Senior Patch Management Engineer

HCLTech; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Vacation allowance

Insurance (Term life, business travel)

Job summary

HCLTech in London seeks a Senior Patch Management Engineer to own firmware and software lifecycle across a multi-vendor network estate, including routers, switches, firewalls, and wireless devices. You will assess advisories, prioritise CVEs, and lead automated patch workflows and maintenance windows.

You will collaborate with security and NOC teams, develop runbooks, validate patches, and ensure patch compliance while maintaining network stability and high service levels.

Qualifications

• Experience leading patching of multi-vendor networks.
• Ability to map CVEs to upgrades and prioritise by impact.
• Develop and maintain patch runbooks and validation checks.
• Ability to integrate vulnerability feeds into patching workflows.

Responsibilities

• Manage firmware/software lifecycle for routers, switches, firewalls, load balancers, wireless controllers across multi-vendor environments.
• Assess advisories (PSIRT/JSA) and map CVEs to upgrades; prioritise by CVSS and business impact.
• Develop and maintain device-specific patching runbooks with pre-checks, upgrades, rollbacks, post-validation.
• Automate patch workflows using Ansible, Netmiko, NAPALM or vendor APIs.
• Lead maintenance window planning including CAB submission and rollback testing.
• Ensure backup integrity before patching (RANCID/Oxidised/Cisco NSO) and perform structured rollbacks.
• Incorporate Qualys/Tenable vulnerability data into prioritisation.
• Monitor post-patching network stability with NMS/IPAM tools.
• Act as L2 escalation for patch-related issues and routing incidents.
• Produce patch compliance reports for management and security teams.
• Drive SLA adherence: Critical within 72h, High within 14 days.

Skills

Risk assessment

Planning

Communication

Documentation

Vendor advisories awareness

Education

CCNP Enterprise or Security (Cert)

JNCIP-ENT or JNCIP-SEC (Cert)

PCNSE (Cert)

Security+ or CySA+ (Cert)

ITIL 4 Foundation/Managing Professional (Cert)

Tools

Ansible

Netmiko

NAPALM

Python (Paramiko)

Cisco DNA Centre

SolarWinds

NetBrain

Infoblox

Cisco NSO

Viptela/SD-WAN

Job description

We are a $13+ billion global technology company, home to more than 224,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud, and AI, powered by a broad portfolio of technology services and products.

HCLTech is a globally recognized leader in the Tech and IT industry, but we’ve never forgotten the startup mindset that got us here. We’ve always approached our work with an idea-first attitude because every one of our accomplishments —no matter how big or small —can be traced back to an idea’s single spark.

It’s that spark —that inner drive —that sets our people apart from our competitors. It enables us not just to pull off game-changing feat after game-changing feat but to better our world in the process. We want you to find your spark. Because that’s what drives you to be better, be more and ultimately, be more fulfilled.

To learn more about how we can supercharge progress for you, visit www.hcltech.com

Job Title: Senior Patch Management Engineer

Location: London, UK (Hybrid mode at client location)

Experience: 3 – 6 years in network engineering / operations

ROLE SUMMARY

The L2 Senior Network Patch Management Engineer owns the firmware and software lifecycle across a multi-vendor network estate (LAN, WAN, data centre fabrics, firewalls, load balancers, and wireless). Responsibilities include risk assessment, automated patching workflows, vulnerability-led prioritisation, and cross-team co-ordination for zero-disruption maintenance. The role serves as an escalation point for L1 and leads continuous improvement of network patching practices.

KEY RESPONSIBILITIES

• Manage the firmware / software lifecycle for routers, switches, firewalls, load balancers, and wireless controllers across multi-vendor environments (Cisco, Juniper, Aruba, Palo Alto, F5, Fortinet).
• Assess vendor advisories (Cisco PSIRT, Juniper JSA, Palo Alto Security Advisories) and map CVEs to required upgrades; prioritise based on business impact and CVSS score.
• Develop and maintain device-specific patching runbooks including pre-check scripts, upgrade procedures, rollback steps, and post-validation checks.
• Automate network patch workflows using Ansible, Netmiko, NAPALM, or vendor APIs (Cisco NSO / DNA Centre).
• Lead maintenance window planning: impact analysis, rollback testing, stakeholder communication, and CAB submission.
• Oversee configuration backup integrity (RANCID / Oxidised / Cisco NSO) before every patching activity.
• Conduct structured rollback for failed upgrades; perform root cause analysis and document findings.
• Integrate network vulnerability data from Qualys / Tenable into the patch prioritisation workflow.
• Monitor network stability post-patching using NMS/IPAM tools (SolarWinds, NetBrain, Infoblox).
• Act as L2 escalation for L1 patch-related issues and routing/connectivity incidents.
• Produce patch compliance reports and present to network management and security teams.
• Drive patching SLA adherence: Critical vulnerabilities within 72 hours, High within 14 days.

TECHNICAL SKILLS & KNOWLEDGE

• Expert-level CLI skills: Cisco IOS / IOS-XE / NX-OS, Juniper JunOS, Aruba AOS, Palo Alto PAN-OS.
• Deep understanding of network protocols: OSPF, BGP, EIGRP, MPLS, VRF, STP, HSRP/VRRP.
• Experience with automated patching toolchains: Ansible, Netmiko, NAPALM, Python (Paramiko).
• Vendor firmware lifecycle knowledge including feature releases, maintenance releases, and ED/MD trains (Cisco SMU, Juniper package management).
• Firewall firmware management: Palo Alto, Fortinet FortiOS, Cisco ASA/FTD upgrade procedures.
• Load balancer firmware: F5 BIG-IP or Citrix ADC upgrade methodology.
• Network management platforms: Cisco DNA Centre, SolarWinds NPM/NCM, NetBrain, Infoblox.
• Vulnerability management: parsing Cisco PSIRT, Juniper JSA, and NVD CVE data.
• ITSM integration: ServiceNow change management, CMDB for network asset tracking.
• SD-WAN patching exposure (Cisco Viptela, VMware VeloCloud) is advantageous.

SOFT SKILLS & COMPETENCIES

• Strong risk assessment skills: balances urgency with network stability.
• Excellent planning skills for complex, multi-device maintenance windows.
• Clear communicator with NOC, application, and security teams.
• Methodical documentation – detailed runbooks, RCAs, and change records.
• Proactive – stays current with vendor EOL/EOS notices and security advisories.

PREFERRED CERTIFICATIONS

• Cisco Certified Network Professional (CCNP Enterprise or Security)
• Juniper Networks Certified Professional (JNCIP-ENT or JNCIP-SEC)
• Palo Alto Networks Certified Network Security Engineer (PCNSE)
• CompTIA Security+ or CySA+
• ITIL 4 Foundation or Managing Professional

Benefits

• A supportive, diverse, and global team with a brilliant culture.
• Competitive compensation and benefits that includes vacation per year, various insurances like Term life and Business Travel insurance. These are apart from the statutory benefits applicable in the country. Employee benefits are regulated by an internal policy that contains full details regarding the entitlement and conditions for the benefits as per the law of the land.
• Great opportunities to make the role your own, upskill yourself and get involved with exciting projects.
• Total Wellbeing is our focus. Alongside your professional excellence, you join the likeminded colleagues to create a larger impact within the company and society at large in your chosen area of passion - CSR Council, Diversity Council, Women Connect, Sparks – Engagement Champion to name a few.
• To know more about us visit – www.hcltech.com
• For more information on how we process your personal data, please refer to HCLTech’s Candidate Data Privacy Notice.