Endpoint Vulnerability Management Administrator

EY; Ernakulam; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

EY EndPoint Management is seeking a hands-on EndPoint Infrastructure Patch & Vulnerability Administrator to own the patching lifecycle for about 450 SCCM/AppProxy servers across CAS and primary sites. The role requires coordinating with SCCM/Approxy engineering, validating patches, restarting servers, and driving vulnerability closure under EY change control.

You will manage monthly, accelerated, and emergency patches, monitor SLA, report status, and participate in War Room operations during

Qualifications

• Hands-on experience administering and patching SCCM/AppProxy server infrastructure in a large enterprise.
• Strong Windows Server administration skills including patching, restart sequencing and validation.
• Working knowledge of SQL Server and Always On/HA concepts in patch contexts.
• Solid understanding of enterprise change management (RFC/CAB/eCAB) and audit discipline.
• Ability to work under pressure in War Room/on-call during accelerated patch cycles.

Responsibilities

• Execute monthly, accelerated and emergency patching across ~450 SCCM/AppProxy servers, non-prod first then prod.
• Sequence patching so Windows/SQL finish before SCCM/AppProxy patches; validate restarts.
• Apply SCCM/AppProxy hotfixes and SQL CU updates with careful coordination around SQL databases.
• Provide War Room coverage and stakeholder communication during patch surges and zero-day events.

Skills

SCCM Admin

Windows Server

SQL Server

Change Management

War Room/On-call

Job description

EndPoint Infrastructure Patching & Vulnerability Management Administrator

Function / Portfolio

Digital Workplace Enablement Services (DWES) EndPoint Management

Scope

Patching & vulnerability remediation of the ~450 on-prem SCCM/APPPROXY infrastructure servers (CAS, Primary Sites, SQL site databases and supporting server roles)

Job Description Summary

Maintain and secure the Endpoint Management infrastructure (approximately 450 SCCM and AppProxy servers) by ensuring systems remain patched, hardened, and free of known vulnerabilities. Own the end-to-end server patching and remediation lifecycle, including monitoring, validation, deployment coordination, post-patch verification, and driving vulnerability findings to closure.

The successful candidate will operate the patching lifecycle end to end: monitoring for released fixes, validating them, sequencing and executing patching in coordination with the SCCM and Approxy engineering team, restarting/validating servers, and driving vulnerability findings to closure.

The estate is split across non-production and production environments and includes the Central Administration Site (CAS), Primary Sites and their SQL site databases, which are the true single point of failure for a site. Work is executed against an accelerated cadence and, when required, under an Emergency/Zero-Day change model. The role is hands-on, evidence-driven and governed by EY change management (RFC / eCAB).

Key Responsibilities

Server Patching & Maintenance

• Execute monthly, accelerated and emergency patching across the ~450 SCCM/AppProxy servers (non-production first, then production), following the confirmed environment sequence.
• Sequence patching correctly so Windows/SQL work completes before SCCM/APPPROXY patching in each environment; perform and validate server restarts within the agreed windows.
• Apply Microsoft SCCM/APPPROXY hotfixes and SQL Server cumulative updates (CU/GDR) as prerequisites for a healthy SCCM/APPPROXY platform, coordinating carefully around SQL site databases to avoid taking a whole site down.
• Support High-Availability failover patching (patch passive node/SQL replica, switch active/passive, patch former active) to minimize outage windows.

Vulnerability Management & Remediation

• Own the remediation of vulnerabilities flagged against the SCCM/APPPROXY server estate (e.g. GVM / scanner findings from tools such as Qualys / Tenable), tracking each item to closure within SLA.
• Triage and prioritize findings by criticality (CVSS), separating in-scope SCCM/APPPROXY/SQL items from those owned by other teams and re-assigning out-of-scope items correctly (accurate CMDB ownership).
• Validate that deployed fixes actually mitigate the reported vulnerability, remove flagged/unnecessary software, and capture evidence for audit and closure.
• Maintain and report remediation status, backlog reduction and platform health metrics to the SCCM/APPPROXY lead and stakeholders.

Coordination, Change & War Room Operations

• Liaise daily with the core SCCM/APPPROXY engineering team, SQL/DBA, platform, and service management to plan and execute patch windows.
• Raise and manage changes through EY change management (RFC / eCAB), including emergency/zero-day changes, respecting change freezes and approvals.
• Provide War Room coverage during patch surges and zero-day events: readiness checks, live execution, validation, rollback if thresholds are exceeded, and clear stakeholder communication.
• Produce concise, evidence-based status updates and closure reports for leadership.

Required Skills & Experience

• Hands-on experience administering and patching SCCM/APPPROXY server infrastructure (CAS, Primary Sites, site system roles) in a large enterprise estate.
• Strong Windows Server administration skills (multi-domain Active Directory) including patching, restart sequencing and post-patch validation.
• Working knowledge of SQL Server as an SCCM/APPPROXY prerequisite applying CU/GDR updates and understanding site-database criticality and Always On / HA concepts.
• Solid understanding of enterprise change management (RFC / CAB / eCAB) and evidence/audit discipline.
• Ability to work under pressure in a War Room / on-call model across accelerated and emergency patch cycles.

Out of Scope

• Day-to-day administration of the SCCM/APPPROXY application layer application packaging/deployment, collections/targeting, task sequences, client health and end-user device compliance.
• Operating-system patching governance owned by other platform teams (the role executes/sequences server patching but does not own OS patch policy).