Cloud Security Engineer

Live the experience . From professional empowerment to continual learning opportunities. From ongoing investment in new and emerging technologies to a career of self-determination. At Ulta Beauty, our tech team is critical to our scalability—and is recognized that way. We’ve been defined as a “mature start-up.” A place where interdepartmental exposure, open doors, and genuine collaboration is ubiquitous. Where challenges come fast and furious, requiring agility, mental dexterity, and creativity. Where our passion for better solutions drives us and is core to who we are.   We’re engineering for the future of retail, and it’s no-holds-barred. But for those motivated by continual change and ambiguity, by superior leadership, by whip smart colleagues who will press you daily for your very best, you’ll find that virtually nothing’s impossible at Ulta Beauty. THE IMPACT YOU CAN HAVE:  Ulta Beauty is seeking a Cloud Security Engineer with hands-on, technical experience in securing our cloud platforms and modern application environments. This role will focus on implementing and improving cloud security controls , monitoring and responding to security findings, supporting compliance initiatives , and partnering with engineering and project teams to integrate security into cloud and application workflows . Ulta’s environment is primarily based within Google Cloud Platform (GCP) , with a smaller Azure footprint supporting a subset of applications. The ideal candidate is a hands-on engineer who can solve technical security challenges across Cloud Infrastructure , IAM , data and workload protection , and DevOps (CI/CD) processes. Success in this role requires strong collaboration and communication skills , as you will work closely with infrastructure, platform, and application teams to improve security while enabling business objectives. YOU'LL ACCOMPLISH THESE GOALS BY:  Cloud Security Implementation Implement and maintain cloud security controls across GCP and Azure environments, including projects, subscriptions, and organizational structures. Assist in the design, deployment, and continuous improvement of cloud security guardrails, baseline configurations, and policy enforcement mechanisms. Support Identity and Access Management (IAM) initiatives and operational activities, including least-privilege access, privileged account/identity management, service account governance, and identity federation in the cloud, always following zero-trust principles. Secure cloud services, workloads, and data platforms through configuration reviews, hardening activities, and security best practices; including but not limited to VPC Service Controls, NSGs, Cloud Storage, GKE, BigQuery, Cloud SQL, Pub/Sub, Cloud Functions, and Cloud Run. Support container and workload security initiatives, including hardened container image adoption, image scanning for CVEs, and secure deployment practices (DevSecOps). Support defining and implementing encryption, key management, and data protection practices and controls across cloud environments. Contribute to security automation efforts using Infrastructure as Code (IaC), scripting, and cloud-native tooling to improve operational efficiency and reduce manual processes. Integrate and maintain cloud-native and third-party security tools to improve visibility, posture management, and threat detection to improve overall security posture. Support the implementation of security controls within CI/CD pipelines, including vulnerability scanning, secrets detection, and policy validation (DevSecOps). Assist development teams with secure cloud architecture patterns and application deployment practices. Monitoring & Incident Response Monitor and tune cloud security alerts, vulnerabilities, and findings from cloud-native and third-party CSPM and CNAPP tools Investigate suspicious activity, misconfigurations, exposed secrets, and potential security incidents within cloud environments. Support incident