Senior Security Engineer (Tanium)

We are looking for a Senior Security Engineer to join the security engineering team, delivering, among others, patch management services. The team owns patch operations across the client’s server and cloud estate and drives the migration of legacy patching approaches onto Tanium. Scope is branch and data-centre servers, native EC2 workloads in AWS, and a the migration of fragmented other patching approaches (AWS Patch Manager, SSM patching, Ansible-based application patching) onto Tanium. Responsibilities Plan and execute patch cycles via Tanium Patch for Windows and Linux servers, including branch servers Patch native EC2 instances in AWS using Tanium, in line with the target operating model Support the phased decommissioning of AWS Patch Manager and SSM-based patching, migrating affected workloads to Tanium Migrate application patching currently run through Ansible to Tanium: analyze existing playbooks, design equivalent Tanium patch/deployment packages, test, and cut over Manage Tanium patch configuration: patch lists, blocklists, maintenance windows, deployment rings, and endpoint groupings Track and report patch compliance by priority and deadline; analyze failures and drive remediation Coordinate with the Security team on vulnerability-driven patching and critical/emergency patch deployments Operate within the boundaries of the patching scope: end-user computing (EUC) patching remains with Intune and is out of scope, but interfaces and reporting handoffs must be understood Maintain patching runbooks, procedures, and change/incident records in the ITSM platform Participate in change reviews as part of the change advisory process Identify automation opportunities (scripting, Tanium sensors/actions, reporting dashboards), applying an AI-first approach to triage, exception handling, and compliance reporting Requirements 3+ years in infrastructure operations with hands-on patch management experience Tanium: Patch module, plus Deploy and Endpoint Config; sensors, actions, and packages Windows Server and Linux (RHEL/SUSE/Ubuntu) patching in enterprise environments AWS fundamentals: EC2, plus familiarity with AWS Patch Manager and Systems Manager (SSM) Ansible: reading and migrating playbooks (application patching) Scripting: PowerShell and/or Bash/Python for automation Experience with heterogeneous, multi-site estates, including branch/remote-site servers Awareness of Microsoft Intune patching for EUC (interface knowledge only) ITIL foundations: incident, change, and problem management Fluency in English with a proficiency level of B2 or higher Nice to have Tanium Certified Operator or equivalent certification AWS Certified SysOps Administrator / Cloud Practitioner certification