Senior Security Engineer (Tanium)

EPAM Systems; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

EPAM Systems Inc. is seeking a Senior Security Engineer to lead patch management across on‑prem and cloud environments, driving Tanium adoption for Windows, Linux, and EC2 workloads.

You will migrate away from AWS Patch Manager and SSM, translate Ansible patching to Tanium, and implement automation for reporting, compliance, and remediation. Strong ITIL practices and English proficiency are required.

Qualifications

• 3+ years in infrastructure operations with hands‑on patch management experience.
• Tanium: Patch module, Deploy and Endpoint Config; sensors and packages.
• Windows Server and Linux patching in enterprise environments.
• AWS fundamentals: EC2; familiarity with AWS Patch Manager and Systems Manager (SSM).
• Ansible: reading and migrating playbooks (application patching).
• Scripting: PowerShell and/or Bash/Python for automation.
• Experience with heterogeneous, multi‑site estates, including branch/remote‑site servers.
• Awareness of Microsoft Intune patching for EUC (interface knowledge).
• ITIL foundations: incident, change, and problem management.
• Fluency in English with a proficiency level of B2 or higher.
• Nice to have Tanium Certified Operator or equivalent certification.
• AWS Certified SysOps Administrator / Cloud Practitioner certification.

Responsibilities

• Plan and execute patch cycles via Tanium Patch for Windows and Linux servers, including branch servers.
• Patch native EC2 instances in AWS using Tanium, in line with the target operating model.
• Support decommissioning of AWS Patch Manager and SSM-based patching, migrating workloads to Tanium.
• Migrate application patching from Ansible to Tanium: analyze playbooks, design Tanium packages, test, and cut over.
• Manage Tanium patch configuration: patch lists, blocklists, maintenance windows, deployment rings, and endpoint groupings.
• Track and report patch compliance by priority and deadline; analyze failures and drive remediation.
• Coordinate with Security team on vulnerability-driven patching and critical/emergency patch deployments.
• Operate within patching scope; EUC patching remains with Intune and is out of scope, but interfaces and reporting handoffs must be understood.
• Maintain patching runbooks, procedures, and change/incident records in the ITSM platform.
• Participate in change reviews as part of the change advisory process.
• Identify automation opportunities (scripting, Tanium sensors/actions, reporting dashboards) using an AI-first approach.

Skills

Patch management

Infrastructure operations

Scripting

English fluency

ITIL knowledge

AWS fundamentals

Education

Tanium Certified Operator

AWS Certifications

Tools

Tanium Patch

Tanium Deploy

Tanium Endpoint Config

AWS Patch Manager

SSM

Ansible

Microsoft Intune

PowerShell

Bash

Python

Job description

We are looking for a Senior Security Engineer to join the security engineering team, delivering, among others, patch management services. The team owns patch operations across the client’s server and cloud estate and drives the migration of legacy patching approaches onto Tanium. Scope is branch and data-centre servers, native EC2 workloads in AWS, and a the migration of fragmented other patching approaches (AWS Patch Manager, SSM patching, Ansible-based application patching) onto Tanium.

Responsibilities

• Plan and execute patch cycles via Tanium Patch for Windows and Linux servers, including branch servers
• Patch native EC2 instances in AWS using Tanium, in line with the target operating model
• Support the phased decommissioning of AWS Patch Manager and SSM-based patching, migrating affected workloads to Tanium
• Migrate application patching currently run through Ansible to Tanium: analyze existing playbooks, design equivalent Tanium patch/deployment packages, test, and cut over
• Manage Tanium patch configuration: patch lists, blocklists, maintenance windows, deployment rings, and endpoint groupings
• Track and report patch compliance by priority and deadline; analyze failures and drive remediation
• Coordinate with the Security team on vulnerability-driven patching and critical/emergency patch deployments
• Operate within the boundaries of the patching scope: end-user computing (EUC) patching remains with Intune and is out of scope, but interfaces and reporting handoffs must be understood
• Maintain patching runbooks, procedures, and change/incident records in the ITSM platform
• Participate in change reviews as part of the change advisory process
• Identify automation opportunities (scripting, Tanium sensors/actions, reporting dashboards), applying an AI-first approach to triage, exception handling, and compliance reporting

Requirements

• 3+ years in infrastructure operations with hands‑on patch management experience
• Tanium: Patch module, plus Deploy and Endpoint Config; sensors, actions, and packages
• Windows Server and Linux (RHEL/SUSE/Ubuntu) patching in enterprise environments
• AWS fundamentals: EC2, plus familiarity with AWS Patch Manager and Systems Manager (SSM)
• Ansible: reading and migrating playbooks (application patching)
• Scripting: PowerShell and/or Bash/Python for automation
• Experience with heterogeneous, multi‑site estates, including branch/remote‑site servers
• Awareness of Microsoft Intune patching for EUC (interface knowledge only)
• ITIL foundations: incident, change, and problem management
• Fluency in English with a proficiency level of B2 or higher
• Nice to have Tanium Certified Operator or equivalent certification
• AWS Certified SysOps Administrator / Cloud Practitioner certification