How to Get an IT Manager Job in 2026 and 2027

How IT manager hiring actually works

Most IT managers are not hired, they are promoted. The person who ran the migration, held the on-call phone and became the one the CFO called directly gets the title when the previous manager leaves. If you are already inside a company, your campaign is twelve to eighteen months of visible ownership, not a resume rewrite. Volunteer for the renewal nobody wants, take the audit evidence pack, run the restore test, present the ticket numbers at the operations meeting. Internal promotion decisions are made on who is already behaving like the manager, and they are usually made before the role is posted.

Externally advertised IT manager roles concentrate in three places, and they are different jobs wearing the same title. In a mid-market company of roughly 150 to 2,000 employees, IT Manager is the top IT job: you own everything from the firewall to the laptop fleet to the Microsoft agreement, you typically have between two and twelve reports, and you report into finance or operations. At a managed service provider, IT Manager usually means running a pod of technicians against client service levels and a utilisation target, and the interview is about margin, escalation and client retention. In a large enterprise it means one slice: End User Services Manager, Infrastructure Manager, Service Desk Manager, Network Operations Manager. Read the posting for seat count, headcount and reporting line before you tailor anything, and if they are missing, ask in the screen.

There is a fourth shape that has become common enough to prepare for: the co-managed role, where the company has outsourced the service desk or infrastructure to a provider and the IT manager manages the contract, the escalations and one or two internal staff rather than a team. If the posting mentions a managed service provider, co-managed IT or a named outsourcer, expect the interview to be weighted towards governance: how you hold a provider to its service levels, how you run a monthly service review with evidence rather than vibes, what you do when the provider's ticket data and your users' experience disagree, and whether you have ever triggered a service credit or exited a provider. Candidates who only describe managing employees lose this version of the job to candidates who can describe managing a supplier.

The stages are predictable. A recruiter or in-house talent partner screens for twenty to thirty minutes and is checking four facts: how many people you have managed, how big a budget you have owned, how many users or seats, and your number. Give those plainly and early. Then the hiring manager, who is frequently not a technologist. Then a stakeholder panel that typically includes finance, sometimes HR, sometimes the security lead, and often a department head whose team you would be serving. At the top of the range there is a presentation or a scenario exercise, usually a 30/60/90 day plan or an assessment of a described estate. Then references and a background check. Three to six weeks is normal, and the gap between panel and offer is usually finance, not doubt about you.

Public sector, local government, school districts, universities and many hospital systems run a different process and it catches private sector candidates out. The application form is the screen, and it is read by HR against the posting rather than by anyone in IT, so address every minimum and desirable qualification explicitly, in the posting's own words, with a line of evidence each. At interview, every candidate is asked the same written questions, read aloud, often with no follow-ups, and each answer is scored against a rubric by two or three panellists. You will not be drawn out. Every answer has to be self-contained: name the situation, the action, the number and the result in about ninety seconds.

Finding these roles takes a different search than a software job. Mid-market IT manager openings are often posted only on the company's own careers page and on one local job board, so build a list of thirty to fifty employers in your commuting area by headcount band and check them directly. Local and regional recruitment agencies place a real share of these roles because mid-market companies without a talent function outsource the shortlist. Managed service providers hire continuously and are the fastest route to a first management title, at the cost of client pressure and utilisation targets. And tell the account managers you already deal with that you are looking, because vendors and resellers hear about open IT manager seats across their whole customer base before the postings go up.

One question to ask in the first conversation, every time: who does this role report to, and what is that person measured on. The answer tells you what the whole process is really about. A CFO hiring an IT manager is buying spend control and predictability. A COO is buying uptime and fewer interruptions to the operation. A CIO is buying delivery of a roadmap they already own. Three different second interviews.

What gates the job, and what does not

Nothing licences this role. There is no board, no registration, no continuing education requirement, no state exam. Anyone telling you a certificate is mandatory to manage IT is selling the certificate. What certificates do is clear a screen and supply vocabulary.

ITIL 4 Foundation is the one that appears most often in postings, and it is worth having for an unglamorous reason: it gives you the shared words for incident, problem, change, request and service level that panels use, and it signals you will not treat a change process as bureaucracy. It is a single exam. PMP or PRINCE2 matters where the role is project-weighted, and PMP in particular requires documented project leadership experience plus formal contact hours before you can sit it, so it is a medium-term plan rather than a weekend. CISM or CISSP matters when the role owns security as well as operations, which in the mid-market it almost always does in practice even when the posting does not say so. Both require verified experience, so they tend to follow the first manager job rather than unlock it.

Keep one current technical certification live even as a manager. Not because anyone needs you to configure conditional access, but because a five-year-old certification next to a resume full of management verbs reads as someone who has lost touch with the estate they are supposed to run. A current Azure, Microsoft 365, Intune or AWS associate-level credential does that job cheaply.

