Senior Application Infra Patch Engineer

L2 Senior Application Infrastructure Patch Management Engineer

The L2 Senior Application Infrastructure Patch Management Engineer owns the patching lifecycle for the full application layer including web servers, application servers, middleware components, messaging queues, and database engines. The role requires deep technical expertise to design patching runbooks, automate patch workflows, resolve complex compatibility issues, and align patching activities with vulnerability management and change management processes.

Key Responsibilities

• Manage end-to-end patching for web servers (Apache HTTP, Nginx, IIS), application servers (Tomcat, JBoss/Wild Fly, Web Logic, Web Sphere), and middleware (MQ, ActiveMQ, Kafka) across on-prem and cloud environments.
• Own the Java / JDK / JRE version management strategy across the application estate.
• Assess vendor CVEs and security bulletins for application components; drive patch prioritisation using CVSS scores and application criticality.
• Develop and maintain detailed patching runbooks, rollback procedures, and post-validation scripts for each platform.
• Automate patching workflows using Ansible, Python, or shell scripting; integrate with CI/CD pipelines where applicable.
• Lead patch testing in non-production environments; validate application behaviour and performance post-patch before production rollout.
• Co-ordinate with DBA teams for database patching (Oracle PSU/RU, MS SQL CU, MySQL updates) and ensure application compatibility.
• Act as L2 escalation for patch-related application failures, class loader conflicts, and compatibility issues.
• Integrate application patch compliance data with vulnerability management tools (Qualys, Tenable) and SIEM dashboards.
• Conduct root cause analysis for patch-induced incidents; produce post-incident reports.
• Maintain CMDB accuracy for application component versions and patch status.
• Drive SLA adherence:
  Critical patches applied within 72 hours post-approval.
• Mentor L1 analysts; review change records and patching logs.

Technical Skills & Knowledge

• Deep expertise in application server administration:
  Apache Tomcat, JBoss/Wild Fly, Oracle Web Logic, IBM Web Sphere, Microsoft IIS.
• Java platform mastery: JDK/JRE lifecycle, version compatibility, class loading issues, GC tuning, and security manager updates.
• Middleware patching: IBM MQ, ActiveMQ, RabbitMQ, Apache Kafka – upgrade procedures and backward compatibility.
• Database patching knowledge:
  Oracle (PSU, RU, one-off patches), MS SQL Server (CU, GDR), MySQL/PostgreSQL minor/major upgrades.
• Web server security hardening post-patch: cipher suite updates, TLS/SSL certificate management, module disabling.
• Automation:
  Ansible playbooks, Python (Paramiko / Fabric), Bash for patching orchestration.
• CI/CD integration:
  Jenkins, Git Lab CI, Azure Dev Ops – automated patching pipelines in lower environments.
• Cloud: AWS (EC2 patch via SSM), Azure (Update Manager), container image patching (Docker base image updates).
• Vulnerability management:
  Qualys Web Application Scanning, Tenable.io, Nexus/Trivy for container vulnerabilities.
• ITSM:
  Service Now change management, CMDB, and automated compliance workflows.

Soft Skills & Competencies

• Strong analytical skills to diagnose complex application compatibility issues post-patch.
• Excellent planning and risk communication for patching highly critical production systems.
• Collaborative approach with DBA, application development, and security teams.
• Thorough documentation – clear runbooks, RCAs, and compliance evidence.
• Continuous improvement mindset – automates repetitive tasks and drives toolchain maturity.