Capstone: Mock Loop & Self-Exam

Cursor's first technical screen hands you a real automation problem and a clock. The IT Systems Engineer role is software engineering applied to IT, so the interviewer is watching whether you reach for code by default and whether that code is safe to run against a production tenant.

Set a 45-minute timer and solve the canonical IT scripting problem out loud, exactly as you would on the call. The prompt below is the one this role gets asked in some shape every time, because it touches identity lifecycle, API hygiene and the blast radiusHow much breaks if a change goes wrong; the scope of potential damage. of getting deactivation wrong.

The four constraints they gradeNon-negotiable for this role

Notice the safety asymmetry. A missed deactivation leaves a stale account for a day until the next run catches it. A false deactivation locks an active employee out of everything mid-sprint. So your default has to fail toward not acting: dry-run unless told otherwise and a guardrail that refuses to deactivate more than a sane fraction of the directory in one pass.

import os, sys, time, logging, requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("jml-reconcile")

OKTA_URL = os.environ["OKTA_URL"]            # never hard-code
TOKEN = os.environ["OKTA_API_TOKEN"]         # from env / secret manager
HEADERS = {"Authorization": f"SSWS {TOKEN}", "Accept": "application/json"}
MAX_DEACTIVATE_RATIO = 0.10                  # refuse a runaway purge

def get_paged(url):
    while url:
        r = requests.get(url, headers=HEADERS, timeout=30)
        if r.status_code == 429:             # respect rate limits
            wait = int(r.headers.get("Retry-After", "5"))
            log.warning("rate limited, sleeping %ss", wait); time.sleep(wait); continue
        r.raise_for_status()
        yield from r.json()
        url = r.links.get("next", {}).get("url")   # follow pagination

def active_hris_emails(path):
    import csv
    with open(path) as f:
        return {row["work_email"].lower() for row in csv.DictReader(f)
                if row["status"].lower() == "active"}

def reconcile(hris_path, apply=False):
    truth = active_hris_emails(hris_path)
    idp_active = [u for u in get_paged(f"{OKTA_URL}/api/v1/users?filter=status eq \"ACTIVE\"")]
    orphans = [u for u in idp_active if u["profile"]["email"].lower() not in truth]

    if len(orphans) > len(idp_active) * MAX_DEACTIVATE_RATIO:
        log.error("guard tripped: %d/%d would deactivate - aborting, check the HRIS export",
                  len(orphans), len(idp_active)); sys.exit(2)

    for u in orphans:
        email = u["profile"]["email"]
        if not apply:
            log.info("DRY-RUN would deactivate %s (no active HRIS record)", email); continue
        resp = requests.post(f"{OKTA_URL}/api/v1/users/{u['id']}/lifecycle/deactivate",
                             headers=HEADERS, timeout=30)
        if resp.status_code in (200, 404):   # 404 = already gone => idempotent no-op
            log.info("deactivated %s", email)
        else:
            log.error("FAILED %s: %s %s", email, resp.status_code, resp.text)

    log.info("done: %d orphans, apply=%s", len(orphans), apply)

if __name__ == "__main__":
    reconcile(sys.argv[1], apply="--apply" in sys.argv)

Typing it perfectly is not the bar. The bar is that you can defend every line: why dry-run is the default, why the ratio guard exists, why a 404 on deactivate is success rather than failure. If you can't justify a line, you don't own it yet.

The 45-minute protocolRun it like the real screen

1. 10–5 min · Clarify the source of truth and the blast radiusHow much breaks if a change goes wrong; the scope of potential damage.. Is HRIS authoritative? What's the worst case if the export is stale? Are there service accounts to exclude? The answers shape every safeguard.
2. 25–10 min · State the plan and the failure mode out loud. Commit: “Pull active IdP users, diff against active HRIS emails, dry-run by default and abort if the diff is suspiciously large.”
3. 310–35 min · Write it with the safe default first. Pagination, env-based secrets, structured logs and the ratio guard before you write the deactivate call. Make the destructive path the one that needs an explicit flag.
4. 435–42 min · Test the happy path and the dangerous path. Run dry-run, then simulate a truncated HRIS export and confirm the guard trips instead of purging the company.
5. 542–45 min · Name what you'd add in prod. Idempotency you'd verify, a Slack notification on every apply and a scheduled run in CI with the secret injected, not stored.

Run the drill twice: once with AI assistance and once without. The first technical screen may bar AI tooling to test fundamentals, while the later work-trial expects fluent AI use. You want to be calm in both modes.

The second technical screen is a scenario round: design a system end-to-end with the trade-offs spoken. For this role the canonical prompt is the joiner/mover/leaver pipeline - automate onboarding and offboarding across the IdP, HRIS and downstream SaaS so access is instant, correct and audited.

Time-box it to 30 minutes and start by clarifying, not drawing. The interviewer is grading whether you find the source of truth, reason about drift and name failure modes before you commit to an architecture.

Clarify first - the questions that anchor the designSpend the first 3 minutes here

• What's authoritative for identity - the HRIS (Workday/Rippling) or a manual request? Everything downstream flows from that answer.
• What's the access model: static role-to-group mappings or dynamic groups derived from department and title attributes?
• How fast must offboarding be - same-minute on termination or end-of-day batch? That decides event-driven vs scheduled.
• Which apps support SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. and which only have a REST API or no API at all? The long tail of non-SCIM apps is where the design earns its keep.

