Patch Management Engineer - Cyber Security

This position may require the consultant to work 5 days onsite. This is Mandatory requirement.

Key Product Knowledge

·       Rapid 7

·       Tenable

·       Nizomi 

·       Crowdstrike

·       Service Now Vulnerablity response 

·       ServiceNow

Skills

Risk prioritization

• CVSS scoring, including the NVD base scores the RFP references.
• EPSS, the exploit-probability model, and how to weigh it against CVSS.
• CISA KEV catalog and how it drives SLA timing.
• Business-context prioritization, such as asset criticality, exposure, and VIP asset status, layered on top of raw severity.
• CTEM (continuous threat exposure management) concepts: scoping, discovery, prioritization, validation, and mobilization.

Scanning and assessment

• Credentialed scanning across Windows, Linux, and Unix.
• Authenticated vs. unauthenticated scan tradeoffs and how to tune profiles.
• Scan scheduling by zone: PCI and regulatory monthly, external and DMZ daily, and OT only with explicit approval.
• CIS Benchmarks and DISA STIG assessments, including interpreting misconfiguration results.
• Asset discovery and awareness scanning to find new, decommissioned, and rogue devices.

Asset and data integration

• ServiceNow for ticketing, remediation tasks, SLA tracking, and reporting (the system of record for this contract).
• CAASM platforms and their role in building a unified asset inventory.
• Reconciling data across the CMDB, scanner output, and asset tools to eliminate duplicate or non-actionable tickets.

Remediation and change management

• Patch deployment through SCCM and Intune, including baseline and compliance reporting.
• Change management processes, including standard change, normal change, and the emergency CMR process for critical patches.
• Patch window coordination, maintenance scheduling, and rollback planning.
• Closed-loop verification: rescanning to confirm a fix, not just a patch record.

Compliance mapping

• NIST SP 800-53 controls and the NIST Cybersecurity Framework.
• PCI DSS scanning requirements.
• CISA Binding Operational Directives.