IT Director
Interview Questions 2026

Pragmatism vs idealism, ability to sequence work, willingness to make trade-offs between debt reduction and new capabilities.

Framework: "Year 1: stabilise — patch critical security and operational risk, freeze deprecated platforms, establish governance. Year 2: modernise — migrate the highest-impact legacy systems, build cloud foundation, retire 30-40% of redundant SaaS. Year 3: differentiate — invest in data platform, AI/automation, and capabilities that drive competitive advantage. Throughout: 60-70% of capacity on the roadmap, 30-40% reserved for business demand."

Concrete example: "Inherited a 14-year-old ERP, 6 legacy data warehouses, and a sprawl of 240+ SaaS tools costing €4.2M/year. Year 1 cut SaaS spend by €1.8M through consolidation, hardened authentication after a near-miss incident, and stabilised the ERP through a re-platforming to S/4HANA Cloud (€6M, on-time). Year 2 consolidated the data warehouses into a single Snowflake-based platform. Year 3 launched AI-driven forecasting that reduced inventory carry by €12M. Three-year IT spend ratio dropped from 2.8% to 2.1% of revenue while delivering more capability."

"Three mechanisms: structural (IT leadership embedded in business unit leadership teams, not separate IT planning), financial (every major IT investment must show measurable business outcome, not technical metrics), cultural (every initiative starts with 'what business problem are we solving' not 'what technology should we deploy')."

Practical example: "At my previous company, the CFO and I built a joint scorecard: IT projects were evaluated 70% on business outcome metrics (revenue enabled, cost saved, time saved) and 30% on technical health (uptime, security, debt reduction). The change reframed conversations — instead of arguing about technology choices, we argued about which business outcomes deserved priority."

"Three-lens framework: business value (revenue impact, cost reduction, risk mitigation), strategic alignment (does this advance our 3-year direction?), and feasibility (technical and organisational risk). I require every investment request to have a named business sponsor accountable for outcomes, not just a wish list."

Concrete: "Last fiscal year I had €8M of investment capacity and €23M of demand. We ran a structured prioritisation with the ExCo using these three lenses scored 1-5. Surprisingly, two of the largest CapEx requests — both technically interesting — scored low on business value because sponsors couldn't articulate measurable outcomes. We funded 11 projects worth €7.6M and rejected or deferred the rest with documented reasoning. Six months later, all 11 were on track."

"Three shifts: (1) Outcome reporting — instead of 'tickets closed' and 'projects delivered,' report 'revenue enabled,' 'hours saved,' 'risk reduced.' (2) Business partnering — every IT leader has a peer in the business, joint OKRs, shared accountability. (3) Transparent unit economics — every major service has a documented cost per unit (per user, per transaction, per location) so the business sees what they consume."

Example: "Within 90 days of joining, I rebuilt our IT scorecard from 47 operational metrics to 8 business-outcome metrics. The CFO told me six months later that IT had moved from 'cost to be managed' to 'investment to be optimised' in the board's view — same budget, completely different conversation."

"Cloud-first but not cloud-only. Decision framework on three axes: economics (lifecycle TCO including data egress and licensing), strategic fit (does cloud enable speed/scale we need?), and regulatory/data sovereignty (some workloads can't legally leave region). I'm sceptical of lift-and-shift — it usually creates higher costs without unlocking cloud benefits."

Practical patterns: "New workloads: cloud-native by default. Customer-facing applications: cloud for elasticity. Data and analytics: cloud for compute flexibility. Manufacturing/OT systems: on-premise or edge for latency/availability. Legacy ERPs: case-by-case — sometimes re-platforming makes sense, sometimes containerisation keeps them stable longer."

FinOps discipline: "Cloud without FinOps is a finance disaster. Tag everything, set budget alerts at 80% threshold, monthly cost reviews per service owner, automated right-sizing for over-provisioned resources. On my last cloud estate I reduced annual spend by 28% in 9 months without reducing capability."

"Default to buy unless there's clear strategic differentiation. Three questions before considering build: (1) Does this capability give us competitive advantage, or is it table stakes? (2) Is there a mature SaaS solution serving this market well? (3) Do we have the engineering capacity to maintain it for 7+ years? If the answer to #1 is 'no' or #2 is 'yes,' we buy."

