Databricks AI Security Engineer interview questions

Reviews fail when they arrive late, cover everything equally and produce vague findings. The scored answer scopes early, focuses on the riskiest decisions and writes findings as specific, owned changes.

AI features need the usual secure development steps plus a few that most lifecycles lack. The scored answer places each activity at the stage where it is cheapest and names the gate.

Leaked keys remain one of the commonest breach causes, and agents create new places to leak them. The scored answer prefers no secret at all, then short-lived ones, and keeps them out of every model context.

A leadership question. The scored answer finds out what exists, fixes the highest-impact exposures, and builds the few shared controls that make every later project cheaper.

Security engineers rarely have authority over the teams whose code matters most. The scored answer makes the secure path the easy one, earns trust through help, and gives teams ownership.

The tools are free; running them is not. A strong answer picks a small set by risk, assigns owners, and treats every security tool as software that can be compromised or relicensed.

A seccomp filter decides on a system call number and six integers. It cannot read the file path a pointer refers to, and that one limitation shapes every good policy.

'Yes, always' is the right default and the wrong answer. The interviewer wants the list of attackers it does nothing against.

mTLS authenticates both ends, but only as well as your private CA and identity scheme. The scored answer designs issuance, identity, rotation and authorisation, and contrasts it with the public web.

Mutual TLS proves who connected to whatever terminated the TLS. If that is a load balancer, the application only knows what a header tells it, and headers can be forged.

Documents are shared with people, folders, teams and links. Roles alone collapse under that, and the interviewer wants to see you notice when.

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

Scattered permission checks drift apart until one is wrong. The scored answer weighs a central decision service against latency, availability and consistency, and keeps enforcement close to the data.

API keys identify a caller; OAuth delegates a user's authority. The scored answer picks by who is acting and on whose behalf, and makes API keys as safe as they can be when used.

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

Moving passwords from config files into a secret manager helps only if the application's way of logging in to the secret manager is not itself a password in a config file.

Work through tenant, role, object and field checks, then extend the review to bulk exports, permission changes and resource budgets with executable acceptance cases.

Verify the sender protocol, persist recoverable intake, distinguish delivery retries from business effects, and work through two offline fixtures and crash boundaries.

Small requests that trigger large work are the cheapest denial of service. The scored answer finds the multipliers, bounds every one, and adds the AI-era ones.

The commonest serious bug in AI tools is the oldest: fetching an object by ID without checking who is asking. The scored answer finds it, fixes it at the data access, and tests across users and tenants.

An LLM reviewer reads every change, which no human team can, and is confidently wrong some of the time. The scored answer places it as a triage layer, measures it, and protects it from the code it reads.

An easy coding warm-up with traps a security engineer should spot: symlinks, huge files, unreadable files and paths outside the tree. The scored answer handles each and tests it.

An ORM parameterises the queries it builds. It cannot protect the queries you build around it, or the data you trusted because it came from your own database.

Most database breaches are not clever. They are a reachable database, an over-privileged account, a leaked credential or an exposed backup.

Managed databases remove patching chores but add a control plane: whoever can call the cloud API can often copy, share or expose the whole database.

These breaches rarely involved exploits. Databases built for trusted networks were put on the internet with no password, and automated scripts found them within hours.

The provider secures the model service. Everything you put into it, connect to it and build on top of it is still yours.

Many ML tools assume they run on a trusted network and offer 'run this code' as a feature. Put them on the internet and that feature is remote code execution.

Training jobs need privileged-looking things: device access, big volumes, fast networking. Hardening is about granting exactly those and nothing else.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.

Managed AI services remove servers, not responsibility. The scored answer covers identity, network, data, model, logging and governance controls that remain the customer's.

A customer model is customer code: loading it can execute anything, and serving it shares expensive hardware. The scored answer isolates execution, scans and constrains artefacts, and keeps tenants apart on GPUs and networks.

An AI system's behaviour lives in more places than its code. The scored answer versions every one of them together, so you can return to a known-good state in minutes after a bad change or a poisoning.

Serving images bundle a model runtime, GPU libraries and dozens of Python packages. The scored answer controls what goes in, proves where it came from, and admits only verified images to production.

