Senior Infrastructure Engineer - Vulnerability/Server

Lumenalta is seeking a Senior Infrastructure Engineer to own vulnerability remediation and server operations for a client in the regulated banking domain. The role focuses on securing and maintaining a hybrid Azure and on-premises environment, remediating findings across servers, containers, and applications, and documenting operational procedures.

Responsibilities:

• Hybrid server operations. Patch, upgrade, and harden Windows Server and Linux systems running as Azure VMs and as physical or hosted servers in on-premises and third-party data centers, using Azure Update Manager and configuration baselines such as CIS benchmarks
• Vulnerability remediation ownership. Own findings from penetration tests and scanners such as Microsoft Defender for Cloud, Qualys, or Tenable: triage, prioritize, remediate, verify, and close each item
• Exception management. Track risk exceptions and compensating controls, keep their status current, and drive them to resolution with the right owners
• Patch and upgrade management. Plan maintenance windows, reboots, rollback plans, and stakeholder communication for patching and end-of-life software upgrades across the estate
• Configuration management. Maintain server configurations and detect and correct drift, using tooling such as Ansible, PowerShell DSC, or Intune
• Container and application layer fixes. Where findings land above the operating system, rebuild base images, upgrade dependencies and runtimes, and fix insecure configuration and secrets handling for workloads on AKS and App Service, rolling remediated workloads out safely in coordination with the application platform engineer
• Pipeline and monitoring integration. Build vulnerability scanning into CI/CD pipelines, and set up monitoring and alerting so new findings and regressions are caught early
• Networking and documentation. Work with networking teams on required NSG (network security group), private endpoint, and VNet changes, and write runbooks for remediation and patching procedures

Requirements:

• 7+ years of experience in infrastructure or operations, with at least 3 years hands-on in Azure
• Strong Windows Server and Linux administration in production across a hybrid estate: Azure VMs alongside physical or hosted servers in on-premises or third-party data centers
• Proven ownership of vulnerability remediation from penetration test and scanner findings, including exception tracking, patching, software upgrades, and configuration fixes across OS, container, and application layers, from finding to closure
• Patch and upgrade management at scale, including maintenance windows, rollback planning, and change control
• Experience with configuration management and hardening baselines (CIS or similar)
• Working knowledge of the container and application layers, enough to remediate findings on AKS workloads and App Services with support from the platform team
• Experience integrating scanning, monitoring, and alerting into CI/CD and operations workflows
• Working knowledge of Azure networking, including VNets, private endpoints, and NSGs
• Strong documentation habits and the ability to work independently with a high degree of ownership
• Advanced English and the ability to communicate technical issues clearly to engineers and client stakeholders in a distributed, remote team
• Experience with Microsoft Defender for Cloud, Defender for Endpoint, Qualys, Tenable, or container scanners such as Trivy
• Automation with PowerShell, Bash, or Ansible
• Familiarity with regulatory and audit frameworks such as PCI DSS or SOC 2
• Experience in banking, financial services, or other regulated environments
• Consulting or client-facing delivery experience
• Infrastructure as code with Terraform or Bicep
• Certifications such as AZ-500, AZ-104, or CompTIA Security+