Interview guide for IT support roles: a short loop with a ticket queue and a social engineering call

An IT support hire is judged on three things users notice and one they do not. Users notice whether the problem got fixed, how long it took and whether they were treated like an adult. They do not notice whether the technician verified their identity before resetting a password, but that habit protects the whole company. This guide gives hiring managers a short loop for a help desk or desktop support technician: four stages, who owns which competency, core questions with what to listen for, a ticket queue exercise and a social engineering call, example weights and the decision rule. Adjustments for tier 2, desktop support and junior roles are at the end.

The first call, including a talk-through troubleshooting scenario and certification notes, is in help desk technician screening questions. If you are a recruiter or manager without an IT background, read how to interview for technical roles as a non-technical recruiter before the loop starts.

The loop at a glance

Stages 2 to 4 fit in one half-day visit or one block of video calls, which matters for candidates who are working shifts elsewhere. The stage design reasoning is in the interview process template.

Stage 1: the screen (25 minutes)

• "How many users do you support, on what devices and systems, and how many tickets do you close on a normal day?" Listen for: a concrete environment (for example, 400 users on Windows laptops with Microsoft 365) and a realistic volume.
• "Which tickets do you escalate, and to whom?" Listen for: a clear line between what they resolve and what goes to tier 2, network or security.

Stage 2: the ticket queue exercise (60 minutes)

The candidate sees a queue of five invented tickets with timestamps and user details. An IT lead plays the user, the system and any colleague the candidate wants to ask, answering only what is asked.

The queue

• A user cannot print to the floor printer since this morning; others on the floor can.
• A remote employee's VPN connects but they cannot reach the file share.
• A sales team reports email is slow; it started 20 minutes ago and three people have called.
• A new starter arrives tomorrow and their laptop and account are not ready.
• A user's account is locked for the third time this week.

Running it

1. Prioritize (10 minutes): "Put these in the order you would work them and tell me why."
2. Work two tickets in depth (35 minutes): the interviewer picks the VPN ticket and the repeated lockout. The candidate asks questions and says what they would check; the interviewer reports results.
3. Close one ticket in writing (10 minutes): "Write the resolution note for the VPN ticket."
4. Wrap-up (5 minutes): "Which of these might be connected?"

What to listen for

• Prioritization: the multi-user email issue first because it affects several people and may be growing, with a quick acknowledgment to the others.
• Troubleshooting method: gathering facts, isolating the layer (account, device, network, service), changing one thing at a time and confirming the fix with the user.
• The repeated lockout: looking for a cause such as a saved old password on a phone, and raising the possibility of an attack if the pattern is odd, rather than unlocking it a fourth time.
• The resolution note: symptoms, cause, fix and anything the next technician should know, readable without a conversation.

If you can run a reliable test environment, swap the talk-through for a hands-on lab, but keep the same tickets and scoring. More questions on method are in how to interview for problem-solving.

Stage 3: user and security role-plays (30 minutes)

Role-play 1: the frustrated user (15 minutes)

An interviewer from outside IT plays a user whose laptop died before a client presentation in an hour. They are short-tempered and not technical. Listen for: acknowledging the deadline, offering a workaround first (a loaner, web access to the files), plain language, a clear next step and no blame.

Role-play 2: the social engineering call (15 minutes)

A second interviewer calls as the chief financial officer, traveling, locked out, and needing a password reset and multifactor authentication removed "right now" before a wire approval. They cannot answer the verification questions and become impatient.

Listen for: following the verification process anyway, staying polite, offering the approved alternative route (for example a call-back to the number on file or a manager's verification), and reporting the call afterward. A candidate who resets the account to be helpful fails the gate, however good the rest of the loop.

Stage 4: hiring manager interview (40 minutes)

1. "Tell me about a problem you could not solve. What did you do with it?" Listen for: what they tried, how they escalated with notes so the next person did not start over, and whether they followed up to learn the answer.
2. "Tell me about a fix you got wrong." Listen for: telling the user and the team, putting it right and checking more carefully afterward.
3. "What is something technical you learned in the last six months, and how?" Listen for: a specific skill and a specific method, such as a home lab, documentation or shadowing a colleague.
4. "Tell me about a knowledge base article or process you wrote or improved." Listen for: a recurring problem turned into documentation others used.

Scorecard competencies and weights

Example weights for a tier 1 help desk technician. Set yours at intake and lock them before the first candidate.

The scorecard builder checks that the weights add up to 100 and prints a sheet per interviewer. Anchors on a 1–4 scale: 1 guessing or no method, 2 a method with gaps, 3 a clear method that reaches a fix, 4 the same plus prevention.

The decision rule

1. Scorecards first, including the resolution note, before the short debrief.
2. Gate: no failure on the social engineering call.
3. Floor: troubleshooting method at 3 or above for experienced candidates; 2 or above for entry-level candidates who scored 3 or above on learning.
4. Weighted total: in this example, 2.7 or higher on the 1–4 scale is an offer.
5. Decide within two working days. Good support candidates often have several offers; slow loops lose them.

The debrief record is in the interview debrief template.

Adjusting for related roles

Common mistakes in IT support loops

• Trivia quizzes. Port numbers and acronyms are easy to look up. Score method, not recall.
• Ignoring the user side. A technician who fixes everything and alienates users generates complaints and repeat tickets.
• No security test. CISA's Scattered Spider advisory (updated July 2025) describes attackers posing as employees to get help desk staff to reset passwords and move multifactor authentication to the attacker's device. Test the verification habit directly.
• Overweighting certifications. They open the door; the exercise decides.