Tell me about a time you took a concern past your manager to someone more senior.

At a security startup I led the campaign-data side of a phishing-simulation product. I found that recipient records — real employee names and addresses pulled from customer directories — were being retained far past the thirty-day window we had promised those customers in our contracts. Roughly three hundred and forty thousand rows, going back nineteen months. I took it to my manager first, with the query and the row count. He wanted to hold it until after a funding milestone six weeks out, and his reasoning was not stupid — the fix touched the pipeline that produced every customer report. I understood it and still thought it was wrong. So I told him exactly what I intended to do rather than doing it quietly. I said: I want to put this in front of our security lead this week, I would rather we walk in together, and I will say the same things in that room that I have said to you. He came with me. The decision took about fifteen minutes. We shipped the purge job nine days later, and retention has been enforced in code since, not in a policy page. The relationship survived because there was no surprise — he was never told about his own area by somebody else. If I had gone around him I would have won the argument and lost the person I need for the next ten arguments.

As the staff engineer on platform at a security startup, the risk I carried was that every customer's simulated phishing went out through one shared sending reputation. One tenant's employees marking simulations as spam could get that domain throttled for all forty-one accounts, and when delivery degrades the click-rate numbers customers are actually buying stop meaning anything. My director's read was that the rework was a two-quarter project we could not afford before a raise. I did not think he was wrong about the money. I thought he was wrong about the odds. So I did three things. I gave him a written brief with the deliverability trend — our complaint rate had climbed from 0.04% to 0.31% across seven months, and providers begin throttling near that level. I told him I believed this needed to be in front of the executive staff, and asked whether he wanted to present it or whether I should with him in the room. He chose to present it and asked me to write it. And I shrank the ask: not the two-quarter rework, but per-tenant subdomains for the eleven noisiest accounts, about five weeks of work. That got funded. The durable outcome is the monthly deliverability review we started, which is where these calls are made now instead of inside one person's head. I handed it off after the third session.