DevOps engineer phone screen questions: production ownership, on-call and certifications
On this page
- What do you need from the hiring manager before the call?
- How should a 25-minute DevOps phone screen run?
- Which knockout questions come first?
- What is the production snapshot?
- How do you check the must-have tools without being technical?
- Which certifications should you check?
- How do you test motivation on a DevOps phone screen?
- How do you ask about pay without asking salary history?
- When should you advance a DevOps engineer?
- What should you not ask a DevOps engineer on a phone screen?
- Questions people ask
A DevOps engineer phone screen is a 20 to 30 minute recruiter call that checks production ownership before the technical rounds: the cloud the candidate works in every day, whether they wrote the infrastructure code and the delivery pipeline or only used them, the on-call rotation they can commit to, and logistics. You do not need to judge whether an answer is technically right. Listen for details only someone who ran the system would know: a state file problem, a deploy that broke, an incident at 3 a.m. and what changed after it.
This page is the first-call version. The deeper bank, with infrastructure as code, Kubernetes and cost-savings checks, is in DevOps engineer screening questions; the engineers' rounds (incident simulation, pipeline design, code review) are in the interview guide for DevOps roles. The ownership ladder for hearing depth without the technology is in software engineer phone screen questions, and the general call structure is in phone screen questions for recruiters.
What do you need from the hiring manager before the call?
"DevOps" can mean pipelines, reliability, an internal platform or cloud accounts and networking. Get the facts below in the intake; the DevOps engineer job description template shows where each one belongs in the posting.
| Fact | Why the screen needs it | A usable answer (example) |
|---|---|---|
| Which flavor of the job | A pipeline builder, a reliability engineer and a cloud networking specialist are different hires. | "Mostly pipelines and Terraform; the SRE team owns monitoring." |
| Primary cloud and how many accounts | The first knockout. Daily depth in one cloud beats light use of three. | "AWS, about 40 accounts in one organization." |
| The three must-have tools | You can check ownership of three tools in a screen, not fifteen. | "Terraform, Kubernetes on EKS, GitHub Actions." |
| On-call rotation | Rotation fit is a knockout that surfaces late if nobody asks. | "One week in six, 15-minute response, a few pages a week." |
| Certification or clearance required by contract | Decides whether a certification is a knockout or a nice-to-have. | "None required; the federal program needs a clearance." |
| Work setting and time zone | Hybrid days and coverage hours end processes late. | "Remote in US time zones, two on-site days a quarter." |
How should a 25-minute DevOps phone screen run?
- Opening (1 to 2 minutes). Who you are, the seat in two sentences, the length of the call, and your consent line if you record.
- Knockouts (4 to 5 minutes). Primary cloud, infrastructure code ownership, on-call, location, any required certification or clearance, work authorization.
- Production snapshot (6 to 7 minutes). One system they ran, how code reached it, the last incident.
- Must-have tool checks (4 minutes). One question per must-have tool.
- Motivation (3 minutes). Why now and what kind of work they want next.
- Pay expectations and logistics (3 minutes). Base, equity, on-call terms, notice, other processes.
- Their questions and the next step (2 minutes). Consent to submit, availability for the technical round.
The timings are a planning example. If a knockout fails, say so kindly and end the call or redirect.
Which knockout questions come first?
| Question | What a good answer sounds like | Weak answer or red flag |
|---|---|---|
| Which cloud do you work in every day, and roughly how many accounts, subscriptions or projects? | One primary cloud and a number: "Azure, about a dozen subscriptions under one tenant." | "AWS, Azure and GCP" equally, with no primary and no number. |
| Did you write the infrastructure code, or change values in code someone else wrote? | An honest answer with detail: "I wrote the network and cluster modules; other teams reuse them." | "I did all the Terraform" from someone who only ran apply on existing modules. |
| The rotation is [one week in X], with a [Y]-minute response time and about [Z] pages a week. Can you commit to that? | A yes, or a clear limit, with what their current rotation looks like. | Has never been on call, for a seat where on-call is the job. |
| The seat is [remote, hybrid or on-site] in [location or time zones]. Does that work as it stands? | A yes, or a limit you can take back. | "Remote is preferred", from someone who applied to a hybrid role, with no limit stated. |
| Contract seats only: this role requires [certification or clearance]. Do you hold it now? | Names it, the issuer or level, and the expiry or status. | "In progress" with no date, for a requirement the contract fixes. |
| Are you legally authorized to work in the US, and will you now or in the future need visa sponsorship? | A direct answer to both parts. | None from the answer. Ask the same two parts of everyone, nothing about citizenship. |
The authorization wording follows the Justice Department's Immigrant and Employee Rights Section FAQ, which says an employer may generally ask whether applicants have the legal right to work in the United States and whether they will need visa sponsorship (as of November 2026). For clearance seats, ask only about the clearance the contract requires; the wording is in cybersecurity analyst screening questions.
