Quality Engineering

Shift-left = move testing activities earlier in SDLC. Find bugs when they're cheapest to fix (in design/planning stage costs 1x; in production costs 100x).

• Requirements ReviewQA participates in requirement writing — identify testability issues, ambiguities, missing edge cases BEFORE sprint planning. Saves rework later. "This requirement can't be tested as written."
• Design ReviewQA reviews system design documents, API contracts, DB schemas. Identify: untestable designs, missing error states, performance risks. Ask "how will we test this?"
• 3 Amigos / RefinementBA + Dev + QA discuss stories before sprint starts. QA's questions define acceptance criteria and catch gaps. "What happens when the user is offline?" before a line of code is written.
• Test-Driven Development SupportQA provides test scenarios for dev to write unit tests against. Test cases written before feature code. Ensures testability is designed in.
• Pair TestingQA pairs with dev during feature development — catches issues before formal testing. Not full QA cycle, but quick sanity. Builds shared understanding.
• Static Analysis ReviewQA understands and references linting, SAST (static application security testing) results. Not writing the tools, but consuming and acting on results.

Shift-right = testing activities IN and AFTER production. Real users, real data, real conditions.

• Production MonitoringQA defines alerts for error rate spikes, performance degradation, specific user flows. "Alert when checkout error rate > 2% for 5 minutes." Own the quality signals in production.
• Feature Flags TestingTest features enabled only for subset of users (10% rollout). QA designs test plan for: flag-off behavior, flag-on behavior, transition between states. Validate rollout metrics.
• Canary DeploymentsNew version deployed to 5% of traffic first. QA monitors: error rate, latency, business metrics vs control group. Define criteria for "canary is healthy" and "canary is failing."
• A/B Test ValidationVerify both variants function correctly. Verify metric tracking is accurate. Ensure statistical significance before declaring winner. QA role in experimentation platform.
• Chaos EngineeringIntentionally inject failures (kill pod, slow network) to verify system resilience. QA defines expected behaviors during chaos: graceful degradation, error messages, recovery time.

Observability = ability to understand internal system state from external outputs. 3 pillars:

• LogsStructured logs (JSON) cho every significant event. QA uses logs để: investigate bugs, find root cause, verify feature behavior. Key: logs phải include correlation ID để trace request qua services.
• MetricsAggregated numbers: request rate, error rate, latency (RED method). QA monitors: error rate by endpoint, error rate by user segment, conversion rate. Alert on deviations from baseline.
• Distributed TracingTrack single request across multiple services. Tools: Jaeger, Zipkin, Datadog APM. QA uses: "Why did this checkout take 8 seconds? Which service was slow?" without reading logs of 5 services.

QA-specific monitoring signals:

• Checkout conversion rate — drop ≥ 5% → flag immediately
• Login success rate — drop → auth issue or external attack
• API 5xx rate by endpoint — spike = likely bug in last deployment
• Page load time — Lighthouse CI run nightly, alert if LCP regresses
• JavaScript errors in production — Sentry/Datadog Real User Monitoring

• Shared responsibility: In DevOps culture, quality is everyone's responsibility — not just QA. QE helps dev own quality through tooling, practices, and culture.
• Infrastructure as Code awareness: QA doesn't write Terraform, but understands: what environments exist, how they're provisioned, how to request environment changes. Reduces "it only happens on production" mysteries.
• Container basics: QA knows docker-compose để spin up local test environment. Understands container logs, exec into containers to debug.
• Cloud fundamentals: Know what S3/GCS is (file storage), what RDS is (managed DB), what Lambda/Cloud Functions are (serverless). Not deep knowledge, but enough to understand architecture and failure modes.
• Incident response: QA participates in incident review (post-mortem). Identify: what test would have caught this? Update test suite. Build incident prevention into testing practice.

• Mentoring Junior QAWeekly 1:1s: review their test cases, give feedback on bug reports, pair test on complex features. Teach "why" not just "what." Goal: make them independent, not dependent on you.
• Code Review for Test CodeReview automation code: locator choices, assertion quality, test data management, readability. Same rigor as production code review. Test code maintenance is real work.
• Knowledge DocumentationWrite internal guides: "How to test payment feature," "Common failure patterns in our app," "Testing checklist for new team members." Institutional knowledge → searchable docs.
• RetrospectivesFacilitate QA retrospectives: what bugs slipped through? What process changes would prevent them? Focus on system improvement, not individual blame.
• Cross-functional InfluenceSenior QA influences design decisions: "This API design is hard to test — can we add this field to the response?" Advocate for testability, observability, and quality at every planning meeting.

Alternative paths from Senior QA:

• SDET (Software Dev Engineer in Test): Heavy coding focus. Write test frameworks from scratch. High demand, high salary.
• QE Platform Engineer: Build internal testing tools and infrastructure used by all engineers. DevOps/SRE crossover.
• Product Manager: Deep domain knowledge from testing → great product intuition. Common transition.
• Security Engineer: Specialize in security testing → penetration testing → AppSec engineer.
• Developer: Some QAs transition to dev, especially those with automation background.

• AI-Assisted TestingGitHub Copilot generates test code. AI tools suggest test cases from requirements. LLMs analyze bug reports and suggest root causes. QA role shifts: from writing tests to reviewing AI-generated tests, from executing to orchestrating.
• Visual AI TestingApplitools, Percy with AI: detect meaningful visual changes (not pixel differences). Reduce false positives in visual regression. AI learns what "correct" looks like.
• Autonomous TestingTools that crawl apps and generate their own test cases (testRigor, Functionize). Currently limited — best for simple flows. Human judgment still critical for complex business logic.
• Shift to PreventionLess "find bugs" more "prevent bugs": design reviews, code analysis, architectural testing, contracts. QE mindset becoming mainstream. Static analysis + AI code review reduces defects before testing phase.
• Skills to Develop NowPrompt engineering for testing tasks, understanding LLM limitations, infrastructure knowledge, data engineering basics (test data at scale), MLOps testing (AI model testing). QA who upskill → more valuable, not replaced.