Real example: "Inherited a 6-year custom-built CRM that was a perpetual capacity drain — 4 engineers maintaining what 80% overlap with HubSpot. Migration to HubSpot took 8 months, freed up 4 engineers for actual differentiating work, and the business gained features we'd never have built ourselves. Total cost lower, capability higher. The lesson: maintaining commodity software is the most expensive thing IT can do."

"Digital transformation is a business transformation that requires technology change — not the reverse. IT can't 'lead' digital transformation; we can enable it. My role: provide the platform, the data, and the speed; the business owns the outcomes and process change."

Concrete approach: "I run digital transformation as a portfolio of business-owned initiatives with IT as enabler. Joint steering with business sponsor, joint OKRs, joint accountability. Common failure mode: IT pushes a tool, business doesn't adopt, transformation stalls. Better pattern: business sponsor commits to behaviour change, IT delivers the enabling capability, both share success metrics."

"Defence in depth across five layers: identity (MFA universal, privileged access management, zero trust principles), endpoint (EDR with managed SOC, baseline hardening), network (segmentation, especially OT/IT boundary), data (classification, DLP, encryption at rest and in motion), and people (awareness training, phishing simulation, clear incident response playbooks)."

Investment priorities: "Most cyber incidents trace to identity compromise — MFA, PAM, and identity governance get my first investment dollars. Endpoint protection second. Network segmentation third. Many organisations over-invest in perimeter tools and under-invest in identity. I align spend to actual incident patterns, not vendor marketing."

Governance: "Quarterly cybersecurity review with the audit committee. Annual penetration test by external firm. Tabletop incident response exercises twice a year with executive team — most leadership teams have never practiced making decisions during a live breach."

Framework: "Pre-defined incident response: containment first, evidence preservation second, communication third. CEO and CISO notified within 30 minutes, legal and PR within 1 hour, regulators per jurisdiction requirements (72 hours for GDPR). Activate IR retainer with external forensics firm — never investigate alone."

Real example (STAR): "Discovered a compromised admin account at 02:00 on a Sunday — attacker had been in for 11 days. Activated IR plan: isolated affected systems within 90 minutes, brought in our retained Mandiant team by 06:00, full executive briefing at 09:00. Forensics confirmed lateral movement but no data exfiltration. Reported to BaFin and customers within 72 hours despite no confirmed breach — chose transparency over hope. Cost €1.4M in IR and remediation, but avoided regulatory penalty and retained customer trust. Lessons led to MFA enforcement on all privileged accounts and 24/7 SOC monitoring."

"Security as enabler, not blocker. Build security into the platform (paved roads developers can use) rather than reviewing every initiative manually. Shift-left in development pipelines. Self-service security for common patterns. Risk-based approach: high-risk changes get scrutiny, low-risk changes get automation."

Concrete: "Created an internal developer platform with pre-approved patterns for cloud deployment, API exposure, and data handling. Reduced security review from 2 weeks to same-day for 80% of changes. Genuinely novel risks still get human review. Security incidents dropped 40% year-over-year despite 3x deployment velocity."

"Compliance as continuous, not point-in-time. Three structural elements: a designated compliance owner with budget and authority, automated evidence collection wherever possible, and a single source of truth for controls across frameworks (90% overlap between ISO 27001, SOC 2, and most industry frameworks)."

Practical: "Use a GRC platform (Vanta, Drata, OneTrust) to automate evidence collection from cloud, identity, endpoint, and HR systems. Reduces audit prep from 8 weeks to 2 weeks. Quarterly internal audit, not just annual external. Treat audit findings as roadmap input, not box-ticking exercise."

"Tier vendors by access and risk. Tier 1 (data access, critical operations): annual security assessment, SOC 2 Type II minimum, named security contact, right-to-audit clause. Tier 2 (operational tools): self-attestation questionnaire, contract security clauses. Tier 3 (peripheral): basic vetting. Continuous monitoring via security rating service for tier 1."

Critical insight: "Most companies vet vendors at onboarding then forget them. SolarWinds, Kaseya, and MOVEit all happened with established vendors that had passed initial assessment. Real risk management is continuous — security rating service alerts, annual reassessment, breach notification clauses in contracts."

