Windows Server - Vulnerability & Remediation Engineer

CBTS; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

CBTS is seeking a Windows Server (2016/2019/2022) vulnerability remediation engineer. You will leverage Qualys, Chef/Ruby, and automation to identify, prioritize, and close vulnerabilities in enterprise Windows environments.

Responsibilities include coordinating remediation, hardening configurations, and validating fixes with cross-team stakeholders. Remote work and ongoing change management are integral to the role.

Qualifications

• 6–10 years of hands-on Windows Server experience in enterprise environments.
• ,
• ],
• },
• :

Responsibilities

• Coordinate remediation activities for Microsoft security updates and reboots.

Skills

PowerShell

Shell scripting

Ruby

Cookbooks/Recipes

Security fundamentals

Tools

VMware

SCCM/WSUS

Qualys

Terraform

Job description

Microsoft Wintel Vulnerability & Remediation Engineer (Windows Server 2016/2019/2022) - 100% Remote - Direct Hire (FTE) - Market Pay - NO (Sponsorship, H1B, F1, OPT, EAD, C2C)

CBTS is searching for a Windows Server 2008/2016/2019/2022 (Wintel) focused on Configuration Management using Chef/Ruby and Qualys Vulnerability Remediation. This role focuses on Microsoft Windows Server 2016/2019/2022 and leverages existing automation and scanning technologies (e.g., Qualys, Chef, SCCM/WSUS, PowerShell/shell scripting, Ruby) to identify, prioritize, implement, validate, and close vulnerabilities in alignment with internal compliance requirements (e.g., Meridian requirements). The engineer partners closely with Operations, Engineering teams, application owners, and support teams to deliver timely fixes while maintaining server stability and change discipline.

Must Have Skills:

Microsoft Windows Server 2016/2019/2022, Qualys, Chef/Ruby, PowerShell/shell scripting, cookbooks, Windows Server Patching (SCCM/WSUS), Triage, STIGs

Responsibilities:

• Coordinate remediation activities for:
• Microsoft security updates (monthly/Out-of-Band as needed) and required reboots where applicable.
• Configuration hardening aligned to organizational standards and security baselines (as applicable in the environment).
• Mitigations/compensating controls when immediate patching is not feasible (documented and approved per process).
• Develop, enhance, and maintain remediation automation using:
• Chef (cookbooks/recipes, attributes, templates, policy files as applicable)
• PowerShell and scripting (server-side automation and custom remediation logic)
• Ruby for maintaining/extending Chef-based remediation code and custom logic
• Convert recurring manual remediation steps into repeatable automated solutions and standardized runbooks.
• Ensure code follows internal engineering standards: version control, peer review, testing, documentation, and change management.

Validation, Closure & Reporting

• Validate remediation effectiveness by re-scanning and verifying closure in Qualys (and/or approved internal validation methods).
• Confirm fixes did not introduce regressions; coordinate with application and platform teams for post-change verification.
• Maintain accurate documentation of remediation actions, approvals, exceptions, and closure evidence to support audit and compliance needs.
• Provide progress updates, metrics, and risk status to stakeholders (e.g., open critical/high items, aging items, SLA adherence).

Cross-Team Coordination & Operational Execution

• Schedule and lead remediation calls with infrastructure support teams, application owners, and other stakeholders to drive timely execution.
• Work within change management processes: create/execute change plans, develop rollback steps, and coordinate maintenance windows.
• Partner with platform engineering to improve standard server baselines and prevent vulnerability recurrence.

Vendor & Release Coordination (as needed)

• Follow up with vendors (Microsoft and/or third-party software providers installed on servers) for patch availability, release schedules, and remediation guidance when vulnerabilities require vendor action.
• Track Microsoft security advisories and coordinate planned rollout timelines where applicable.

Requirements:

• Must have 6–10 years of strong hands‑on experience with Windows Server 2016/2019/2022 in enterprise environments (Wintel). Banking/Finance industry
• Must have experience building/configuring, administrating, virtualization (VMware) and migrating to Cloud Platforms (AWS & Azure) with Microsoft Servers (2016/2019/2022).
• Must have experience working with Microsoft OS patching and platform hardening tools such as SCCM, WSUS or configuration management tools such as Chef/Ruby.
• Must have 5+ years of Vulnerability and Remediation experience using Qualys.
• Must have Expertise with Qualys (or equivalent vulnerability scanners) including interpreting findings, false‑positive validation, and closure verification.
• Must have experience with Terraform for spinning up cloud resources
• Must have automation experience with Chef in production on Windows server environments. This also includes experience creating Cookbooks/Recipes for automating how infrastructure should be configured.
• Must have strong scripting skills (PowerShell; plus ability to use/maintain shell scripting where applicable in the environment).
• Working proficiency in Ruby (or ability to maintain/extend existing Ruby codebases used for Chef remediation).
• Must have strong understanding of Windows security fundamentals (patching, services,