Cybersecurity Awareness Lead

OVERVIEW

Live the experience
. From professional empowerment to continual learning opportunities. From ongoing investment in new and emerging technologies to a career of self-determination. At Ulta Beauty, our tech team is critical to our scalability—and is recognized that way. We’ve been defined as a “mature start-up.” A place where interdepartmental exposure, open doors, and genuine collaboration is ubiquitous. Where challenges come fast and furious, requiring agility, mental dexterity, and creativity.

Where our passion for better solutions drives us and is core to who we are.

We’re engineering for the future of retail, and it’s no-holds-barred. But for those motivated by continual change and ambiguity, by superior leadership, by whip smart colleagues who will press you daily for your very best, you’ll find that virtually nothing’s impossible at Ulta Beauty.

The Cybersecurity Awareness Lead is responsible for developing and executing a comprehensive security awareness and training program that empowers employees to recognize and mitigate cyber risks. This role focuses on fostering a strong security culture across the organization through engaging education campaigns, targeted training, and measurable behavior change initiatives.

The Cybersecurity Awareness Lead will design and deliver content tailored to diverse audiences, leveraging modern communication strategies, behavioral science principles, and industry best practices. They will partner with business units, HR, and IT teams to integrate security awareness into onboarding, compliance programs, and daily workflows. Additionally, the role involves monitoring program effectiveness through metrics, phishing simulations, and feedback loops, ensuring continuous improvement and alignment with organizational risk objectives.

• Program Strategy & Development
  • Design and implement a comprehensive cybersecurity awareness and training program aligned with organizational risk objectives
  • Develop annual awareness plans, campaigns, and initiatives to foster a strong security culture
  • Incorporate behavioral science principles to drive measurable security behavior change
• Content Creation & Delivery
  • Create engaging, role-based training content for employees, contractors, and third parties
  • Develop multimedia materials (videos, infographics, newsletters) and interactive learning modules
  • Tailor messaging for different audiences, including executives, technical teams, and general staff
• Phishing Simulation & Behavioral Testing
  • Plan and execute phishing simulation campaigns to measure user susceptibility
  • Analyze results and provide targeted follow-up training for high-risk groups
  • Continuously refine simulations based on emerging phishing tactics and threat trends
• Metrics & Reporting
  • Define KPIs for awareness effectiveness (e.g., phishing click rates, training completion rates)
  • Produce dashboards and reports for leadership, highlighting program impact and areas for improvement
  • Use data-driven insights to adjust awareness strategies and content
• Stakeholder Engagement
  • Partner with HR, IT, and business units to integrate security awareness into onboarding and compliance programs
  • Collaborate with communications teams to ensure consistent messaging across channels
  • Act as a trusted advisor to leadership on security culture initiatives
• Threat Intelligence & Continuous Improvement
  • Stay current on emerging cyber threats and incorporate relevant topics into awareness campaigns
  • Benchmark program maturity against industry standards (e.g., NIST, SANS Security Awareness)
  • Evaluate and implement new tools, platforms, and gamification techniques to enhance engagement
• Governance & Compliance
  • Ensure awareness programs meet regulatory and compliance requirements (e.g., ISO 27001, PCI DSS)
  • Maintain documentation for audits and certifications
  • Support risk management by aligning awareness initiatives with organizational policies
• Incident Response Support
  • Provide rapid awareness communications during security incidents or zero-day vulnerabilities
  • Develop playbooks for emergency messaging and employee guidance during crises

• An ability to…