Senior Security Engineer (Tanium)

We are looking for a Senior Security Engineer to join the security engineering team, delivering, among others, patch management services. The team owns patch operations across the client’s server and cloud estate and drives the migration of legacy patching approaches onto Tanium.

Scope is branch and data-centre servers, native EC2 workloads in AWS, and a the migration of fragmented other patching approaches (AWS Patch Manager, SSM patching, Ansible-based application patching) onto Tanium.

Responsibilities

• Plan and execute patch cycles via Tanium Patch for Windows and Linux servers, including branch servers
• Patch native EC2 instances in AWS using Tanium, in line with the target operating model
• Support the phased decommissioning of AWS Patch Manager and SSM-based patching, migrating affected workloads to Tanium
• Migrate application patching currently run through Ansible to Tanium: analyze existing playbooks, design equivalent Tanium patch/deployment packages, test, and cut over
• Manage Tanium patch configuration: patch lists, blocklists, maintenance windows, deployment rings, and endpoint groupings
• Track and report patch compliance by priority and deadline; analyze failures and drive remediation
• Coordinate with the Security team on vulnerability-driven patching and critical/emergency patch deployments
• Operate within the boundaries of the patching scope: end-user computing (EUC) patching remains with Intune and is out of scope, but interfaces and reporting handoffs must be understood
• Maintain patching runbooks, procedures, and change/incident records in the ITSM platform
• Participate in change reviews as part of the change advisory process
• Identify automation opportunities (scripting, Tanium sensors/actions, reporting dashboards), applying an AI-first approach to triage, exception handling, and compliance reporting

Requirements

• 3+ years in infrastructure operations with hands-on patch management experience
• Tanium: Patch module, plus Deploy and Endpoint Config; sensors, actions, and packages
• Windows Server and Linux (RHEL/SUSE/Ubuntu) patching in enterprise environments
• AWS fundamentals: EC2, plus familiarity with AWS Patch Manager and Systems Manager (SSM)
• Ansible: reading and migrating playbooks (application patching)
• Scripting: PowerShell and/or Bash/Python for automation
• Experience with heterogeneous, multi-site estates, including branch/remote-site servers
• Awareness of Microsoft Intune patching for EUC (interface knowledge only)
• ITIL foundations: incident, change, and problem management
• Fluency in English with a proficiency level of B2 or higher

Nice to have

• Tanium Certified Operator or equivalent certification
• AWS Certified SysOps Administrator / Cloud Practitioner certification

Benefits

• Opportunity to work in a fast-paced, agile, software engineering culture
• Comfortable modern office in Prague 7, with support of hybrid or fully remote mode
• Benefit program (5 weeks of vacation, paid sick days, paid days off for special occasions, meal vouchers, flexi pass, Prague city public transport annual coupon, multisport cards, optional contribution to pension fund, health insurance for family member)
• EPAM Employee Stock Purchase Plan (ESPP) (subject to certain eligibility requirements)
• English language courses
• Czech language courses upon request
• Referral bonuses for recommended candidates
• Mobile Phone Tariff’s program for managerial-level candidates
• Great learning and development opportunities, including in-house professional training, career advisory and coaching, sponsored professional certifications, well-being programs, LinkedIn Learning Solutions and much more