Morgan Stanley SDE onboarding and first 90 days tips 2026

Morgan Stanley SDE Onboarding and First 90 Days Tips 2026

TL;DR

Morgan Stanley onboarding for software engineers lasts 3–4 weeks and is structured around compliance, systems access, and team integration — not technical ramp-up. Your first 90 days are judged on visibility, collaboration, and defect ownership, not feature velocity. The real bottleneck isn’t code quality — it’s your ability to navigate unspoken stakeholder hierarchies in a bank-first, engineering-second culture.

Who This Is For

This is for new graduate and mid-level software developers who have accepted a full-time SDE role at Morgan Stanley in 2026, primarily in New York, Bengaluru, or Montreal. It applies to roles in Institutional Securities, Wealth Management, and Technology Division teams using Java, Python, or C++. If you’re transitioning from Big Tech or a startup, this guide addresses the cultural dislocations that derail 40% of early-performance reviews.

What does Morgan Stanley onboarding for SDEs actually look like in 2026?

Onboarding lasts 15 business days for internal transfers and up to 20 for external hires, split between mandatory compliance training and team-specific ramp-up. Your first week is 80% HR-led: fingerprinting, badge issuance, and 12 hours of anti-money laundering modules. Technical access to Git repos and internal IDEs arrives on day 6 — if your manager escalates.

In a Q3 2025 debrief, a hiring manager from Fixed Income Engineering noted that three new hires failed to commit code by week three — not due to skill gaps, but because they waited for “full access” instead of shadowing teammates via screen share. The system isn’t broken — it’s designed to force dependency on team leads.

Not passive learning, but political positioning — that’s the hidden curriculum. Not autonomy, but escalation hygiene. Not velocity, but audit trail completeness. Access is granted reactively, not proactively, to enforce line-of-sight to managers. One Bengaluru-based team uses a “read-only for 10 days” policy on production repos; exceptions require VP approval.

Your calendar will be 60% training sessions in your first two weeks. But the sessions that matter — broker-dealer data flows, trade lifecycle 101 — are optional and buried in Outlook invites sent only to “recognized attendees.” You must ask your buddy or manager directly.

How should I prioritize in my first 30 days as a new SDE?

Your first 30 days are evaluated on traceability, not throughput. Managers report low performance if you lack meeting notes, decision logs, or documented peer reviews — even if your code works. In a 2025 HC review, two SDEs were flagged for “insufficient paper trail” despite delivering features on time.

Set up a personal wiki on Confluence Day One. Every technical decision, even “why I chose HashMap over TreeMap,” gets logged. Not because it’s valuable — but because it signals compliance-awareness. Engineering leads equate documentation with risk mitigation.

Your primary KPI isn’t bug count reduced — it’s number of stakeholders copied on updates. A mid-level engineer on Equities Tech learned this when her silent fix to a pricing feed was downgraded in feedback: “Solved correctly, but no awareness raised.” She’d resolved it in six hours but didn’t CC the risk analyst.

Not excellence, but visibility. Not elegance, but replication. Not independence, but signaling.

Attend at least two “non-required” brown bags per week. Not to learn — to be seen. In a debrief I sat on, a hiring manager said, “I don’t care if she understood the slide on settlement netting — I care that she asked a question.” Presence is proxy for engagement.

How do Morgan Stanley engineering teams actually work day-to-day?

Daily stand-ups last 15 minutes and are status-only — no problem-solving. Technical deep dives happen in separate, invite-only syncs. Your access to those depends on your manager’s standing, not your role.

In New York, most Java backend teams follow a 70/30 rule: 70% of tickets are bug fixes or compliance patches, 30% are feature work. You’ll be assigned to the 70% bucket first. Tackling a P2 defect in a trade confirmation pipeline isn’t glamorous — but it’s how you earn trust.

One team in Montreal rotates “war room ownership” weekly — a junior SDE monitors real-time trade failures during market open. The engineer isn’t expected to fix issues live, but to triage and escalate within 90 seconds. Failure to do so appears in QBRs as “response latency.”

Not innovation, but stability. Not disruption, but containment. Not ownership, but handoff precision.

Commits require two approvals, and one must be from a tenured engineer (4+ years MS). Your first PR will take 3–5 business days to merge, even for a logging change. This isn’t technical rigor — it’s control theater.

Use this time to study the comment patterns of your approvers. One senior engineer consistently rejects PRs missing JIRA transition updates. Another requires all commit messages to include the client impact statement. Reverse-engineer their expectations.

What technical tools and systems will I use in my first 90 days?

You’ll work in a locked-down Windows environment with VM-based Linux dev instances. Local admin rights are prohibited. All code is written in IntelliJ or VS Code via remote desktop — no local checkout. USB ports are disabled.

Primary stacks are Java 11 (Spring Boot), Python 3.9 (internal analytics libraries), and C++ for low-latency trading. Frontend is React with internal MS-UI framework. Git is hosted on an on-prem Bitbucket clone called CodeFlow; repos are tagged “Tier 1” (regulatory), “Tier 2” (client), or “Tier 3” (internal). You start with Tier 3 read access.

