Software Testing Interview Questions for Senior QA / SDET / Lead (1970)

Start from risk, not tools. (1) Map business risk per service (payments and auth = P0; static content = P3). (2) Set the test pyramid contract per tier — unit > component > contract > API > UI. (3) Define quality gates for each stage (PR gate = smoke + unit, merge gate = component + contract, nightly = full regression + non-functional). (4) Assign ownership — each team owns tests up to contract; the platform team owns cross-service E2E, perf and security. (5) Publish RACI + SLOs + review cadence. Present as a 1-page document leadership can approve.

Publish 5 SLOs: escape rate < 3% per release, P1 MTTR < 4 hours, flake rate < 1% per suite, PR smoke feedback < 8 min, regression coverage > 80% of P0/P1 flows. Track weekly, alert on breach, review monthly with engineering leadership. SLOs turn quality from 'testing team's job' into a shared engineering commitment.

Automate anything repeated, stable and high-value (regression, smoke, data-integrity, contracts). Keep manual for exploratory, visual/UX judgement, usability, one-off migrations, and early alpha where UI churn kills ROI. Publish the decision matrix (frequency × stability × business impact) so juniors don't automate low-value paths.

Six-month rollout: (1) get engineering leadership sponsorship with a leakage baseline. (2) pilot with one squad — pair QA + dev on story acceptance and PR review. (3) add PR-level smoke + contract gates. (4) publish before/after metrics (leakage down, cycle time down). (5) roll out to 3 more squads with the pilot's playbook. (6) make shift-left part of the definition-of-done. Change management > tooling.

Monthly cadence, 45 minutes: (1) leakage trend + top 3 root causes, (2) automation coverage vs target per team, (3) flake and MTTR trend, (4) infra spend vs budget, (5) top 3 risks for next month + owners. Publish minutes and action items in a shared doc; close every action by the next review. Governance without follow-through is theatre.

Anchor on regulation (RBI / HIPAA / SOX). Checklist per release: (1) traceability from requirement → test → evidence, (2) audit trail for every test run (who, when, env, data), (3) sign-offs on P0 flows, (4) data-privacy tests (masking, PII isolation), (5) security scan results (SAST, DAST, SCA), (6) rollback rehearsal. Never release without every box green + regulator-visible evidence.

Frame it as a business decision, not a QA veto. Present: (1) exact user impact per P1 (workflows blocked, users affected, revenue at risk), (2) rollback plan and monitors, (3) mitigation options (feature flag off, communication, hotfix ETA). Ask leadership to sign the risk acceptance. Document the decision. Never say 'no' alone; never say 'yes' silently.

It means the org's incentives, tooling and processes make quality the default, not the QA team's private effort. Concretely: devs write unit + contract tests, PRs gate on smoke, definition-of-done includes non-functional, on-call is shared, RCAs are blameless, and QA owns strategy + platform tooling, not just test execution. If quality still sits only with QA, the strategy has failed.

Answer in layers, not tools: Config layer (env, secrets, feature flags), Driver/API layer (Playwright/Selenium/RestAssured with a factory), Page/Service layer (Page Objects, API service clients), Business-flow layer (reusable domain flows — checkout, onboarding), Test layer (declarative tests, data providers), Reporting layer (Allure/ReportPortal + trend + flake analytics), CI layer (parallel + sharding + retries + gating). Ready to sketch the diagram and justify every choice.

Default to Playwright for web unless the team is deep in Selenium or needs Grid + real-device farms tightly integrated. Playwright wins on speed, auto-wait, tracing, network mocking and TypeScript ergonomics. Selenium still wins on browser breadth via Grid, legacy IE/Edge scenarios, and existing Java ecosystems. Pick per team + product, not per hype.

(1) Enforce the test pyramid — push work down from UI to API/component/unit. (2) Parallelise with shards + workers; target < 15 min for the full suite. (3) Selective execution — run only tests touching the changed code (test-impact analysis via git diff + affected modules). (4) Kill duplicates quarterly. (5) Isolate test data per worker. (6) Move slow browser tests to headless containers with tuned CPU/RAM. (7) Cache dependencies. (8) Track suite duration as an SLO.

Root-cause categorisation is the senior move: build a flake dashboard tagging every failure (timing, data, third-party, env). Attack the top category first. Fix > retry: retries hide real bugs. Auto-quarantine tests exceeding a flake budget, assign owner, un-quarantine only after RCA. Publish a weekly flake report. Treat flake as tech debt with a budget, not as inevitable noise.

Strangler-fig pattern: (1) run both frameworks side by side in CI. (2) all new tests written in Playwright from day one. (3) migrate high-value / high-flake tests first (biggest ROI). (4) delete migrated Selenium tests same PR. (5) track migration % as a KPI. (6) sunset Selenium infra only after 100% migration + 2 stable release cycles. Never big-bang.

