# Design a security incident response platform: system design interview question

> Security response workflows: duplicate alerts, uncertain action outcomes, human approvals, tenant isolation, and reliable audit records.

Source: https://sysround.com/questions/design-security-incident-response-platform
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a platform that turns security alerts into investigation cases and automated response workflows. It must coordinate actions across external tools, support approval gates and retries, and preserve an execution history."

## What to clarify first

- Scale
- Alerts and case rules
- Workflow behavior
- Read and write traffic
- Latency
- External tools
- Approvals and cancellation
- Consistency and durability
- Retention and audit
- Security and boundaries

## Scope of a strong answer

Core requirements:

- Accept alerts and create or update investigation cases.
- Run response workflows with conditions, parallel steps, and approval gates.
- Execute external actions with retries and clear failure states.
- Preserve case histories and an audit record for each action.

Usually out of scope:

- Detect threats from raw security data.
- Analyze malware.
- Implement the external security tools.
- Provide multi-region failover.

## What interviewers probe

### Alerts and cases

Sources repeat alerts and deliver them late. Concurrent consumers must create one case and one workflow without losing evidence.

### External action outcomes

A tool can complete an action without returning a response. A retry can repeat a harmful action or hide an unresolved result.

### Approval decisions

Human decisions arrive late while targets, policies, and run states can change. An approval must authorize one precise action.

### Execution history and recovery

Security teams need evidence for every action. Worker failures and administrator access must not leave silent gaps or undetectable changes.

## Common mistakes

- Treat every duplicate alert as a new case or workflow.
- Promise exactly-once external actions without support from the external tool.
- Retry an uncertain destructive action without a safe recovery rule.
- Store approval as a case flag without an action target or expiry.
- Keep a worker active while a workflow waits for human approval.
- Use ordinary application logs as the only audit record.

## The bar by level

- **Senior:** Defines crash recovery and unknown outcomes. Binds approvals to exact actions. Uses atomic state transitions, durable waits, tenant quotas, and a reliable audit path.
- **Staff+:** Defines enforceable safety boundaries across tools with different guarantees. Covers stale workers, credential compromise, audit integrity, tenant isolation, and recovery without duplicate destructive actions.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=security-incident-response


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.