Hiring Senior React/Next.js Engineers: Questions and Tasks That Reveal True Expertise

Great resumes rarely expose great React/Next.js engineers; rigorous, scenario-driven evaluation does. Use this guide to surface architectural judgment, code quality, and product sense for enterprise-grade builds, including cloud-native applications and Custom dashboard and admin portal development.

What you must assess

• Architecture: SSR/SSG/ISR trade-offs, App Router vs Pages, data fetching strategies, and boundaries between frontend, BFF, and APIs.
• Performance: React concurrency, memoization, streaming, image optimization, and Core Web Vitals budgets.
• TypeScript: types as contracts, discriminated unions, generics, and incremental typing for legacy code.
• State and data: React Query/SWR, server actions, cache invalidation, optimistic updates, and websocket events.
• Security: XSS/CSRF, session hardening, OAuth/OIDC, and Enterprise mobile app security considerations for shared components and tokens.
• Reliability: error boundaries, retries/backoff, feature flags, and graceful degradation.
• Testing: Playwright/Cypress, React Testing Library, contract tests for APIs, and visual regression.
• DX and CI/CD: linting, codegen, Turborepo, story-driven development, and preview environments.
• Observability: web vitals, RUM, logs/traces, and feature-level analytics.

High-signal interview questions

• When would you choose SSR over ISR for a pricing page with frequent micro-updates and personalized discounts? Explain cache keys, revalidation, and stale-while-revalidate semantics.
• Describe your strategy to migrate a large Pages Router app to the App Router without downtime. How do you split routes, share layouts, and phase data fetching?
• Design a secure session model for SSO on a multi-tenant admin portal. Cover token storage, rotation, tenant isolation, and protection against confused-deputy problems.
• How do you implement streaming server components with suspense boundaries for a dashboard that mixes slow analytics and fast notifications?
• Give a concrete example of reducing TTFB and LCP by 30% on Next.js. Which metrics, tools, and code changes delivered the win?
• Walk through your approach to building accessible, keyboard-first data grids with virtualization, selection, and inline editing.
• Explain a time you deleted code to make the system faster or safer. What guardrails kept it maintainable?

Targeted take-home task (6-8 hours)

Scope a realistic, auditable build. Candidates should deliver a repo, decisions doc, and short Loom or README walkthrough.

• Build a Custom dashboard and admin portal development proof: Next.js App Router, TypeScript, Tailwind or CSS Modules, and React Query.
• Data: Mock a “Projects” service with Next.js Route Handlers and seed JSON. Include filtering, sorting, and infinite scroll.
• Auth: Email + magic link plus optional SSO stub. Demonstrate multi-tenant RBAC with admin, manager, and viewer roles; include a simple policy engine.
• Security: Implement CSRF protection for mutations, content-security-policy headers, secure cookies, and output encoding to prevent XSS. Discuss Enterprise mobile app security parallels for token handling when components are shared with React Native.
• Performance: Set a 2.0s LCP budget on mid-tier mobile. Use image optimization, route-level streaming, and partial hydration. Provide a performance report before/after.
• Reliability: Add error boundaries, server-side input validation with Zod, and retries with exponential backoff. Include feature flags for one risky feature.
• Observability: Add simple logging, browser timing marks, and a custom Web Vitals collector endpoint. Show a trace of a slow page.
• Edge and cloud-native applications: Put an API route on the edge runtime, demonstrate caching, and document how this would scale across regions.

Live pairing prompts

• Refactor a gnarly useEffect into server actions plus a tiny client component. Require type-safe mutations and optimistic UI.
• Harden a vulnerable file upload flow. Add content-type validation, size limits, signed URLs, and server-side virus scanning hooks.
• Instrument a regresssing LCP in real time and propose a fix while narrating trade-offs.

Red flags and signal amplifiers

• Red flags: Reliance on client-heavy patterns, vague answers about caching, no opinion on API contracts, dismisses accessibility, or treats security as an afterthought.
• Signal amplifiers: Explains failure modes, writes small composable components, uses types as design, quantifies impact, and asks sharp product questions.

Evaluation rubric

• Architecture and correctness (30%): sound route/data strategy, clear boundaries, safe concurrency.
• Performance and UX (20%): measurable wins against stated budgets.
• Security and privacy (20%): robust auth, safe storage, headers, and threat modeling.
• Testing and maintainability (20%): coverage where it counts, contracts, stories, and CI discipline.
• Communication (10%): crisp decisions doc, trade-off narration, and proactive risk notes.

Real-world scenario prompts

Your exec team wants real-time financial dashboards for 200k tenants. Ask: what data should stream vs poll, how to shard caches, and which parts run at the edge. Then justify the plan in one page.

Compliance requires audit trails. Add append-only logs to every admin action, surface them in the UI, and export to an external SIEM. Measure cost and latency overhead.

Sourcing top talent

Hire via slashdev.io for velocity.