Lead Vulnerability Remediation Engineer-Infrastructure Engineer

The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status. Need Help? If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response). Regular or Temporary: Regular Language Fluency:  English (Required) Work Shift: 1st shift (United States of America) Please review the following job description: The Lead Infrastructure Engineer within Truist’s Digital Workplace organization is accountable for enterprise governance, risk reduction, and lifecycle oversight of endpoint vulnerabilities and configuration compliance across physical and virtual (VDI) environments. This role partners across engineering, operations, and security stakeholders to identify, prioritize, remediate, and prevent endpoint security exposures while producing defensible, repeatable, and scalable solutions aligned to Truist standards. This position supports a proactive operating model emphasizing automation, prevention, and measurable outcomes. Specific job Function: 1) Endpoint Vulnerability Management (Enterprise Scale) • Operate and mature the endpoint vulnerability lifecycle: discovery → prioritization → remediation → validation → reporting. • Perform vulnerability identification and prioritization using Qualys and or other security agents, including (but not limited to) Microsoft Security Updates and major 3rd party applications (e.g., Chrome, Edge, legacy dependencies where applicable). • Drive risk-based remediation workflows aligned to business impact, exploitability, and fleet exposure. • Validate remediation efficacy and ensure vulnerability closure is auditable and reproducible. 2) Secure Baseline Configuration (SBC) & Compliance (Windows 11 + VDI) • Own Secure Baseline Configuration compliance outcomes for Windows 11 across physical devices and VDI. • Detect and correct compliance drift; build governance routines to prevent recurring deviation. • Translate policy intent into enforceable configuration standards and operational guardrails. 3) Problem Management (Root Cause + Corrective Actions) • Lead or co-lead root cause analysis for recurring endpoint issues and systemic remediation failures. • Develop long-term corrective actions, workarounds, and knowledge artifacts that reduce repeat incidents. • Align problem practices to Digital Workplace Problem Management goals, templates/artifacts, tooling/automation, and metrics. 4) Configuration Management & Deployment Enablement (SCCM / MECM) • Leverage Microsoft Endpoint Configuration Manager (SCCM/MECM) to support remediation delivery at scale (packages, deployments, compliance baselines, reporting). • Troubleshoot deployment failures and endpoint state issues impacting remediation timelines. • Partner with endpoint engineering and operations teams to harden delivery pipelines and reduce rework. 5) Automation & Engineering Enablement (PowerShell + Workflows) • Create and maintain PowerShell automation to reduce manual effort, accelerate remediation, and improve consistency. • Build automation patterns for detection, enforcement, validation, and reporting (including safe failure handling and rollback considerations). • Integrate automation into operational workflows (e.g., Service Management processes) to increase throughput and reduce friction. 6) Data, Reporting, and Decision Support (Databases) • Use SQL and relational database concepts to support remediation tracking, compliance analytics, trend analysis, and operational reporting. • Define data-quality expectations (integrity, lineage, reproducibility) and produce