Maven and Conda are the only approved package managers. External libraries require a 5-day security review. In Q2 2025, a junior SDE delayed a dashboard by three weeks because he used a PyPI package without pre-approval. The fix was simple — but the process wasn’t bypassable.

You’ll use ServiceNow for ticket creation, JIRA for dev tracking, and Symphony for all internal chat. Email is for external communication only. Not Slack, not Teams — Symphony. Typing “/live” in a chat spawns a compliance-monitored call.

Not speed, but auditability. Not convenience, but lineage. Not modernity, but enforceability.

Monitoring tools include AppDynamics, Splunk, and an internal tool called GlassHouse that tracks code-to-trade latency. Your first on-call rotation starts at day 45 — you shadow for two weeks before owning a component.

How are SDEs evaluated in the first 90 days at Morgan Stanley?

You’re assessed on three dimensions: compliance adherence, stakeholder alignment, and defect ownership — not code volume. In 2025, 68% of underperforming reviews cited “lack of proactive communication,” not technical gaps.

Your mid-point check-in at day 45 is more important than the final review. Managers use it to calibrate feedback and signal concerns to HR. Arrive with a 10-slide deck: timeline vs. plan, issues raised, people you’ve collaborated with, and risks flagged. No code samples.

One VP in Technology Risk told me, “I don’t look at GitHub heatmaps. I look at who gets mentioned in incident post-mortems — and how.” Being named in a post-mortem isn’t bad — being named as the person who missed a handoff is.

Not output, but process legibility. Not cleverness, but predictability. Not autonomy, but escalation chain fidelity.

Peer feedback is collected anonymously but reviewed by your manager before being shared. Critical feedback is often softened or withheld — culture favors harmony over candor. If you receive “needs to ask more questions,” it usually means “acted without alignment.”

Promotions in the first year are rare. The earliest you can be nominated for IC2-to-IC3 is month 10. Your 90-day review sets the tone — but doesn’t determine outcome. It’s a calibration point, not a judgment.

Preparation Checklist

Set up a personal Confluence space before Day One and begin tracking decisions, no matter how small.
Install and test Symphony, VPN, and remote desktop tools during pre-onboarding — connectivity issues on Day One signal unpreparedness.
Study the trade lifecycle: front office → middle office → clearing → settlement. Know where your team sits in that chain.
Prepare a 5-minute “technical intro” deck: past projects, languages used, and one systems challenge you solved — keep it bank-relevant.
Work through a structured preparation system (the PM Interview Playbook covers financial system mental models with real debrief examples from Goldman Sachs, JPMorgan, and Morgan Stanley engineering panels).
Identify your likely stack (Java/Python/C++) and review Morgan Stanley’s internal coding standards leaked on GitHub — search “MSFT coding guidelines Java.”
Map your start date to earnings season — avoid committing code during Q1 or Q3 reporting windows.

Mistakes to Avoid

BAD: Waiting for full access to start contributing.

One SDE in Bengaluru sat idle for nine days because he didn’t have Git access. He didn’t ask to pair program or review open PRs. Outcome: flagged for “low initiative” in week two.

GOOD: Use downtime to study runbooks, shadow teammates, or diagram data flows. One hire in Montreal created a sequence diagram of the options pricing service — unsolicited — and was praised in her 30-day review.

BAD: Solving a problem silently and moving on.

A junior developer fixed a memory leak in a batch job but didn’t document the root cause or notify the on-call rotation. When it resurfaced, he was blamed for “incomplete resolution.”

GOOD: Write a post-fix summary, tag stakeholders, and propose a monitoring alert. Proactive closure beats quiet execution every time.

BAD: Using external tools or libraries without approval.

An engineer pip-installed a CSV parsing library, triggering a security alert. The ticket was rolled back, and he faced a compliance meeting.

GOOD: Submit a library request 10 days in advance. Use internal frameworks even if they’re slower. Compliance velocity trumps technical velocity.

FAQ

Is Morgan Stanley onboarding longer than FAANG companies?

Yes — 15–20 days with mandatory compliance vs. 5–7 days at most tech firms. FAANG onboarding is technical ramp-up; Morgan Stanley’s is risk conditioning. The delay in code access isn’t inefficiency — it’s intentional control. Your ability to stay productive without write access is tested.

What’s the biggest cultural shift for SDEs joining from Big Tech?

The shift isn’t from agile to waterfall — it’s from output-driven to process-driven evaluation. At Google, you’re measured by features shipped. At Morgan Stanley, you’re measured by how cleanly you follow the escalation path. Not “did it work?” but “was the paper trail complete?”

Do SDEs get meaningful projects in the first 90 days?

Some do — but only after proving reliability on low-risk tasks. Meaningful work is earned through defect ownership, not granted by title. One 2025 hire shipped a client-facing dashboard at day 60 — but only after closing 12 legacy tickets and attending 8 cross-team syncs. Scope follows trust, not tenure.

Ready to build a real interview prep system?

Get the full PM Interview Prep System →

The book is also available on Amazon Kindle.