What actually gates the role is evidence of scope. A panel is deciding whether you have ever been accountable when something cost money or stopped working, or whether you have only ever executed. The proof is numbers attached to decisions you made: a contract you signed off, a budget you built and then hit, a person you hired and a person you managed out, a risk you accepted in writing. If you have none of that, get some before you apply. Ask your current manager for the renewal calendar. Ask to own the hardware refresh budget line. Ask to run the next access review. These are not favours; nobody wants to do them.

What belongs on an IT manager resume, and what gets ignored

The most common failure in IT manager resumes is that they read as a senior administrator resume with the word manage pasted over the verbs. The reader cannot tell what you were responsible for, only what you touched.

Lead with scope. Under your name and title, give a one-line scope statement using your real figures: team size, annual budget and whether it is operating, capital or both, user or seat count, number of sites and countries, and the core platforms. A reader is deciding in the first few seconds whether you have operated at their size. Make that decision easy and make it accurate, because every number on that line will be probed.

Then write bullets that start with the business outcome and carry a number you would defend under follow-up questions. The pattern that works: what changed, by how much, over what period, and what you did. Not the technology you used.

What gets ignored or actively counts against you: a skills matrix listing forty technologies, which reads as a doer; strings of certification acronyms after your name; words like spearheaded, synergised and passionate; duties with no scale, such as managed backups and antivirus; and a one-page resume, which at this level hides the scope that is your whole case. Two pages is right. Three is acceptable at fifteen years.

On title honesty: if you ran the team without the title, do not invent one, but do disambiguate. Systems Administrator III (acting IT manager, five reports, 2024 to 2026) is true, searchable, and answers the recruiter's question. Applicant tracking systems and recruiters both filter on title, so burying the fact that you led the team in bullet four will cost you the screen.

• Four numbers visible in the top third: people managed, annual budget owned, seats or users supported, sites or countries.
• The renewal bullet: name the category and what you changed in the terms, not only the saving. Removing an auto-renewal clause and capping the uplift at renewal is worth more than a one-off discount and shows you read contracts.
• The restore bullet: state that you tested a restore and what recovery time you actually proved. Backup success rate is a vanity metric. Restores are the evidence an auditor and a panel both want.
• The service bullet: a service level or ticket metric you moved, with the before, the after and the window. First contact resolution, mean time to resolve by priority, reopen rate, or new-starter time to productive.
• The security coverage bullet: a control you took from partial to near-complete, expressed as coverage. Multi-factor authentication across staff accounts, service accounts and remote access. Endpoint detection across the fleet. Standing privileged accounts reduced from many to few.
• The audit or questionnaire bullet: a framework you were assessed against (SOC 2, ISO 27001, PCI DSS, HIPAA, Cyber Essentials) and the evidence you were responsible for producing.
• The supplier bullet, if you ran a managed service provider or outsourced desk: the service levels you held them to, what you did when they missed, and what the monthly service review produced.
• The people bullet: hires made, attrition, an on-call rota you designed, someone you developed into a senior or lead role.
• Leave out: tool lists longer than six items, home lab projects, every course you have ever taken, and anything that happened more than twelve years ago in technical detail.

Vendors, spend and risk: the three subjects every panel tests

This is the part of the interview that hands-on candidates lose, and it is losable in two minutes. Panels are not testing whether you know what a firewall does. They are testing whether you can be trusted with other people's money and other people's exposure.

Vendors. Expect: walk me through your last renewal. A weak answer names a product and a percentage saved. A strong answer has structure. Here is the category, here is the seat count against true consumption, here was list price against what we paid, here is what I changed in the terms, here is who I brought in, and here is what I was willing to lose. The term changes that impress a panel are unglamorous: removing automatic renewal, co-terminating agreements so renewals land together and you negotiate once with leverage, capping the uplift at renewal, protecting against a mid-term true-up, getting data egress and exit assistance written in, and making sure service credits are not quietly the only remedy. Say plainly that credits are not compensation, they are a discount on the outage you already suffered. Know the purchasing vocabulary: enterprise agreement against cloud solution provider against direct, reseller margin, named user against concurrent, perpetual against subscription, maintenance as a percentage of licence, data processing agreement, subprocessor list. The question behind the question is always whether you will be captured by the incumbent reseller who takes you to lunch.

Be ready for the inventory question too, because nobody answers it badly and recovers. How many software products are in use in your organisation, and how do you know. The credible answer names the method: sign-in logs and enterprise applications in your identity provider, expense and card reports from finance, a discovery tool, and a renewal calendar you maintain by hand. Saying that the last time you did this you found tools nobody in IT had approved, and a product you were paying for twice through two cost centres, is a better answer than claiming a clean inventory.

