Network Infrastructure Patch Management Engineer

Job Title: Network Infrastructure Patch Management Engineer

Job Location: Cary, NC / Jacksonville, FL

Job Type: Full Time / Perm / Direct Hire

Job Overview:

Requirement/Must Have:

• Expert-level CLI skills: Cisco IOS / IOS-XE / NX-OS, Juniper JunOS, Aruba AOS, Palo Alto PAN-OS.
• Deep understanding of network protocols: OSPF, BGP, EIGRP, MPLS, VRF, STP, HSRP/VRRP.
• Experience with automated patching toolchains: Ansible, Netmiko, NAPALM, Python (Paramiko).
• Vendor firmware lifecycle knowledge including feature releases, maintenance releases, and ED/MD trains (Cisco SMU, Juniper package management).
• Firewall firmware management: Palo Alto, Fortinet FortiOS, Cisco ASA/FTD upgrade procedures.
• Load balancer firmware: F5 BIG-IP or Citrix ADC upgrade methodology.
• Network management platforms: Cisco DNA Centre, SolarWinds NPM/NCM, NetBrain, Infoblox.
• Vulnerability management: parsing Cisco PSIRT, Juniper JSA, and NVD CVE data.
• ITSM integration: ServiceNow change management, CMDB for network asset tracking.
• Strong risk assessment skills: balances urgency with network stability.
• Excellent planning skills for complex, multi-device maintenance windows.
• Strong verbal and written communication skills.
• Methodical documentation detailed runbooks, RCAs, and change records.
• Proactive stays current with vendor EOL/EOS notices and security advisories.

• Manage the firmware / software lifecycle for routers, switches, firewalls, load balancers, and wireless controllers across multi-vendor environments (Cisco, Juniper, Aruba, Palo Alto, F5, Fortinet).
• Assess vendor advisories (Cisco PSIRT, Juniper JSA, Palo Alto Security Advisories) and map CVEs to required upgrades; prioritise based on business impact and CVSS score.
• Develop and maintain device-specific patching runbooks including pre-check scripts, upgrade procedures, rollback steps, and post-validation checks.
• Automate network patch workflows using Ansible, Netmiko, NAPALM, or vendor APIs (Cisco NSO / DNA Centre).
• Lead maintenance window planning: impact analysis, rollback testing, stakeholder communication, and CAB submission.
• Oversee configuration backup integrity (RANCID / Oxidised / Cisco NSO) before every patching activity.
• Conduct structured rollback for failed upgrades; perform root cause analysis and document findings.
• Integrate network vulnerability data from Qualys / Tenable into the patch prioritisation workflow.
• Monitor network stability post-patching using NMS/IPAM tools (SolarWinds, NetBrain, Infoblox).
• Act as L2 escalation for L1 patch-related issues and routing/connectivity incidents.
• Produce patch compliance reports and present to network management and security teams.
• Drive patching SLA adherence: Critical vulnerabilities within 72 hours, High within 14 days.

• SD-WAN patching exposure (Cisco Viptela, VMware VeloCloud) is advantageous.

• Cisco IOS.
• IOS-XE.
• NX-OS.
• Juniper JunOS.
• Aruba AOS.
• Palo Alto PAN-OS.
• OSPF.
• BGP.
• EIGRP.
• MPLS.
• VRF.
• STP.
• HSRP/VRRP.
• Ansible.
• Netmiko.
• NAPALM.
• Python.
• Paramiko.
• Cisco SMU.
• Fortinet FortiOS.
• Cisco ASA/FTD.
• F5 BIG-IP.
• Citrix ADC.
• Cisco DNA Centre.
• SolarWinds NPM/NCM.
• NetBrain.
• Infoblox.
• ServiceNow.
• CMDB.

• Cisco Certified Network Professional (CCNP Enterprise or Security).
• Juniper Networks Certified Professional (JNCIP-ENT or JNCIP-SEC).
• Palo Alto Networks Certified Network Security Engineer (PCNSE).
• CompTIA Security+ or CySA+.
• ITIL 4 Foundation or Managing Professional.