Lead with the deal: company size, system being replaced, system being deployed, budget, timeline, your role. Then the four phases:

1. Business case & design (months 1-4): Process redesign first, technology decisions second. Locked scope before signing the implementation contract.

2. Build & configure (months 5-12): Phased approach by business unit or module. Master data migration as a separate workstream — most ERP failures trace to data quality.

3. Testing & cutover (months 13-15): Three test cycles, parallel run for finance modules, weekend cutover with explicit rollback plan.

4. Stabilisation & optimisation (months 16-18): Hypercare for 60 days, then formal handover to BAU, then quarterly optimisation cycles.

Real example: "Led S/4HANA replacement of legacy ECC across 23 entities, 11 countries. €18M, 22 months, ended €1.2M under budget and 4 weeks early. Three things that worked: kept scope locked through change board, hired the implementation partner on a fixed-price model with shared risk, embedded business process owners in the project full-time."

"Three-stage approach: strategic vendor partnership for tier 1 (Microsoft, SAP, Salesforce — multi-year, structured QBRs, joint roadmap), commercial discipline for tier 2 (annual benchmarking, structured RFP every 3 years), aggressive optimisation for tier 3 (license consolidation, removing shelfware)."

Negotiation playbook: "Multi-year deals with annual escalator caps (max 3-5%), termination for convenience clauses, benchmark clauses (right to renegotiate if market rate moves 10%+), shelfware swap rights. Never sign without legal and procurement involved. Renew 4-6 months before expiry, not at the last minute when leverage is gone."

Quick example: "Renegotiated a €4M/year SAP contract by consolidating modules across entities, removing legacy components, and committing to 5-year term. Net savings of €1.8M over the contract period plus better support tier, in exchange for SAP getting predictable revenue and reference site rights."

"Escalate early, document rigorously, prepare alternatives in parallel. Step 1: clear written communication of the gap with SLA references. Step 2: executive sponsor escalation on both sides (their CSM, our procurement). Step 3: formal escalation invoking contract remedies. Step 4: in parallel, evaluate alternatives so the vendor knows we're not captive."

Critical principle: "Never let a vendor problem become your problem. Their inability to deliver doesn't relieve me of accountability to the business — I need to have a plan B ready before plan A definitively fails."

"Four layers: (1) Architecture — redundancy designed in, not bolted on. Multi-AZ for cloud, redundant ISPs for offices, automated failover for critical systems. (2) Operations — 24/7 monitoring with clear runbooks, defined SLOs not just SLAs, error budgets to balance reliability vs change. (3) Process — change management proportional to risk, post-incident reviews without blame, continuous improvement. (4) People — on-call rotation that's sustainable, paid appropriately, with proper escalation."

Metric example: "On my current estate: 99.95% availability for tier 1 systems (4.4 hours allowed downtime per year), MTTD < 5 minutes for critical alerts, MTTR < 45 minutes for tier 1. Tracked weekly, reviewed monthly, reported quarterly to ExCo."

"Three structural moves: (1) Transparent unit economics — cost per user, per transaction, per location, published quarterly. (2) Continuous SaaS audit — annual review of 240+ tool sprawl is normal; most companies pay for 30-40% they don't use. (3) FinOps for cloud — tagging discipline, automated right-sizing, reserved capacity for predictable workloads, spot instances for batch."

Result: "On my last optimisation cycle: cut SaaS portfolio from 247 tools to 156 (€2.1M annual saving), reduced cloud spend 28% via right-sizing and reserved instances (€1.8M), renegotiated 4 major contracts (€1.4M). Total €5.3M annual saving without reducing capability — funded the next year's transformation investments."

"Due diligence priorities: cybersecurity posture (any active or recent incidents?), critical system dependencies, contract obligations (especially perpetual licenses that don't transfer), IP and data ownership, team retention risk. I've killed two deals during diligence — one for undisclosed ransomware history, one for catastrophic technical debt."

Integration approach: "Day 1 priorities: secure access, network isolation until risk assessed, basic operational continuity. Day 100: clear integration plan with three options for each system — adopt theirs, adopt ours, or maintain both temporarily. Avoid the 'forced consolidation' trap — sometimes running two systems for 18 months is better than rushing a bad migration."

