Lead Engineer

Role Objective

As a Windows Server Patching Engineer (SE III), need toexecute and coordinate vulnerability remediation and security patching across the Windows Server environment. You will translate vulnerability findings and Microsoft security guidance into prioritized, well-controlled remediation; deploy patches across test, development, and production environments; troubleshoot failures; and maintain clear evidence of compliance and closure.

This is a senior, hands-on engineering role. Need to work closely with Vulnerability Management, Information Security, PCI Compliance, Windows Engineering, application owners, infrastructure, network, cloud, database, and risk teams to meet remediation SLAs and reduce exposure.

Key Responsibilities

·Manage Windows Server vulnerability findings from identification and prioritization through remediation, validation, evidence capture, and closure.

·Assess CVEs, CVSS ratings, vulnerability scan results, Microsoft security updates, and security advisories to determine appropriate remediation and priority.

·Plan and execute monthly Patch Tuesday deployments, emergency/out-of-band updates, and zero-day remediation across test, development, and production environments.

·Coordinate maintenance windows, change records, incidents, dependencies, approvals, and stakeholder communications in ServiceNow.

·Troubleshoot patching and update failures using Windows Update, WSUS, SCCM or Tanium, DISM/SFC, CBS and Windows Update logs, registry, disk-space, and reboot diagnostics.

·Verify patch installation and server health after deployment; track pending reboots, failed patches, and remediation actions through closure.

·Monitor critical and high-severity findings, SLA adherence, aging items, exceptions, and recurring patch failures; escalate blockers and maintain accurate status.

·Support vulnerability assessments, PCI requirements, audits, and security reviews by preparing remediation evidence, compliance reports, and management updates.

·Coordinate documented risk exceptions, compensating controls, and remediation plans when findings cannot be resolved within the required SLA.

·Help address legacy and end-of-life Windows Server systems through upgrades, migration, Extended Security Updates (ESU), replacement, or decommissioning plans.

·Develop and maintain PowerShell scripts to support vulnerability checks, patch compliance, remediation workflows, and reporting.

·Collaborate with application and infrastructure teams to assess impact, resolve dependencies, and deliver remediation with minimal service disruption.

·Provide technical guidance to L1/L2 support teams and engage Microsoft or other vendors when escalation is required.

Required Skills

·Strong hands-on experience administering and patching Windows Server in an enterprise environment.

·Experience with Windows Server 2012 R2, 2016, 2019, and/or 2022, including support for legacy systems.

·Practical experience with enterprise vulnerability management and patch remediation, including remediation SLAs and prioritization of CVEs/CVSS findings.

·Experience deploying Microsoft security updates using one or more of WSUS, SCCM, or Tanium.

·Strong PowerShell scripting skills for administration, automation, validation, or reporting.

·Strong troubleshooting skills across Windows Update, Event Viewer, DISM, SFC, CBS, Windows Update logs, registry, disk space, and reboot-related issues.

·Working knowledge of Active Directory, Group Policy, DNS, TCP/IP, firewalls, RDP/RDS, WinRM, SMB, and TLS/SSL.

·Experience with change, incident, and remediation tracking, and with producing clear technical evidence and status reports.

·Ability to coordinate effectively with security, compliance, application, infrastructure, and operations stakeholders.

Preferred experience :

·Experience supporting PCI vulnerability remediation, audits, or security assessments.

·Experience managing patching and vulnerability remediation across large or complex server environments.

·Familiarity with risk exceptions, compensating controls, and remediation planning for systems that cannot be patched within SLA.

·Experience supporting Windows Server upgrades, migrations, ESU, replacement, or decommissioning.