The data flow, end to endSource of truth → IdP → SaaS + device

1. 1HRIS is the source of truth. A new hire, role change or termination in the HRIS is the trigger. Prefer a webhook for same-minute action, with a scheduled full reconciliation as the safety net that catches missed events.
2. 2IdP is the control plane. The HRIS event provisions or updates the user in Okta/Entra and assigns groups from role and department attributes. Group membership, not per-app clicks, is what grants access.
3. 3SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. pushes to downstream SaaS. Group assignment drives SCIM provisioning into Google Workspace, Slack, Zoom and the rest. Deprovisioning is the same path in reverse: remove from group, SCIM deactivates downstream.
4. 4MDM handles the device. A joiner triggers zero-touch enrollment (ABM/Autopilot) so the laptop arrives configured; a leaver triggers a remote lock or wipe and license reclaim.
5. 5Reconciliation closes drift. A scheduled job re-derives expected state from the HRIS and diffs it against every downstream system, alerting on or correcting accounts that drifted out of band.

The single highest-value idea to volunteer here is that the pipeline is a reconciliation loop, not a one-shot script. Events drift, webhooks get missed, an admin grants access by hand. A design that only reacts to events will silently rot; a design that periodically re-derives truth and corrects drift stays correct.

Hit every axis the rubric gradesSay these unprompted

Cursor's signature round is a paid work-trial - engineering roles get a real-project day and for IT/Systems it takes the form of a hands-on build: a runnable automation or a small self-service tool, plus the documentation a teammate would need to run it tomorrow.

The artifact matters, but the process is what's scored: how fast you scope, whether the thing actually runs, how visibly and competently you use AI tooling and whether you owned it end-to-end. Rehearse against a fixed time-box so the real day feels familiar.

Pick a build you can finish and demoRunnable over impressive

Whatever you pick, bias hard to shipping something that runs. A working tool with one rough edge beats a beautiful design that never executed. The work-trial is a proxy for the job and the job rewards people who deliver from week one.

The time-box protocolScope → build → document → demo

1. 1First 15% · Scope ruthlessly and write it down. State the one outcome you'll ship and the things you're explicitly cutting. “I'll deliver a working access-request command; I'm cutting the approval UI and hard-coding the approver for now.”
2. 2Build the thin vertical slice first. Get one end-to-end path working - request in, API call out, result back - before you polish anything. A demoable spine beats four half-features.
3. 3Use AI tooling visibly and well. Drive Cursor's agent to scaffold the boilerplate, then review and correct what it generates out loud. Showing judgment over AI output is the signal, not raw speed.
4. 4Write the runbook as you go. A short README: what it does, how to run it, the env vars it needs and the one thing that would break it. This is the “owned end-to-end” evidence.
5. 5Leave time to demo it running. End on a live run, not a code tour. Then narrate the two decisions you'd revisit with more time.

That sentence does three things at once: it shows fluent AI use, it shows you review AI output critically and it shows the security instinct this role demands. That's the texture the work-trial is built to surface.

Self-score the trialThree questions, honestly

The cross-functional and final rounds probe how you operate on a flat, talent-dense team. Run six rapid-fire behavioral prompts on yourself and score each story coldly, because a vague answer here sinks an otherwise strong loop.

Each story needs four parts: a clear situation, your specific action (not the team's), a quantified outcome and the value it demonstrates. If a story has no number, flag it now and go find one before the real loop.

The six prompts - one strong story eachMap each to a value this role screens for

Drill the AI-authenticity question hardest, because Cursor builds an AI code editor and there's an implicit bar that you genuinely use these tools daily. The weak answer is generic enthusiasm. The strong answer is a specific, recent example with a real artifact.

The 90-second “why Cursor / why this role”Tight, specific, no filler

1. 1Why this company. One genuine, specific reason - the AI-native culture, the chance to build IT as software at a hypergrowth company, the talent density. Not “I love your product.”
2. 2Why this role. You want to own identity and automation end-to-end and treat IT as engineering, which is exactly how this role is framed.
3. 3Why you, now. The one credential that proves you'll deliver from week one: a JML pipeline you built, a fleet you automated, a zero-trust rollout you led.

End the prep where the loop will test you: a cold self-assessment across every dimension, each gap mapped to the exact section to revisit and a 3-day plan to close what's left. The loop grades your floor, so a single weak axis is what sinks an otherwise strong candidate.

Treat the rubric as a gap finder, not a score to admire. Mark the weakest proof, turn it into one practice rep and keep the artifact you would show an interviewer.

Rate yourself 1–5 on each row below. Be honest - a 5 you can't defend in an interview is a 2. Anything under a 4 is a gap that gets a plan.

The readiness scorecardRate 1–5, then map each low score

Two things you must be able to produce on demandNon-negotiable artifacts

Pre-loop checklistTick all before you walk in

• Stack research done: confirm Cursor's likely IdP (Okta/Entra), MDM (Kandji/Jamf) and SaaS (Google Workspace, Slack, Zoom) so your examples land in their world.
• Three sharp questions prepared for each interviewer - about the IT roadmap, the M&A integration cadence and how the team uses AI internally.
• AI examples ready: two specific, recent uses of Cursor with the judgment call you made on each.
• Scripting warmed up: you've re-run the s1 drill within the last 48 hours, both with and without AI assistance.