Senior Security Platform Engineer

Varmoda is seeking an experienced Senior Security Platform Engineer to engineer, integrate, and support enterprise security platforms across hybrid-cloud and on-premises environments.
This role focuses on vulnerability management, patching and remediation, endpoint security administration, and privileged access management (PAM) across Windows and Linux environments. The ideal candidate will have strong experience designing reliable enterprise services, troubleshooting complex infrastructure dependencies, automating operational workflows, and validating security and remediation outcomes across multiple security technologies.

Key Responsibilities

• Design, deploy, configure, upgrade, maintain, and troubleshoot enterprise vulnerability management, patch management, endpoint management, and privileged access platforms.
• Engineer asset discovery and security-platform coverage across servers, endpoints, and cloud workloads.
• Identify and remediate unmanaged assets, failed agents, stale inventories, and credentialed vulnerability-scanning gaps.
• Design and operate end-to-end patching and remediation workflows, including:
  • Risk-based prioritization
  • Test rings and pilot deployments
  • Change windows
  • Deployment validation
  • Rollback procedures
  • Post-remediation verification
• Correlate vulnerability findings with asset ownership, business criticality, exploit intelligence, ticketing workflows, exceptions, and remediation verification.
• Engineer Privileged Access Management (PAM) controls, including account discovery, credential vaulting and rotation, just-in-time access, least-privilege administration, session auditing, service accounts, and service identities.
• Diagnose platform outages and deployment failures involving agents, operating system services, firewalls, proxies, DNS, TLS certificates, credentials, APIs, and other infrastructure dependencies.
• Develop automation for deployment, remediation, compliance validation, platform health monitoring, and reporting using PowerShell, Python, Bash, APIs, and configuration-management technologies.
• Support platform upgrades, operational break/fix activities, incident response, root cause analysis, and backup/recovery validation.
• Develop and maintain technical runbooks and repeatable operational processes for support teams.

Required Qualifications

• 7+ years of hands-on experience in infrastructure engineering, endpoint engineering, security platform engineering, or a related discipline within large enterprise environments.
• Demonstrated experience designing, deploying, integrating, and supporting enterprise solutions for one or more of the following:
  • Vulnerability management
  • Patch and endpoint management
  • Privileged Access Management (PAM)
• Strong administration experience with Windows and Linux environments.
• Hands-on knowledge of patching technologies, agent lifecycle management, service troubleshooting, and large-scale software or configuration deployments.
• Practical knowledge of:
  • Authenticated vulnerability scanning
  • CVE and CVSS
  • CISA Known Exploited Vulnerabilities (KEV)
  • Exposure/risk-based vulnerability prioritization
  • Asset inventory and discovery
  • Remediation validation
• Experience supporting Active Directory/LDAP, privileged identities, service accounts, credential rotation, session controls, and least-privilege access.
• Strong troubleshooting knowledge of TCP/IP, DNS, TLS/PKI, proxies, firewalls, REST APIs, and logging/integration issues.
• Scripting and automation experience using PowerShell, Python, and/or Bash.
• Ability to create and maintain technical runbooks, implement automation, and troubleshoot business-critical production services.

Preferred Qualifications

• Tanium
• Qualys
• BeyondTrust
• Microsoft Intune / MECM
• BigFix
• Tenable
• Rapid7
• CyberArk
• Delinea
• ServiceNow integrations
• Splunk or other SIEM platforms
• AWS and Azure cloud workloads
• Git
• Infrastructure automation
• Configuration management technologies

Certifications & Clearance

• Cybersecurity / Vulnerability Management
• Privileged Access Management
• Windows or Linux Administration
• AWS or Microsoft Azure
• Security Engineering / Infrastructure Security