What is the production snapshot?
One system, four questions, about six minutes. It replaces fifteen tool questions with one story the candidate cannot look up.
- "Pick one system you ran in production in the last two years. What was it, and who depended on it?" Good: a named service and its users ("the payments API; checkout calls it about 300 times a second at peak"). Weak: a list of tools with no system attached.
- "What happened between a developer merging code and it reaching production, and which part of that did you build?" Good: the steps in order (tests, image build, scans, staged rollout) and their part. Weak: "DevOps handled it", from the DevOps engineer.
- "What was the last incident you were paged for? What failed, how did you find it, and what changed afterwards?" Good: a short timeline and a follow-up change, such as an alert, a runbook or a fix to the deploy process. Weak: has never been involved when something broke, in a role with on-call.
- "What would you change about that system if you could start again?" Good: a specific regret with a reason. Weak: "Nothing."
The example answers above are invented; the pattern is what matters. Specific nouns, numbers and a failure story mean ownership. Generic definitions of DevOps mean the candidate is describing the field, not their work.
How do you check the must-have tools without being technical?
Ask one question per must-have tool from the intake. Each question below works without you knowing the answer; it works because only daily users have one.
| Claim on the resume | Question | Good answer | Weak answer |
|---|---|---|---|
| Terraform, OpenTofu, CloudFormation, Bicep or Pulumi | "Where was the state kept, and tell me about a plan that showed something you didn't expect." | Names the backend and a real surprise: drift, a resource about to be destroyed. | No idea what state is, or "it always worked". |
| Kubernetes | "Did you run the clusters, or deploy onto clusters another team ran?" | An honest answer either way, with detail about upgrades or failures. | Claims to run clusters but cannot say who was paged when one failed. |
| CI/CD (GitHub Actions, GitLab CI, Jenkins, Azure Pipelines) | "How long did a pipeline run take, and what did you do to make it faster or safer?" | A time and a change they made: caching, parallel tests, a manual gate removed. | Does not know how long the build took. |
| Monitoring and alerting | "Which alert woke you up most, and did you change it?" | A noisy alert they tuned or deleted, and why. | Dashboards described, no alert ever changed. |
Which certifications should you check?
Certifications are rarely a knockout for DevOps seats unless a contract or partner program requires one. When one is required, ask for the issuer's verification link or digital badge and the expiry date. The details below come from each issuer's own page, as of November 2026.
| Certification | Issuer | What to note on the screen |
|---|---|---|
| AWS Certified DevOps Engineer - Professional | Amazon Web Services | A Professional-level exam; AWS says the certification is valid for three years. |
| Microsoft Certified: DevOps Engineer Expert | Microsoft | Requires exam AZ-400 plus the Azure Administrator Associate or Azure Developer Associate certification, though as of November 2026 Microsoft Learn shows the Azure Developer Associate and its renewal assessment as retired; Microsoft's role-based certifications expire unless renewed. |
| Professional Cloud DevOps Engineer | Google Cloud | A two-hour multiple-choice exam; Google lists renewal rules in its certification FAQ. |
| Certified Kubernetes Administrator (CKA) | The Linux Foundation | An online, proctored, performance-based exam solved at a command line; valid for two years. |
| Terraform Associate | HashiCorp | The associate-level Terraform certification; HashiCorp also lists a professional and an advanced Terraform exam. |
A current certification plus a production story is the strongest combination. A stack of certifications with no production ownership is common among career changers and is a reason to ask more questions, not to reject.
How do you test motivation on a DevOps phone screen?
| Question | What a good answer sounds like | Weak answer or red flag |
|---|---|---|
| What has you open to a move right now? | A specific push or pull: a rotation that never ends, a platform team they want to build, a move off a legacy stack. | Only "new technology", with nothing about the work. |
| What do you want to spend most of your week on next? | Close to the seat: pipelines, reliability, internal platform, cloud foundations. | The opposite of the seat, such as pure application development. |
| If your company offered more to stay, what would it take? | "Nothing realistic", with a reason. | "Getting off on-call would do it", for a seat with on-call. |
| Where else are you interviewing, and how far along? | Stages and dates, names optional. | "Nowhere", then a final round elsewhere appears next week. |
How do you ask about pay without asking salary history?