Publish a shared library (npm/Maven) with: reusable Page Object base classes, API service clients, auth helpers, data factories, custom assertions, and reporting hooks. Version it semver, gate breaking changes with an RFC. Product teams consume via package manager, contribute back via PRs. Governance > copy-paste.

Three tiers: (1) synthetic factories (Faker + builders) for isolated tests, (2) seeded data via setup APIs with tear-down (test owns lifecycle), (3) anonymised prod snapshots for perf/regression on PII-masked datasets. Never rely on shared mutable state. Test-data service becomes a first-class platform product with SLAs.

Every run publishes: results (Allure/ReportPortal), trace (Playwright trace / Selenium video), logs (structured, correlation-id-linked to app logs), metrics (duration, flake, coverage) into a time-series store (Grafana). Dashboards for suite health, flake trend and coverage. Alerts on SLO breach. Observability is the senior differentiator between 'we run tests' and 'we understand our tests'.

Bazel or Nx-style affected-graph: on PR, detect which services changed via git diff + dependency graph, run only their unit + component + contract tests + smoke of downstream consumers. On merge to main, run full regression on changed services + integration on affected boundaries. Nightly: full E2E + non-functional. Parallelise per service; cache aggressively. Target < 10 min PR feedback.

Containerise the test runner + browser images (mcr.microsoft.com/playwright, selenium/standalone-chrome). Use K8s Jobs for on-demand runs; auto-scale via HPA on queue depth. Each job gets isolated env vars, secrets from Vault, ephemeral namespace. Pods stream logs + artefacts to S3. Right-size CPU/memory per test type — perf tests need more, unit needs less. Kill zombie pods aggressively.

Layered gates: Pre-commit — lint + unit locally. PR — unit + component + contract + smoke (must pass, < 10 min). Merge to main — full regression + integration (must pass). Pre-release — perf + security + a11y + manual sign-off on P0. Post-deploy — canary + synthetic monitors. Never let a broken main last more than 30 minutes.

Cost + control trade-off. Self-hosted Docker/K8s wins on cost at > 500 test-hours/month and gives full control over browser versions, network and data. Cloud farms win on real device matrix (iOS, Android, real Safari), regulatory constraints (no infra to maintain), and low volume. Most mature teams end up hybrid: self-hosted for the bulk, cloud for real-device nightly and long-tail browsers.

Secrets in Vault / AWS Secrets Manager / GitHub Actions encrypted secrets — never in code, never in logs. Rotate quarterly. PII: mask before use, generate synthetic where possible, never copy prod PII into lower envs without legal + security sign-off. Add pre-commit hooks + secret-scanning in CI to block leaks.

Blue/green: run the full smoke + P0 regression against green before cutover; keep blue warm for instant rollback. Canary: automate 1% → 5% → 25% → 100% rollout with synthetic monitors + real-user-monitoring gates between steps. QA owns the canary rules and the rollback trigger. Test in production is a first-class strategy at senior level.

Define SLOs (p95 latency, throughput, error rate) with product. Baseline every release with k6/JMeter/Gatling in CI. Load, stress, soak and spike tests as separate suites, run nightly. Correlate results with APM (Datadog, New Relic) traces. Publish a perf regression alert on SLO breach. Perf isn't a phase — it's a continuous gate.

Shift-left across four layers: SAST (SonarQube, Semgrep) in PR, SCA (Snyk, Dependabot) daily, DAST (OWASP ZAP) in staging nightly, and manual pentest quarterly. Every P0/P1 CVE has an SLA to fix. Integrate with security team's ticketing so it's one workflow. Add auth/authz/rate-limit/PII negative tests to the API regression suite.

Automated: axe-core / pa11y in every UI test run, gate on new violations. Manual: keyboard-only + screen-reader (NVDA / VoiceOver) audit per major release. Contract with product: WCAG 2.2 AA is definition-of-done. Track violation count as a quality metric. A11y isn't optional — it's regulatory in EU / US public sector.

Start with a hypothesis (e.g., 'checkout survives payment-gateway 500ms latency'). Use Gremlin / Chaos Mesh / Litmus to inject failures (latency, packet loss, pod kill, disk-fill) in staging. Assert observability catches it (alerts fire, dashboards show, on-call paged), then assert user impact (graceful degradation, retry, fallback). Progress from staging to production game-days.

Layered: Unit — pure transform functions with Great Expectations / pytest. Contract — schema registry (Avro, JSON Schema) tests for producers and consumers. Integration — testcontainers spinning up ephemeral Kafka + DB, assert end-to-end row parity. Data-quality — nightly Great Expectations / dbt tests on prod for freshness, uniqueness, distribution drift. QA co-owns data-quality SLOs.

