Technical screen #2 - design / scenario

An open-ended design round, usually one of two prompts: design an automated joiner/mover/leaver pipeline or design a zero-trust access model. There's no single right answer, so they grade your structure, your trade-offs and whether you think past the happy path.

Use this stage map to decide what evidence belongs in each round. Memorizing the order is the shallow version. For every stage, prepare one artifact, one story and one question that shows how you reason in the role.

Run the same skeleton every time. It keeps you from rambling and signals that you've designed real systems, not just operated them.

1. 1Clarify requirements. How many employees, how fast is headcount growing, which platforms and SaaS apps, what compliance regime (SOC 2 / ISO 27001)?
2. 2Name the source of truth. For JML it's the HRIS - every join, move and leave originates there, never from manual tickets.
3. 3Map the data flow. HRIS event → IdP (Okta) → group membership (RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition./ABAC) → downstream apps via SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition./API → MDM for device state.
4. 4Walk failure and edge cases. Partial provisioning, API outages, drift between IdP and apps, a rehire, a contractor-to-FTE conversion.
5. 5Cover security and audit. Least privilege, access reviews, immutable logs, evidence for auditors, secrets management.
6. 6Show how it scales. Idempotent reconciliation jobs, policy-as-code, dynamic groups so new apps and new hires don't mean new manual steps.

The detail that separates senior from mid-level is what you say about the unglamorous parts. Anyone can draw the happy path.