IAM Risk Audit (CIAM) - Lead
Posted Jul 22, 2026 · We last checked this listing on Oct 6, 2026
Likely interview questions for this role
Written from this job description, not a generic list. Each one notes what the interviewer is really checking.
About your past
Tell me about a time an audit finding landed on a control you were responsible for. What did you do in the first week?
What they are checking: How they take ownership under scrutiny and turn a finding into a credible remediation plan without getting defensive.
Describe a process improvement you led in an IAM or controls environment. How did you measure that it worked?
What they are checking: Evidence they can deliver lasting change and prove it with numbers, not just describe good intentions.
You partner with engineering, risk, internal audit and compliance. Tell me about a time those groups disagreed on how serious an issue was.
What they are checking: Whether they can broker a shared view of risk across functions with different incentives and still keep work moving.
What would you do
Internal audit tells you they'll start fieldwork on privileged access in six weeks. Walk me through how you get the IAM teams audit ready in that window.
What they are checking: Whether they can organize evidence, owners and known gaps before auditors arrive rather than reacting during fieldwork.
An engineering team says a remediation date can't be met because the fix needs a platform upgrade. How do you handle that with audit and risk?
What they are checking: Balancing honest date changes with compensating controls, so regulators see managed risk instead of a missed commitment.
Access reviews keep coming back with managers rubber-stamping approvals. How would you fix that?
What they are checking: Whether they see certification fatigue as a design problem and can improve review quality, not just completion rates.
A regulator asks for evidence that terminated employees lost access within policy timelines. What would you pull, and how would you check it first?
What they are checking: Care with evidence quality, since handing over untested data to an examiner can create a new finding.
About the work
What are the key controls you'd expect to see in a mature Identity Governance and Administration program, and which ones fail most often?
What they are checking: Real working knowledge of joiner, mover, leaver and certification controls, plus a realistic sense of where they break.
How would you design control monitoring for Privileged Access Management so you find problems before an examiner does?
What they are checking: Whether they think in continuous, data-driven checks instead of relying on annual testing to surface PAM weaknesses.
What IAM risk metrics would you put in front of senior management, and what would you leave out?
What they are checking: Judgment about reporting that drives decisions, separating meaningful risk indicators from noise that only fills slides.
How do orphaned accounts and service accounts usually slip through IAM controls, and how would you close that gap?
What they are checking: Familiarity with non-human identities and lifecycle gaps that commonly cause audit findings at banks.
Practice this interview out loud.
Offer builds a real interview for this exact role at Northern Trust from your resume and this job description, asks the questions one at a time, and tells you what landed. The first one is free.
Practice this out loudThe full job description
As published by Northern Trust.