Vulnerability & Patch Management Engineer

Key Responsibilities - Own the vulnerability management lifecycle across the estate from scanning and detection through to remediation and closure. - Coordinate and oversee patch management schedules across servers both on prem and cloud, endpoints, network devices, and 3rd party applications, working closely with infrastructure, application, and security teams. - Identify, Triage and prioritise vulnerabilities based on severity, exploitability, and business risk (e.g. CVSS scoring, threat intelligence). - Track remediation SLAs and escalate overdue or high risk vulnerabilities to relevant stakeholders and senior management. - Maintain and report on vulnerability and patching KPIs/metrics, providing regular reporting to Service Delivery and Corporate Technology Leadership. - Liaise with third party vendors and internal teams to ensure timely patch availability and application. - Support audit and compliance requirements (e.g. ISO 27001, Cyber Essentials, PCI-DSS) by maintaining accurate vulnerability and patching records. - Continuously improve vulnerability management processes, tooling, and automation to increase remediation speed and coverage. - Act as the escalation point for critical/zero-day vulnerabilities requiring emergency patching. Key Skills & Experience - Proven experience in vulnerability management, patch management, or IT security operations. - Strong understanding of vulnerability scanning tools (Qualys, Rapid7) and patch management platforms (Ninja One, Ivanti, Intune). - Familiarity with risk frameworks and scoring methodologies (CVSS, NIST, etc.). - Experience working within ITIL aligned service delivery environments, particularly change and incident management. - Strong stakeholder management skills able to work across infrastructure, cloud, infosec, and application teams. - Ability to produce clear reporting and communicate risk to both technical and non-technical audiences. - Relevant certifications advantageous (e.g. CompTIA Security+, CISSP, ITIL Foundation). Key Relationships - Service Delivery Management - Information Security / CISO function - Infrastructure & Application teams - Change & Release Management - Third-party vendors/suppliers