Sending prompts to a provider is a data flow like any other. The scored answer keeps it on private paths where possible, forces all model traffic through one controlled exit, and blocks everything else.

Serving nodes parse hostile input all day, so assume one falls. The design question is what it can reach: the registry, other tenants' models, the signing keys, or nothing at all.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.

Inference servers are built to run on a trusted machine, so most have no authentication and some trust their own network completely. Internet scans keep finding them anyway.

You cannot protect data you have not found, and you cannot find it once it has been copied into ten places. The toolchain answer follows data from discovery to the AI index.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

The weights are safetensors and the code is a Python file from the same repository, fetched at load time. Guess which one runs with your credentials.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

Promotion to production is a deployment decision dressed as a metadata change. The scored answer gives it change control, binds it to evidence, and makes swaps detectable.

Open weights arrive with code, configs, licences and unknown training. The scored answer turns due diligence into a repeatable gate that production enforces automatically.

Pinning a version is not pinning content. The scored answer verifies every file against a recorded hash, treats unexpected and missing files as failures, and explains where the lockfile's own trust comes from.

A vendor breach becomes yours through the access you gave them. The scored answer inventories that access, rotates and revokes it, looks for misuse, and works out what data was exposed.

Scanners are good at one thing: spotting code where only data should be. The scored answer explains how they work, how they are evaded, and why a clean scan is not a clean model.

Code that downloads a model by name trusts whoever owns that name today. The scored answer lists the ways that trust breaks and replaces names with pinned, mirrored, verified artefacts.

Typosquatting waits for a human typo. Slopsquatting waits for a model to invent the same wrong name again, and models repeat themselves.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

A design round in miniature. The answer that scores follows the data through both halves of the pipeline and spends most of its time on authorization, where real leaks happen.

The tempting answer is that embeddings are one-way hashes. They are not. The answer that scores explains inversion and protects the index like the documents.

LLM observability quietly becomes the largest copy of customer data in the company. The scored answer minimises what is captured, separates what must be kept, and treats trace stores as production data.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

Fine-tuning moves data from a database you can query and delete into weights you cannot. The scored answer covers memorisation, tenant separation, poisoning and the deletion problem.

The connector copies documents out of a system that enforces permissions into one that must re-create them. The scored answer treats permission fidelity and freshness as the core problem.

A gateway turns dozens of ad hoc model integrations into one place to enforce and observe. The scored answer chooses what belongs centrally and what must stay in each application.

Most bad retrieval is a quality bug; some of it is an attack or an access failure. The scored answer separates the cases quickly and checks the security ones first.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.

The most similar chunk is often the one written to be retrieved. The answer adds provenance to every chunk, ranks with it outside the model, and refuses to let text declare its own authority.

Research has shown a handful of planted documents can steer targeted answers. The defence is not a detector that recognises poison; it is control over who can write, staged promotion, and a risk estimate that multiplies the stages.

Yes, it is certifiable, and it is built to sit next to 27001. The follow-up is what a certificate does not prove.

Location of the office is not the test. Where the system is placed, used, or where its output is used, is.

When everyone owns AI risk, nobody does. The scored answer puts one accountable owner on each decision and makes the specialist teams responsible for the work they are best at.

AI vendors add questions a standard security questionnaire never asked. The scored answer covers training use, retention, subprocessors, model changes and incident terms, and verifies rather than trusts.

Six months is possible for a well-run organisation with a narrow scope. The scored answer sets the scope first, reuses an existing management system, and schedules the audits backwards from the date.

Slides on prompt injection change little. The scored answer teaches through the developers' own code, gives them paved roads, and measures behaviour change.

Three bugs, one cause. The answer that scores names the cause, explains why parameters are structural, and lands on why prompts have no parameters.

'Sanitise input' is the answer that fails. The interviewer wants encoding at the point of output, for the specific context, with CSP behind it.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

Reading files top to bottom finds style issues. A security review starts from sources, sinks and the checks between them, and AI code adds a new source.

The model is not the attacker, but whoever wrote the document it just read might be. Every argument in a tool call is untrusted input.

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Three browser rules that candidates mix up constantly. The JWT follow-up exposes whether you know which one depends on cookies.

The format is the bug. JSON cannot call functions; pickle is designed to. The AI version is the model checkpoint you just downloaded.