Many states and cities bar employers and their agents from asking about a candidate's current or past pay, as of November 2026; the list is in salary history ban states. Ask what the candidate needs from the new role.
| Ask this | Not this |
|---|---|
| "What base do you need for this move, and how do you weigh equity against base?" | "What's your current base?" |
| "This seat pays [on-call terms]. Does that work for you?" | "What does your current company pay you for on-call?" |
| "What would the offer need to include for you to accept?" | "How much unvested stock would you leave behind?" |
If the candidate volunteers a number, keep it out of your notes and the submittal and record the expectation instead. This is general information, not legal advice; check the law where the job is located.
When should you advance a DevOps engineer?
Knockouts (all must be yes)
- Daily depth in the seat's primary cloud, or a credible bridge the hiring manager accepts.
- Wrote infrastructure code or pipelines, not only ran them, for a build-heavy seat.
- Can commit to the on-call rotation as described.
- Location and time zone work as stated.
- Any certification or clearance the contract requires is held now.
- Work authorization answered, and sponsorship needs known.
| Area | 1 | 2 | 3 |
|---|---|---|---|
| Production snapshot | Tools listed, no system | A system, thin on their part | System, their part, an incident and a change after it |
| Must-have tools | Present where they worked | Used daily | Built or owned in production |
| On-call and reliability | Never on call | On call, little follow-up | On call, with changes made after incidents |
| Communication | Hard to follow | Clear with prompting | Clear to a non-engineer, unprompted |
| Motivation and timing | No clear reason | Reason given, timing unclear | Specific reason, known timeline |
An example rule to agree with the hiring manager: advance when every knockout passes, the production snapshot scores at least 2, and two other areas score 3. Hold when one fact, such as a certification's expiry, needs checking. Decline when a knockout fails. Once hired, the 30-60-90 day plan for DevOps engineers picks up with the infrastructure inventory, delivery metrics and on-call shadowing.
What should you not ask a DevOps engineer on a phone screen?
The EEOC says pre-employment inquiries should be limited to what is needed to judge whether someone is qualified, and that questions which reveal race, sex, national origin, age or religion may be used as evidence of intent to discriminate.
| Do not ask | Ask instead |
|---|---|
| "Do you have kids? Night pages are rough." | "The rotation is [schedule]. Can you commit to it?" |
| "Any health issues that would make on-call hard?" | "Can you perform on-call duties as described, with or without accommodation?" |
| "When did you graduate?" | "How many years have you run production infrastructure in [cloud]?" |
| "Where are you from originally?" | The two-part work authorization question, asked of everyone. |
If you take the screen through your computer, Interview Signal keeps the cloud, infrastructure code and on-call questions pinned until you ask them and writes the candidate's own words beside each score, with no bot in the call.
Questions people ask
What should a recruiter ask a DevOps engineer on a phone screen?
Ask which cloud they work in every day, whether they wrote the infrastructure code and the delivery pipeline or only used them, and what on-call rotation they can commit to. Then ask about one system they ran in production: how code reached it, the last incident they were paged for and what changed afterwards. Finish with motivation, pay expectations and logistics.
Can a non-technical recruiter phone screen a DevOps engineer?
Yes. The screen does not judge whether an answer is technically correct; it checks ownership and specifics. Engineers who ran a system in production name the services, the failure and the fix without being pushed. Leave design exercises, code reviews and incident simulations to the engineers in the later rounds.
Is it legal to ask a DevOps candidate about on-call availability?
Yes. Describe the rotation, how often pages happen and the expected response time, then ask whether the candidate can commit to that schedule. Do not ask about children, caregiving or health to judge it; ask about the schedule itself.
Which DevOps certifications should I verify on a phone screen?
Only the ones the client or contract requires. Common ones include AWS Certified DevOps Engineer - Professional, Microsoft Certified: DevOps Engineer Expert, Google Cloud's Professional Cloud DevOps Engineer, the Linux Foundation's Certified Kubernetes Administrator and HashiCorp's Terraform Associate. Ask for the issuer's verification link or badge and the expiry date; production ownership still matters more.