Vulnerability Management Engineer // Endpoint Patching
Job Description
A well-established wealth management firm is seeking a Vulnerability Management Engineer to join its cybersecurity team. In this role, you will own the end-to-end vulnerability management program with a strong emphasis on hands-on endpoint patching and system hardening across a Windows-dominant enterprise environment. You will lead remediation efforts, drive patch compliance, and collaborate with infrastructure and IT operations teams to reduce the organization's attack surface.
\n
This position is ideal for someone who thrives in a technical, execution-focused role and takes pride in getting vulnerabilities closed — not just tracked. You will work closely with IT, cloud, and business stakeholders to ensure timely remediation while maintaining the stability of critical financial systems. The ideal candidate combines deep Windows patching expertise with a solid understanding of vulnerability prioritization and risk-based decision-making.
\n
The organization is committed to fostering a diverse and inclusive workplace where all employees are treated equitably and with respect.
\n
Required Skills & Experience
\n
3+ years of experience in vulnerability management, endpoint security, or a related IT/information security role
\n
Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related discipline (or equivalent experience)
\n
Hands-on experience with patch management platforms in a Windows environment (e.g., WSUS, SCCM/MECM, Intune, or equivalent)
\n
Proficiency with vulnerability scanning tools such as Tenable Nessus, Qualys, or Rapid7 InsightVM
\n
Strong understanding of Windows OS hardening standards and CIS Benchmarks
\n
Ability to prioritize and communicate risk-based remediation recommendations to both technical teams and leadership
\n
Experience coordinating remediation activities across infrastructure, desktop engineering, and application teams
\n
Strong written and verbal communication skills across technical and non-technical audiences
\n
Self-directed and organized, with the ability to manage competing priorities in a fast-paced environment
\n
Strong analytical and problem-solving skills with a continuous improvement mindset
\n
Desired Skills & Experience
\n
Experience supporting patching and hardening in a regulated financial services or wealth management environment
\n
Familiarity with STIG compliance and Group Policy (GPO) for Windows endpoint configuration
\n
Exposure to Active Directory security hardening and privileged account hygiene
\n
Experience working with ticketing and workflow platforms (e.g., ServiceNow, Jira) for remediation tracking
\n
Knowledge of cloud vulnerability management (Azure or M365 environments)
\n
Understanding of CVSS scoring, exploit intelligence feeds, and risk-based patch prioritization frameworks
\n
Relevant certifications such as CompTIA Security+, CySA+, GCWN, or similar
\n
What You Will Be Doing
\n
Owning the full vulnerability management lifecycle — from scan and discovery through prioritization, remediation coordination, and validation
\n
Executing and coordinating endpoint patching across the Windows fleet, including workstations and servers, using enterprise patch management tooling
\n
Applying and maintaining system hardening configurations in line with CIS Benchmarks, STIGs, and internal security baselines
\n
Analyzing scan results and translating findings into clear, actionable remediation guidance tailored to asset criticality and business risk
\n
Partnering with IT operations, desktop engineering, and server teams to plan and execute patch deployments with minimal disruption
\n
Tracking and reporting on patch compliance, SLA adherence, and remediation progress for leadership and audit audiences
\n
Identifying hardening gaps across the Windows environment and driving improvement projects to close them
\n
Supporting exception management processes, including risk acceptance documentation and compensating control review
\n
Contributing to policy and procedure development around patch management and endpoint configuration standards
\n
Participating in security operations activities such as vulnerability-related incident response and threat intelligence correlation
\n
Tech Breakdown
\n
45% Vulnerability Scanning, Analysis & Remediation Coordination
\n
30% Endpoint Patching & Windows Hardening
\n
15% Reporting, Metrics & Compliance
\n
10% Security Operations Support & Process Improvement
\n
Daily Responsibilities
\n
35% Executing and tracking patch deployments and hardening tasks across endpoint and server infrastructure
\n
25% Reviewing scan results, prioritizing findings, and coordinating remediation with IT teams
\n
20% Producing compliance reports and remediation dashboards for leadership and audit stakeholders
\n
10% Managing exceptions, documenting risk acceptances, and updating hardening baselines
\n
10% Contributing to process improvements, runbooks, and team collaboration
\n
The Offer
\n
You will receive the following benefits:
\n
Competitive salary commensurate with experience
\n
Medical, dental, and vision insurance
\n
401(k) with company match
\n
Paid time off and company holidays
\n
Remote-first work environment with flexibility
\n
Opportunities for professional development and certification support
\n
Exposure to enterprise security tooling in a complex financial services environment
\n
Collaborative, mission-driven team culture
\n
Applicants must be currently authorized to work in the US on a full-time basis now and in the future.