System Administrator interview loops

A system administrator, or sysadmin, is responsible for an organization's servers and the services that run on them: setting them up, keeping them updated and working, managing the accounts people sign in with, and making sure that what is backed up can be restored. As of October 2026, NIST's NICE Framework, which sets out the tasks and skills of cybersecurity work, describes its Systems Administration work role in much the same terms and adds putting security controls in place. Postings read the same month also write the title systems administrator; some add a platform to it, as with Windows, and some put the platform in its place, as with a Linux administrator.

As of October 2026 the title covers three settings. In a small IT team it is a generalist's job: a LangChain posting puts its IT systems administrator among the first members of the company's IT team, automating the work as well as administering the company's software-as-a-service applications and the access to them (LangChain). At a managed service provider it is many clients' systems at once: a posting from Intelligent Technical Solutions, a managed IT services firm, has its system administrator resolving anything from a printer to a server for clients on site and remotely, taking turns on call, and measured in part by the hours logged against client tickets (Intelligent Technical Solutions). In the public sector, a Government Accountability Office posting for an IT specialist (SYSADMIN), in federal job series 2210, places its administrator in an enterprise infrastructure division, looking after physical and virtual servers, Windows and Linux among them, and the storage and backups behind them, together with other federal staff and contractors (GAO). The loop below is written for the first setting, in a team that runs its own servers as well as its applications: two to six people looking after Windows and Linux machines, an on-premises directory synchronized with a cloud identity service, and backups with a copy offsite.

The job is judged mostly on things nobody sees: a patch night nobody noticed, a restore that worked the first time it was needed, an account that stopped working on the evening its owner left. This role covers systems and the identities that use them. Switching, routing, firewalls and wireless belong to network administration, and cloud architecture and delivery pipelines to other roles.

Most failures in this job are not a single dramatic mistake. They are something configured years ago and reported as healthy ever since: a backup job that never included the data disk, a script that matched on a surname, a build note that switched off time synchronization, a deny entry nobody remembers adding. Interviews for the role drift towards what is easy to ask — port numbers, command flags, the difference between RAID levels — and a candidate can answer all of it from a revision sheet while being unable to read a backup report. So every round here puts evidence on the table, the kind a working administrator reads every week — event log excerpts, a patch plan, a backup report, a script and its run log — and scores what the candidate finds in it, and what they decline to do.

Employers hiring for IT roles draw the line on AI in the interview in different places. A Coder posting for an IT generalist allows AI on take-home work, if the candidate says where they used it, and not in the interviews that are conversations (Coder), while a 1Password posting for a staff IT engineer is happy for candidates to use it while applying but wants the live interviews done without it (1Password), both as of October 2026. None of the plans below says either way. Of the loop's four rounds, only the backup review sends material ahead: its backup report and setup notes go out the day before, and two of its four sections score what the candidate finds in them — a 600 GB data disk that was never in the job, six months of warnings from the database server, a backup service account in Domain Admins, an offsite copy the backup software can delete. An assistant given that pack overnight could find them first, so allowing one on it changes what the round measures. The loop's other three rounds hand their evidence over in the room, on paper, and the scripting round's rewrite is done on a laptop or on paper, where an assistant could write much of the lookup and loop the plan scores. So decide before the backup pack goes out, and tell the candidate which rounds, and which material, an assistant may be used on.

A loop is a set of round plans in order. Each round scores one to three competencies, every must-have is scored in at least two rounds, and the debrief goes competency by competency rather than interviewer by interviewer, so no single interview decides the hire. How these plans work covers the rest of the method.

Further reading, as of October 2026. Limoncelli, Hogan and Chalup's The Practice of System and Network Administration (Volume 1, 3rd edition, Addison-Wesley, 2016) is a book-length treatment of the job; its chapter on debugging has a section on fixing the cause rather than the symptom, and another chapter is on fixing things once, the kind of fix the scenario round credits beyond each ticket, such as changing the account conversion that left a contractor group behind and the build note that switched off time synchronization. NIST's Guide to Enterprise Patch Management Planning (SP 800-40 Rev. 4, April 2022) treats routine patching, which it warns is easily put off, and emergency patching, such as for a vulnerability under active attack, as separate plans, and suggests patching a small group of systems before the rest; the patch-night change review credits a first ring whose results decide whether the rest of the night goes ahead, and the scenario round's fourth sheet is the emergency. CISA's #StopRansomware Guide (October 2023, written with MS-ISAC, the NSA and the FBI) asks for backups that are kept offline and tested, and for cloud storage that object lock protects from deletion and that keeps earlier versions; the backup review gives an attacker a domain admin account and asks which copies would still exist on Monday, when its cloud bucket has neither. Microsoft's page on revoking a user's access in Microsoft Entra ID (updated June 2026) has an administrator disable the account, reset its password twice to random values and revoke its sessions, and recommends removing the user from applications that keep their own sessions or let people sign in without the directory; the offboarding script round has a script whose session revocation failed while its log said it had worked, and a payroll portal with passwords of its own.