Senior Security Platform Engineer

SHR Consulting Group is seeking a Senior Security Platform Engineer to design, implement, and maintain security platforms that protect IT infrastructure. The role focuses on enterprise vulnerability, patch, endpoint, and privileged access platforms, including their operations, automation, and incident response.

Responsibilities:

• Design, deploy, configure, upgrade, and maintain enterprise vulnerability, patch management, endpoint management, and privileged access platforms
• Engineer asset discovery and platform coverage across servers, endpoints, and cloud workloads; resolve unmanaged assets, failed agents, stale inventories, and credentialed-scan gaps
• Design and operate patch/remediation workflows covering risk prioritization, test rings, pilot deployments, change windows, deployment success, rollback, and verification
• Connect vulnerability findings to asset ownership, business criticality, exploit intelligence, ticket workflows, exceptions, and scan-based remediation verification
• Engineer privileged access controls including account discovery, credential vaulting and rotation, just-in-time/least-privilege access, session auditing, and service identities
• Diagnose platform outages and deployment failures involving agents, OS services, firewalls, proxies, DNS, TLS certificates, credentials, APIs, and infrastructure dependencies
• Automate deployment, remediation, compliance checks, health monitoring, and reporting through scripting, APIs, and configuration management
• Own operational break/fix, upgrades, incident response, root cause analysis, backup/recovery validation, runbooks, and handoff to support teams

Requirements:

• Seven (7) or more years of relevant IT infrastructure, cybersecurity, endpoint management, or security platform engineering experience
• Demonstrated design, deployment, integration, and production support of one or more enterprise patch/endpoint, vulnerability management, or privileged access solutions
• Strong Windows and Linux administration, patch technologies, agent lifecycle management, service troubleshooting, and deployment at scale
• Practical knowledge of authenticated vulnerability scanning, CVE/CVSS, CISA KEV, exposure-based prioritization, asset inventory, and remediation validation
• Experience with privileged identities, Active Directory/LDAP, service accounts, credential rotation, session controls, and least-privilege administration
• Ability to troubleshoot TCP/IP, DNS, TLS/PKI, proxy and firewall paths, REST APIs, and logging/integration failures
• PowerShell, Python, or Bash scripting; ability to write runbooks, implement automation, and troubleshoot critical production services
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related field, or equivalent relevant experience
• U.S. Citizenship
• Experience with Tanium, Qualys, BeyondTrust or comparable tools (Intune/MECM, BigFix, Tenable, Rapid7, CyberArk, Delinea)
• ServiceNow integration, Splunk/SIEM, AWS/Azure cloud workloads, Git, infrastructure automation, and configuration management
• CISSP, CISM, or CompTIA CySA+ certification (Preferred)
• FEMA Public Trust is highly preferred