can't see.
- 4
Run a test install with them before the real one
Say it like this
“Then a timed test install in their dev account with their engineer at the keyboard. The real one goes much faster after that.”
Why it scores
A rehearsal with their people finds blockers before the date that matters.
StrongAll together
About a minute, out loud. The marked parts are the four steps; hover one to find it above.
Before any code, I'd ask for an hour with their cloud security team: approved services, whether outbound internet is allowed, how images get scanned, how long review takes.1 Say it's no outbound traffic, EKS and RDS only. We ship signed container images, a Helm chart and a Terraform module, mirrored into their registry, so every install is identical.2 If the product calls a model, it's one hosted in their account. For support, nothing leaves: we get a health page and redacted logs they choose to share, and updates are new image versions they pull.3 Then a timed test install in their dev account with their engineer at the keyboard. The real one goes much faster after that.4
WeakThe answer that fails
Sounds fine. Common. Scores low.
“I'd set up the infrastructure in their AWS account with Terraform, deploy our containers to Kubernetes, open a VPN so our team can reach it for support, and lock down the security groups.”
Interviewer's note
A VPN for our team is exactly what the bank ruled out. Never asked what their rules are.
PracticeTwo minutes, then they push back
Your turn
A bank wants our product inside their own cloud account, with no data leaving it. How do you approach it?
Answer like you're in the room: about two minutes, no notes. Say it out loud, even alone. It feels different from thinking it. Then check your answer against what interviewers score.