Cybersecurity Interview questions

Identity & Access Management Engineer interview questions

These IAM Engineer interview questions come from our vetting, where 3.4% of applicants pass 5 gates. You get 20 questions with answer hints, a task, red flags and a scorecard.

Updated: October 2026Remote Pro Ai · Cybersecurity20 questions

Build my squad

How we assess

Every applicant goes through 5 gates: application, an AI-assisted screen, a live technical assessment scored by a practice lead, a client-fit interview, and reference and credential checks. The questions below come from the live assessment. We score answers on reasoning and trade-offs, not on recalling definitions.

20 technical questions with model-answer hints

Questions 1–⁠10 (role-specific)

  1. SAML or OIDC for a new application?

    Model-answer hint

    OIDC for modern apps and APIs, SAML for legacy enterprise apps; explain tokens and flows.

  2. How do you roll out conditional access without locking people out?

    Model-answer hint

    report-only mode, break-glass accounts, phased rollout, risk signals.

  3. Walk through a passwordless rollout.

    Model-answer hint

    FIDO2 and passkeys, device readiness, recovery flows, communication, adoption metrics.

  4. How do you automate joiner-mover-leaver?

    Model-answer hint

    HR as source of truth, role models, SCIM provisioning, approval workflows.

  5. What is segregation of duties, and how do you enforce it?

    Model-answer hint

    defined toxic combinations, preventive checks at request, detective reviews.

  6. How do you bring service accounts under control?

    Model-answer hint

    inventory, owners, vaulting, rotation, replacement with workload identity.

  7. What should PAM cover beyond password vaulting?

    Model-answer hint

    session recording, just-in-time access, approvals, endpoint privilege management.

  8. How do you give an AI agent access to user data safely?

    Model-answer hint

    delegated scoped tokens, consent, short lifetimes, per-action audit.

  9. What are the main risks in B2B federation?

    Model-answer hint

    trust scope, partner offboarding, attribute mapping, monitoring.

  10. How do you measure an IAM programme?

    Model-answer hint

    MFA coverage, orphaned accounts, review completion, time to provision.

Questions 11–⁠20 (Cybersecurity core)

  1. Map a control you implemented to NCA ECC-2:2024 or ISO 27001.

    Model-answer hint

    control reference, implementation, evidence produced, how effectiveness was tested.

  2. Walk through a ransomware intrusion using MITRE ATT&CK.

    Model-answer hint

    initial access to impact, with a detection or control at each stage.

  3. How do you prioritise 5,000 open vulnerabilities?

    Model-answer hint

    known exploitation, asset criticality, exposure, compensating controls, SLA tiers.

  4. Which logs do you need to investigate a compromised cloud identity?

    Model-answer hint

    sign-in, token issuance, control-plane audit, resource access and network flow logs.

  5. Explain zero trust to a CFO in 2 minutes.

    Model-answer hint

    no trust by network location; verify identity, device and context per request; frame as business risk.

  6. How do you write a detection that is useful, not noisy?

    Model-answer hint

    clear hypothesis, right data source, baseline tuning, emulation testing, documented triage steps.

  7. What do you do in the first hour of a suspected breach?

    Model-answer hint

    preserve evidence, contain, follow the playbook, start the regulatory clock, control communications.

  8. How do you protect secrets across CI/CD, cloud and laptops?

    Model-answer hint

    central vault, short-lived credentials, OIDC federation, secret scanning, rotation.

  9. How does SAMA CSF differ from ISO 27001 in practice?

    Model-answer hint

    sector regulator and maturity scoring versus a certifiable management system; large control overlap.

  10. Describe a security fix you won despite pushback.

    Model-answer hint

    quantified risk, business framing, agreed compromise, verified closure.

Interviewer tip: Ask for a real example after every answer. Strong candidates describe what they built, what broke and what they changed.

Practical task

Design the target identity architecture for a bank with 6,000 staff and 2 million app users: workforce SSO and MFA, customer login with Nafath, PAM for 300 administrators and service-account remediation, plus a 6-month rollout plan.

How to run it Share the brief 24 hours ahead or run it live. Ask the candidate to talk through trade-offs as they work; reasoning matters more than a finished artefact.

Red flags our practice leads watch for

  • Cannot separate authentication flows from authorisation decisions.
  • Ignores machine identities entirely.
  • Plans an MFA rollout with no recovery or break-glass path.
  • Treats access reviews as a spreadsheet exercise.
  • Universal flag: Vague answers that never reach a concrete system, number or decision the candidate personally owned.

The scorecard we use

Score each dimension 1–⁠4 (1 = no evidence, 2 = partial, 3 = solid, 4 = exceptional):

DimensionWeightWhat a 4 looks like
Technical depth, production judgement and security40%Explains how and why, designs for failure and sensitive data, and knows each tool’s limits
Practical task and problem solving30%Delivers a working solution with tests and documented decisions
Communication and documentation20%Explains clearly to technical and non-technical audiences, in English or Arabic
References and regional context10%References confirm the claimed scope; knows the frameworks and data-residency rules that apply

Pass bar: weighted average of 3.0 out of 4 or higher, with no dimension below 2. The practice lead approves the final result.

Skip the interview loop

Every specialist on our shortlist has already passed this assessment. Working in 4 working days.

Frequently asked questions

Yes. The questions, hints, practical task and scorecard are free to use. They work best when every interviewer scores the same dimensions independently and compares notes afterwards. Ask for a concrete example after each answer, because recalled definitions say little about how someone performs on a live system.

They come from the same live technical assessment, but practice leads rotate and adapt questions so candidates cannot rehearse them. What stays fixed is the scope being tested, the practical task format and the scorecard, which is why the published version is safe to share.

Plan for a technical conversation covering 8 to 10 of the questions, plus the practical task either live or as a short take-home. Use the remaining questions as follow-ups. If you would rather skip the loop, Remote Pro Ai shortlists already-assessed specialists within 48 hours.

Our pass bar is a weighted average of 3.0 out of 4 or higher across the 4 dimensions, with no dimension below 2. Production judgement and security, scored inside the 40% technical dimension, often separate strong candidates from those who interview well but struggle once they own a live system.

The task mirrors the first week of real work in this role and never uses client data. It runs live or as a short take-home of a few hours, and the candidate then explains the trade-offs behind each decision. Reasoning and production habits count for more than a polished final artefact.