Contract-first: publish AsyncAPI / Avro schemas, gate schema changes with Pact-for-Kafka. Test producers by asserting emitted event shape; test consumers by feeding synthetic events and asserting side effects. Add lineage tests (event A must eventually trigger DB state B within N seconds). Never test the full chain via UI at scale — it's slow and flaky; test contracts and side effects.

4-round loop: (1) recruiter screen + resume signal, (2) coding + framework design (60 min), (3) system-design or scenario ('scale to 10k tests', 'design a flake-detection service'), (4) behavioural + collaboration. Calibrate every interviewer. Score on evidence, not gut. Aim for false-negative > false-positive — a bad senior hire compounds.

90-day plan: (1) give them ownership of a cross-cutting initiative (framework upgrade, flake budget), (2) shadow senior meetings — architecture, planning, RCAs, (3) pair on writing an RFC or governance doc, (4) sponsor them for a talk or blog post, (5) publish a quarterly growth review with concrete promotion criteria. Mentorship > task assignment.

Structured, documented, kind: (1) private 1:1 — describe specific behaviour + impact, agree on written goals with dates. (2) weekly check-ins with progress notes. (3) if no improvement after 60 days, formal PIP with HR. (4) if PIP fails, exit respectfully. Never surprise, never public, never emotional. Protect the team's morale while giving the individual a real chance.

Three slides max: (1) trend chart of escape rate + release velocity, (2) top 3 risks + owners + ETAs, (3) 1 ask (headcount, budget, exec sponsorship). Speak in business language — revenue at risk, hours saved, spend avoided. Never dump tool trivia on leadership; they need decisions, not data.

Meet 1:1 first, understand their constraint (velocity pressure, headcount). Bring data — leakage cost, incident hours, customer impact. Propose a compromise (e.g., gate on P0 flows only, allow P2 flake). Escalate to shared skip-level only if genuinely blocked, framed as 'help us align', not as 'they're wrong'. Preserve the relationship.

Days 1–30 — listen: shadow releases, read RCAs, meet dev + PM + SRE leads, baseline metrics. Days 31–60 — one small win (fix top flake source, land a smoke pipeline, kill one duplicate suite). Days 61–90 — publish a 6-month quality roadmap with SLOs, owners, and asks. Never propose big change before day 30. Never coast past day 60.

Situation — payment webhook stopped processing for 40 minutes during peak, $180k revenue at risk. Task — coordinate war-room, RCA, and prevention. Action — pulled logs + traces, identified consumer-lag from a schema mismatch missed by contract tests (the consumer test used stale fixtures). Coordinated hotfix + replay, then owned RCA: added dynamic-fixture contract testing, alert on consumer-lag > 30 s, quarterly schema drift review. Result — zero payment incidents in 6 months; pattern adopted org-wide for all Kafka consumers.

Situation — new team, escape rate at 18%, QA seen as gatekeeper. Task — reduce leakage and shift-left ownership. Action — ran a blameless leakage retro, published a shift-left playbook (PR gates, contract tests, story-level acceptance), paired 1:1 with each dev on their first contract test, and made escape rate a shared team OKR. Result — leakage down to 3% in 2 quarters, devs writing 60% of new automated tests, QA time freed for perf + exploratory.

Situation — director wanted to ship a payment feature without perf testing 'because it's low traffic'. Task — protect the release without stonewalling. Action — brought data on similar 'low traffic' features that spiked 30× at launch, offered a 4-hour k6 baseline instead of a 2-day full perf, and volunteered to run it overnight. Result — perf found a DB connection-pool exhaustion at 200 concurrent users; fixed pre-release; feature launched successfully at 8× projected load. Director now defaults to including QA in launch reviews.

Situation — company grew from 1 to 5 product squads in 9 months; QA team of 3. Task — scale quality without linear headcount growth. Action — reorganised: 1 SDET embedded per squad (hired 2), central platform-QA team of 3 owning framework + CI + non-functional. Published governance model, shared library, weekly office hours. Result — squads shipped independently, escape rate held at 4% across 5 squads with 1.6× headcount instead of 5× — a measurable leverage win for leadership.

Situation — SDK release with an unfixed security CVE (medium severity, active exploit in the wild). Task — decide whether to gate. Action — presented CVE details, customer exposure and 2-day patch ETA to product, engineering and security. Recommended a 48-hour delay with a written risk-acceptance if leadership disagreed. Result — leadership accepted the delay; patched CVE shipped with the SDK; no customer incident. Established a monthly CVE-triage that now runs org-wide.

Frame it in three parts: (1) outside pattern-library — you've shipped X frameworks, seen Y architectures fail, hired Z SDETs across N companies; (2) specific alignment — one thing on their engineering blog or JD you can start attacking day one (e.g., their public post about flaky CI); (3) humility — you'll spend the first 30 days listening before proposing. Never disparage internal candidates; position yourself as complementary, not competing.