Information Security Engineer interview question
How do you design identity and access management?
Centralize identity, require strong authentication, use short-lived credentials and least-privilege role or attribute policies, separate duties, automate joiner-mover-leaver lifecycle, protect privileged access, audit and recertify.
Direct answer
What a strong answer covers
How it works
IAM design centralises identity in one provider so there is one place to enforce strong authentication with phishing-resistant factors and one place to disable a person. Access is granted through roles or attributes mapped to job functions rather than to individuals, with least privilege and separation of duties so no single identity can both request and approve. Credentials are short-lived, issued on demand, and never shared; privileged access goes through a broker with approval, session recording, and time limits. The joiner-mover-leaver lifecycle is automated from the HR system, every access decision is logged, and entitlements are recertified by their owners on a schedule with unused ones removed.
Example
An organisation moved all applications behind an identity provider with passkeys and device posture checks; engineers get production access through a broker that grants a role for four hours after a ticket-linked approval and records the session. When someone changes team, the HR feed updates their groups the same day, and quarterly recertification sent each manager the list of their reports’ entitlements, which removed 30 percent of standing access in the first cycle.
Common mistakes
- Managing access per application with local accounts that survive offboarding.
- Granting permanent administrator rights because requesting them is slow.
- Skipping recertification so access only ever grows.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.