Spend. You should be able to build an IT budget out loud in three minutes: contracted run rate (what renews whether or not you do anything), hardware refresh (what fraction of the fleet turns over each year and at what unit cost), projects, people including contractors and overtime, and contingency. Know your unit economics, because that is how finance thinks: cost per seat per month for the whole stack, cost per ticket, cost per site. Know why finance cares about capital against operating spend, and that moving a data centre to cloud converts a depreciating asset into a monthly operating cost, which changes how the numbers present even when the total is similar.

Then the cut question, which arrives in almost every mid-market panel: we need ten percent out of IT next year, where does it come from. Weak candidates cut training, spares and the thing they personally dislike. Strong candidates give an ordered list with the risk accepted at each step: reclaim unused licences first because it is free, consolidate overlapping tools, extend the hardware refresh cycle by a year and name the increase in failure rate and support load you are accepting, renegotiate the two largest contracts, defer a named project. Then name what you will not cut and why: backups and restore testing, multi-factor authentication, endpoint protection, and support on anything that stops revenue when it breaks. Saying no to a CFO with a reason attached is the skill being tested.

Risk. Panels want to see that risk is a register with named owners and dates in your world, not a feeling. Be able to list what you tracked and the state it was in when you left: documented recovery time and recovery point objectives per critical system, and whether the business agreed them in writing rather than you guessing; the date of your last tested restore and what failed in it; patch service levels by severity and your actual compliance against them; multi-factor coverage including service accounts and remote access; how many accounts hold the highest privilege and whether that access is standing or requested; how fast a leaver loses access and who triggers it; third-party risk on your top vendors; the insurance questionnaire you signed and whether every answer was true.

The incident scenario is standard: we have ransomware on a file server at 2am, go. They are scoring sequence and judgement, not heroics. Who you wake and in what order. When you isolate rather than power off, and why preserving volatile evidence matters. When legal, the insurer and the executive team get told. A decision log with timestamps from the first minute. Who talks to staff and who does not talk to customers. One detail that catches people out: many cyber policies condition cover on prompt notification and on using the insurer's panel incident response firm, so engaging your own responder first can create an argument about cover. Say you would check the policy's notification requirements rather than asserting a rule, because policies differ.

If you operate in the EU or UK, there are obligations covering operational resilience, incident reporting and the use of AI systems at work that may apply to your sector and your suppliers. Several of these timetables have been amended more than once. Name the obligation in an interview, not the date, and verify the current text before you assert a deadline. Being confidently wrong about a compliance date in front of a panel that includes legal is a specific and avoidable way to lose an offer.

The people part, where hands-on candidates fail

If you take one thing from this guide: when the question is about a person, keep the answer about the person. An engineer asked how they handled a struggling team member will describe the runbook they wrote to fix the underlying problem. That answer scores zero on a panel with an HR representative in the room, because it says you solved the ticket and avoided the human.

Prepare real, specific stories for the standard set. The underperformer: what you observed, what you said in the first conversation, what you documented, whether HR was involved, what the outcome was, and how long it took. The excellent engineer who is corrosive to the team: what behaviour you named, what boundary you set, and what you did when it did not change. The on-call rota: how it was structured, how you compensated it, and what you changed because someone was burning out. The promotion: who you developed and into what. The exit: someone you managed out or made redundant, and how you handled the rest of the team afterwards.

Expect the stakeholder question, because it is the daily reality of the job: a department head is unhappy, goes around you, and emails the CEO. What do you do. The answer that works is boring and adult: you go and see them, you find out what they actually needed and by when, you commit to a date or explain plainly why you cannot, and you tell your own manager before they hear it elsewhere. Panels are checking that you escalate upwards early and do not get defensive sideways.

And prepare the question that separates a lead from a manager: what did you stop doing yourself. Name the specific task you handed over knowing it would be done worse for a while, what that cost in the short term, and how the person is doing now. Candidates who cannot answer this are usually about to be hired as the most expensive senior administrator on the team, and experienced panels know it.

The presentation stage and the 90-day plan

Final stages often include a short presentation, typically thirty to forty-five minutes with questions, on one of two prompts: your first ninety days, or an assessment of an estate they describe to you in advance. It is the highest-leverage hour in the process because most candidates fill it with a technology roadmap for a company they have not seen.

Do the opposite. Make the first two weeks explicitly about looking, and list what you would ask for by name: the asset and licence inventory, the renewal calendar for the next eighteen months, the top ten ticket categories by volume, evidence of the last successful restore, the list of accounts with the highest privilege, the risk register if one exists, the current budget against actuals, and the active contracts. Say you would meet every direct report one to one in week one and at least five business stakeholders outside IT in week two, with the same three questions each time: what works, what wastes your time, and what are you afraid of.

