IT Security Engineer II

The Security Engineer II is a mid-level individual contributor responsible for implementing, administering, and maintaining the security controls that protect Sprouts' stores, systems, and data. Working across areas such as email, identity, endpoint, data, cloud, and network security, the role operates assigned security platforms following architectures, policies, and standards established by senior security engineers and architects.

The Security Engineer II is a mid-level individual contributor responsible for implementing, administering, and maintaining the security controls that protect Sprouts' stores, systems, and data. Working across areas such as email, identity, endpoint, data, cloud, and network security, the role operates assigned security platforms following architectures, policies, and standards established by senior security engineers and architects.

The role executes approved changes, responds to assigned security incidents and requests, performs audit-related security controls, and serves as an escalation point for Security Analysts and the Service Desk. Responsibilities include a mix of recurring operational activities, compliance support, incident response, and project-based implementation work.

Within established procedures, the Security Engineer II independently manages alert triage, remediation of compliance issues, and routine changes or exception requests within approved authority levels.

The role reports to our Store Support Office in Phoenix, AZ, with a hybrid work arrangement requiring in-office presence Tuesday through Thursday.

• Implement and modify enterprise security controls across the network, endpoint, cloud, identity, email, and data protection domains, to designs and standards set by the Security Engineer III and the IT Security Architect.
• Assess systems and security tooling, including Microsoft Azure workloads, against hardening baselines and CIS benchmarks; determine the remediation required; and implement approved changes.
• Configure proof-of-concept environments for security technologies under evaluation, run the agreed validation testing, and document capabilities, limitations, and results.
• Prepare and implement approved security platform changes through the enterprise change-management process, including test plans, rollback procedures, and post-implementation validation.

• Analyze security alerts and logs across email, endpoint, identity, network, and data protection tooling, including Crowd Strike NG-SIEM, and determine disposition against the documented severity matrix.
• Handle assigned security incidents and requests in Service Now through documented response procedures and approval limits: scope the event, coordinate containment and remediation, capture evidence, and document the outcome. Serve as the escalation point for security incidents and requests raised by the Security Analyst I and the Service Desk, and elevate decisions that fall outside those limits to the Security Engineer III or the Manager.
• Troubleshoot and restore security tooling, including agents, connectors, log feeds, and data integrations: diagnose failures, remediate coverage gaps, and ...
• Use and adapt the team's existing Power Shell and Python scripts, saved queries, and scheduled reports for recurring work in this role's scope, with support from senior engineering staff where needed, and identify manual work that would benefit from a durable integration.

• Administer identity security controls in Okta and Microsoft Entra n approved policy, including SSO and SAML application assignment, SCIM provisioning, MFA enrollment…