Senior React/Next.js hiring guide: questions and take-home tasks
When you hire a senior React/Next.js engineer for enterprise work, you're betting on judgment under ambiguity. This guide arms you with concrete interview prompts and a high-signal take-home aligned to cloud-native applications, Enterprise mobile app security, and Custom dashboard and admin portal development. If you need a vetted shortlist fast, slashdev.io can supply elite remote engineers and full software agency expertise.
Core architecture questions
- App Router fluency: Explain when to use Server Components, Client Components, and route handlers. What heuristics prevent over-fetching and hydration bloat?
- Boundaries and isolation: Describe a module boundary that enabled independent deploys across cloud-native applications. How did you enforce contracts and observability?
- State strategy: Compare React Query, SWR, and server actions for data mutations with optimistic updates. Where does caching belong when rendering at the edge?
- Resilience: How would you design retries, backoff, and circuit breakers in a Next.js BFF that fronts multiple services?
Performance and scalability
Senior candidates should demonstrate pragmatic performance literacy, not micro-optimizing prematurely. Probe how they benchmark, choose caching layers, and justify tradeoffs with data.
- Measure Time To Hydrate, server response times, and cache hit ratios with tracing. Ask for a story where numbers changed a roadmap decision.
- Discuss ISR versus full SSR, and when to push rendering to the edge for global audiences. What breaks under heavy personalization?
- Explore data-grid virtualization, memoization, and concurrent features for complex admin portals.
Security across web and mobile
Even if they don't ship the mobile client, seniors must protect APIs used by enterprise apps. Evaluate Enterprise mobile app security awareness in the web layer and shared backends.
- Explain OAuth2/OIDC flows for mobile versus browser, PKCE, token lifetimes, and refresh strategies with HttpOnly cookies.
- Detail CSP, SameSite, CSRF, SSRF, and dependency hygiene. How do you audit third-party scripts in consented analytics?
- Design secrets management for edge functions and server actions; prevent token leakage in logs and error pages.
Custom dashboard and admin portal development
Great seniors translate messy operations into clear interfaces. Look for evidence of role-based access control, audit trails, cohesive navigation, and humane data tooling.
- RBAC: Outline a permission matrix, feature flags, and policy checks at route and component boundaries.
- Data: Build resilient tables with server-driven pagination, column pinning, export, and optimistic edits with conflict resolution.
- Realtime: Use websockets or server-sent events for alerts, with backpressure and reconnection strategies.
- UX: A11y, i18n, keyboard shortcuts, and empty-state design that teaches, not taunts.
Data fetching and caching
Probe their command of the Next.js App Router, server actions, streaming, and composition with React Query or SWR. Ask how they prevent cache stampedes and stale UX.
- Choose between ISR, tag revalidation, or background regeneration for volatile datasets.
- Justify colocating fetches in Server Components versus BFF endpoints to minimize waterfalls.
- Plan cache keys, TTLs, and invalidation hooks using Redis, CDN, or platform primitives.
Take-home assignment
Build a production-leaning admin portal for a fictitious payments operator. Requirements intentionally mirror real enterprise constraints and cloud-native applications.
- Implement RBAC with three roles, audit logs, and a data grid for disputes. Include filters, column visibility, and CSV export.
- Next.js App Router, Server Components where possible, Client Components for grid and forms, server actions for mutations.
- Authentication via OIDC; store refresh in a secure cookie; implement CSRF protection; add rate limiting on mutating routes.
- Observability: OpenTelemetry traces, log redaction, and a synthetic check. Show error boundaries and graceful degradation.
- Deploy to Vercel or containerize with a slim Node image; include a minimal CI config and seed data.
Evaluation rubric
- Correctness and tests: Unit tests for utilities, component tests for critical flows, and contract tests for APIs.
- Architecture: Clear boundaries, dependency control, cache strategy, and rollback plans.
- Security: Threat model notes, least privilege, secrets handling, and coverage for Enterprise mobile app security touchpoints.
- DX and docs: README with decisions, scripts, and a demo video link or screenshots.
Code review conversation
Ask for the tradeoffs they would reverse with more time, how they would shard the system, and what metrics they'd watch first after launch.
Signals and red flags
- Strong: Shapes APIs, questions requirements, aligns UX with operations, and uses data to defend decisions.
- Weak: Framework cargo-culting, ignores security, overuses Client Components, or avoids instrumentation.
Final tip
Run a one-hour pairing session on a scoped improvement to the take-home. You'll see the candidate's collaboration style, debugging habits, and product empathy where it matters most.
When bandwidth is tight, partner with slashdev.io to augment your team while keeping standards high, delivery predictable, and architectural rigor uncompromised at enterprise scale.