"Three structural choices: (1) Functional or geographic ownership — I prefer functional ownership (one global owner per capability) with geographic execution. (2) Hub-and-spoke or distributed — depends on talent availability. (3) Hybrid working norms — explicit by design, not by accident."

Concrete: "Built a 145-person IT organisation across Germany (HQ), Poland (shared service centre), and India (development partner). Functional leadership in Germany, transaction processing in Poland, custom development in India. Weekly leadership rhythm via video, quarterly in-person leadership offsites. Retention 91% over 3 years vs industry average ~75%."

"Compensation has to be competitive — pay below market and you lose, simple. But beyond comp: meaningful work, technology choices that don't frustrate engineers, clear growth paths (technical track parallel to management track), and managers who actually manage. Most engineers leave bad managers, not bad jobs."

Practical: "Annual market benchmarking by role, automatic adjustments for top performers. Internal mobility programme — engineers can move between teams every 18 months. Conference budget per person. Senior engineers get protected innovation time. Manager training as condition of promotion to people leader. Result: 89% voluntary retention in a sector averaging 73%."

"Three honest options to evaluate: (1) Add resources — only works in first third of project, hurts in last third. (2) Reduce scope — usually best lever. (3) Move date — sometimes the right call, requires honest conversation with sponsors. The wrong answer is 'work harder' — that's how good people burn out and quality drops."

Process: "Daily standup with project leadership to identify true blockers. Weekly steering with executive sponsors to reshape options. Escalate early — better to flag a 4-week slip 12 weeks out than 2 weeks out. Transparent communication beats heroic recovery every time."

Intellectual courage, framing technical rejection in business terms, ability to disagree without damaging relationship.

S: "The new CRO wanted to deploy a custom Salesforce build to support a specific go-to-market motion, with 12-week timeline and €1.5M budget."

T: "My team's analysis showed the actual delivery would take 9-11 months and €3.5M+, and the custom architecture would create long-term debt around an unusual sales process."

A: "I declined to commit to the original ask. Built three alternatives: (1) Standard Salesforce configuration in 8 weeks, supporting 80% of the desired motion. (2) Salesforce + light customisation in 16 weeks for 95% coverage. (3) The original ask honestly priced at 9-11 months. Presented to CRO and CEO together with explicit trade-offs."

R: "We landed on option 2. The CRO got most of what he needed in a third of the time he feared. We built trust by being honest rather than agreeing to an unrealistic plan that would have failed."

"Disciplined pragmatism. Three categories: (1) Production use cases with proven ROI — copilots for engineering, customer support automation, document intelligence. Deploy now with measurement. (2) Promising but uncertain — autonomous agents, AI for FP&A, specialist domain AI. Limited pilots with clear success criteria. (3) Hype with limited mature use cases — avoid until evidence emerges."

Governance: "AI usage policy covering data privacy, IP exposure, output verification. Clear approved tools list. Quarterly review as the landscape changes. Most companies underinvest in governance and then have an incident — I'd rather be slightly conservative on enablement and have zero incidents than aggressive and have one breach."

This question separates rehearsed candidates from researched ones. Generic answers ("learn the business, meet the team") fail. Specific answers tied to publicly known information about the company succeed.

Structure: "Days 1-30 — listen and learn. 1:1 with every direct report, top 10 internal customers (heads of business units), top 3 vendors, full inventory of IT estate, recent security incidents, current project portfolio. Days 31-60 — diagnose. Health assessment across three lenses: security posture, operational reliability, strategic alignment. Quick wins identified. Days 61-90 — point of view. First strategic recommendation to ExCo: where IT should focus the next 18 months, with specific business outcomes targeted. I commit to no major directional change in the first 90 days — that's earning the right to recommend, not jumping to conclusions."

Don't anchor first if avoidable. Standard reply: "I'd like to understand the role scope and reporting structure before discussing specific numbers — what range has been approved for this role?"

If you must give a number: Always a range, anchor 15-20% above target. Example: "Based on market data for IT Director roles at companies of this size and complexity, I'd expect a base in the €165k-€195k range, target bonus 20-25%, plus appropriate benefits. The right specific number depends on details we haven't covered yet — scope, team size, equity components, hybrid arrangements."