Sr IT Engineer Cloud Security

Live theexperience. From professional empowerment to continual learning opportunities. From ongoing investment in new and emerging technologies to a career of self-determination. At Ulta Beauty, our tech team is critical to our scalability—and is recognized that way. We've been defined as a “mature start-up.” A place where interdepartmental exposure, open doors, and genuine collaboration is ubiquitous. Where challenges come fast and furious, requiring agility, mental dexterity, and creativity.

Whereour passion for better solutionsdrives us and is core to who we are.

We're engineering for the future of retail, and it's no-holds-barred. But for those motivated by continual change and ambiguity, by superior leadership, by whip smart colleagues who will press you daily for your very best, you'll find that virtually nothing's impossible at Ulta Beauty.

THE IMPACT YOU CAN HAVE:

You'll be a key contributor in automating and enforcing cloud security across Ulta Beauty's GCP ecosystem — building guardrails, securing workloads, and integrating real-time detection and remediation capabilities to keep our cloud environments safe and compliant a Beauty is seekinga Senior Cloud Security Engineer with deep, hands-on experience in securing and automating workloads within Google Cloud Platform (GCP). This role is responsible for implementing and maintaining scalable security controls, integrating security into CI/CD pipelines, and automating monitoring and remediation processes to protect data, identities, and workloads across cloud environments.

The ideal candidate has strong technical depth inGCP IAM, network security, and workload protection, with a focus onexecution and automation, not architecture or solution design.

YOU'LL ACCOMPLISH THESE GOALS BY:

• Configure, deploy, and maintaindata and infrastructure security controlsacross GCP and Azure environments (projects, folders, and org-level).
• Design and enforceIdentity and Access Management (IAM)configurations— roles, service accounts, and permissions — followingleast-privilege and zero-trust principles.
• Implementnetwork security measuressuch as firewall rules, VPC Service Controls, Private Service Connect, and secure interconnects to safeguard data in motion.
• Secure GCP and Azure services includingCloud Storage, GKE, Cloud SQL, Pub/Sub, Cloud Functions, and Dataflowwith a focus ondata confidentiality and workload isolation.
• Implementdata encryption and key managementstrategies usingCloud KMS, CMEK, and HSM integrations.
• Automate configuration baselines, guardrails, and policy enforcement usingTerraform, Cloud Build, or Deployment Manager.
• Integrate cloud-native security tools (Security Command Center, Cloud Logging, Cloud Monitoring) forvisibility, compliance, and anomaly detection.
• Develop automation scripts and tooling (Python, Power Shell, Go) to detect, notify, and remediate misconfigurations or security drift.
• Build and maintainCI/CD integrationsfor vulnerability scanning, policy validation, and data protection controls.
• Use APIs and SDKs to connect cloud security data to central logging, SIEM, or analytics platforms (Chronicle, Splunk, Elastic).
• Implement automated workflows forsecurity posture management, access reviews, and incident response.

• Configure and tune alerts fromCSPM tools(e.g., Prisma Cloud, Wiz) and GCP-native monitoring solutions for network and IAM anomalies.
• Respond tocloud-related security incidents, including unauthorized access, network exposure, or data exfiltration attempts, by isolating resources and applying remediation.
• Develop and maintaindetection logic and dashboardsto visualize network flows, IAM changes, and workload health.
• Participate in post-incident reviews to strengthen controls for IAM, encryption, and workload security.

• Executesecurity assessmentson cloud workloads, data storage, network segmentation, and CI/CD processes.
• Enforce compliance baselines (CIS, NIST 800-53, Google Blueprint standards) throughautomated policy checks and reporting.
• Document security controls, policies, and exceptions with clear technical evidence and audit…