Then commit to one visible win inside the first month, chosen to be low risk and widely felt. New-starter setup that is ready on day one. A password reset path that does not require a phone call. The meeting room that never works. Then a costed plan for days sixty to ninety with three things you would fix, one thing you would stop doing entirely, and an honest statement of what you would need: money, a hire, or a decision from them.

Two things not to do. Do not propose a platform migration or a reorganisation you cannot possibly have justified yet. And do not present a slide of generic best practice; present the questions you would ask about their specific estate and the decisions those answers would drive. Panels remember the candidate who told them something uncomfortable and true about their own environment.

Pay, title inflation and reading the real scope

IT Manager is one of the most elastic titles in the market. The same words cover a two-person team at a 90-person charity and a thirty-person function inside a bank, and the pay gap between them is large. Before you talk about money, work out which job it is.

For a defensible reference point, use the US Bureau of Labor Statistics Occupational Employment and Wage Statistics for SOC code 11-3021, Computer and Information Systems Managers, filtered to your metropolitan area. Read it as an envelope rather than a target, because that code pools working IT managers with IT directors and CIOs and therefore skews above where a first-time manager role sits. Cross-check against live postings in jurisdictions that require a published range, including Colorado, California, New York, Washington and Illinois, and note that the set of states and cities with pay-transparency rules keeps changing, so check what currently applies where you are looking. Published salary schedules for public sector, school district and university roles are literal and often downloadable. In the UK, local government and NHS roles map to published bands. The annual salary guides from large recruitment firms are directional and worth reading for the shape of the market, not as a quotable figure.

What moves the number, in rough order: seat count and headcount, reporting line (a role reporting to the CEO or CFO pays above one reporting to an IT director), industry (financial services, pharmaceutical and energy above average; education, local government and non-profit below), whether you own security and compliance as well as operations, whether you carry a formal on-call obligation, and whether the company has a second site or a second country, which multiplies travel and coordination.

Diagnostic questions that reveal the real job before you negotiate: how many people report to this role and how many are contractors; what is the annual IT spend and who signs off what above which threshold; who approves a hire; how many tickets a month and who is on call; when is the next large renewal; has the estate ever been audited. A role that cannot tell you its own IT spend or who signs off a purchase is not really a manager role yet, whatever the title says. That is worth knowing before you accept, not after.

Making the jump from hands-on to managing

If you are a senior administrator or a team lead and the title has not come, the gap is almost never technical. It is that nobody has yet seen you own an outcome where money or exposure was on the line. There are four things you can start this quarter without anyone's permission.

Build the inventory nobody has. A single spreadsheet of every contract, its renewal date, its cost, its owner and its notice period is usually the most valuable document in a mid-market IT department, and it does not exist. Maintaining it makes you the person consulted on spend, which is the whole job in miniature.

Test a restore and write up the result honestly, including what failed. Then get the business to state what downtime and data loss it can actually tolerate for its three most important systems, in writing. That conversation is the one that turns an administrator into a manager, because it forces you to translate technology into business consequence in front of people who do not care about either until you make them.

Volunteer for the renewal and the access review. Both are tedious, both are avoided, and both produce exactly the evidence an interview panel asks for. Then take the ticket data and present it monthly to someone outside IT, in their language: how long a new starter waits to be productive, which recurring fault costs the sales team the most hours, what it costs per person per month to run their software.

Finally, interview before you are ready. The IT manager interview is a skill with its own vocabulary, and you will be bad at the vendor and budget questions the first two times. Find out which answers fall apart under follow-up while the stakes belong to a role you were not sure about anyway.

What a screen is looking for

These are the terms that a resume screen, human or automated, is matching against for this role. Use the ones that are true of you, in the words the posting uses.

• IT Manager
• IT operations management
• vendor management
• contract negotiation
• software licence management
• IT budget management
• capital and operating expenditure
• ITIL 4
• service management
• incident management
• problem management
• change management
• service level agreement
• service desk management
• ITSM
• managed service provider
• co-managed IT
• Microsoft 365 administration
• Microsoft Entra ID
• Intune
• Azure
• endpoint management
• backup and disaster recovery
• recovery time objective
• recovery point objective
• business continuity
• risk register
• third-party risk management
• multi-factor authentication
• privileged access management
• identity and access management
• patch management
• SOC 2
• ISO 27001
• PCI DSS
• cyber insurance
• incident response
• team leadership
• performance management
• stakeholder management
• asset management
• hardware refresh
• Copilot deployment
• AI governance
• data loss prevention
• project management
• PMP
• CISM
• vendor renewal
• cost per seat
• IT procurement

Mistakes that cost people this job

Questions people ask