Patch Management & Automation Consultant

Position Overview MetroSys is seeking an experienced Patch Management & Automation Consultant to support a regional credit union organization in assessing, improving, and modernizing its enterprise patch management program. The consultant will evaluate the client’s existing patching processes, technology, policies, and compliance posture, with a primary focus on Microsoft SCCM / Microsoft Configuration Manager . The environment is predominantly Microsoft-based but also includes Linux systems and infrastructure supporting banking and security operations. This is not strictly an SCCM administration position. The consultant will be expected to take a broader look at the organization’s patch and vulnerability management lifecycle, identify gaps and manual processes, recommend best practices, and determine where automation and AI-assisted capabilities can improve efficiency, visibility, compliance, and risk reduction. The initial engagement is expected to last approximately three months , with the potential for an extended engagement and/or permanent employment based on project needs. Key Responsibilities Perform a comprehensive assessment of the organization’s existing patch management program , including processes, policies, tools, workflows, reporting, and governance. Review the current SCCM / Microsoft Configuration Manager environment and evaluate its configuration, collections, deployment rings, maintenance windows, Software Update Groups, ADRs, compliance reporting, and overall effectiveness. Assess patching processes across a primarily Microsoft environment , while also reviewing requirements and processes for Linux and other supported infrastructure. Review the existing asset and system inventory and determine whether all applicable infrastructure is properly incorporated into patch management and compliance reporting. Identify gaps in patch coverage, automation, testing, deployment, exception management, remediation, and reporting. Evaluate opportunities to automate manual patch-management activities , including patch identification, prioritization, testing, approvals, deployments, compliance validation, remediation, and reporting. Identify practical opportunities to incorporate AI and AI-assisted operations into the patch and vulnerability management lifecycle without introducing unnecessary security or operational risk. Develop recommendations for improving patch prioritization based on vulnerability severity, exploitability, business criticality, and infrastructure risk. Review patching practices for systems supporting banking, security, and regulated workloads , considering applicable PCI and financial-services security requirements. Establish or improve patching standards, deployment rings, maintenance windows, emergency/zero-day patching procedures, rollback procedures, and exception-management processes. Develop dashboards, reports, and measurable KPIs for patch compliance, outstanding vulnerabilities, failed deployments, exceptions, and remediation timelines. Work with infrastructure, security, compliance, and business stakeholders to ensure patch-management processes align with organizational requirements. Recommend a future-state patch-management architecture and create a prioritized roadmap for remediation, automation, and modernization. Where appropriate, assist with implementing approved improvements during the initial engagement rather than limiting the project to assessment and recommendations. Provide documentation and knowledge transfer to internal IT and security teams. Expected Initial Engagement During the initial three-month engagement, the consultant will be expected to deliver: Current-State Assessment: Document the existing patch-management environment, processes, technologies, risks, and gaps. SCCM Health & Configuration Review: Evaluate the current SCCM patching architecture and identify configuration and operational improvements. Patch Coverage Assessment: Validate coverage across Microsoft, Linux, cloud, infrastructure, and other applicable systems. Risk & Compliance Gap Analysis: Identify patching practices that may create security, operational, PCI, or financial-services compliance concerns. Automation & AI Assessment: Identify manual activities that can be safely automated and practical areas where AI-assisted capabilities could provide value. Future-State Roadmap: Develop prioritized recommendations for improving patch management, including quick wins and longer-term initiatives. Implementation Support: Begin implementing approved improvements, automation, reporting, and process changes as time permits. Documentation & Knowledge Transfer: Establish repeatable processes that can be managed by the internal team after the engagement. Required Qualifications 5+ years of experience supporting enterprise infrastructure, patch management, endpoint management, vulnerability management, or related disciplines. Strong hands-on experience with Microsoft SCCM / Microsoft Configuration Manager and enterprise software update management. Experience designing and managing patch deployment strategies, including testing groups, deployment rings, maintenance windows, automated deployment rules, and production rollouts. Strong understanding of Windows Server and Microsoft enterprise environments . Working knowledge of Linux patching and lifecycle management . Experience assessing existing IT environments and developing actionable remediation and modernization plans. Experience with scripting and automation technologies such as PowerShell, APIs, Power Automate, Azure Automation, or similar tools . Understanding of vulnerability management and risk-based patch prioritization. Experience producing patch-compliance reporting, dashboards, KPIs, and audit evidence. Strong understanding of change management, testing, rollback, exception management, and emergency patching procedures. Ability to communicate effectively with infrastructure engineers, security teams, compliance personnel, and IT leadership. Preferred Qualifications Previous experience within a credit union, bank, financial institution, or other highly regulated environment . Understanding of PCI DSS and financial-services security and compliance requirements. Familiarity with Microsoft cloud technologies such as Azure, Intune, Entra ID, Azure Automation, and Microsoft security platforms . Experience integrating SCCM with vulnerability-management, ITSM, security, or reporting platforms. Experience implementing automation within infrastructure or security operations. Familiarity with AI-assisted IT operations , Microsoft Copilot capabilities, or the application of AI to vulnerability and patch-management workflows. Experience developing patch-management SOPs, governance standards, and audit-ready documentation. Consulting experience and the ability to independently lead discovery sessions, assessments, recommendations, and implementation activities.