Sr IT Engineer Cloud Security

Ulta Beauty is a leading beauty retailer that emphasizes technological innovation and collaboration. The Senior Cloud Security Engineer will play a crucial role in automating and enforcing cloud security measures across the company's Google Cloud Platform ecosystem.

Responsibilities:

• Configure, deploy, and maintain data and infrastructure security controls across GCP and Azure environments (projects, folders, and org-level)
• Design and enforce Identity and Access Management (IAM) configurations — roles, service accounts, and permissions — following least-privilege and zero-trust principles
• Implement network security measures such as firewall rules, VPC Service Controls, Private Service Connect, and secure interconnects to safeguard data in motion
• Secure GCP and Azure services including Cloud Storage, GKE, Cloud SQL, Pub/Sub, Cloud Functions, and Dataflow with a focus on data confidentiality and workload isolation
• Implement data encryption and key management strategies using Cloud KMS, CMEK, and HSM integrations
• Automate configuration baselines, guardrails, and policy enforcement using Terraform, Cloud Build, or Deployment Manager
• Integrate cloud-native security tools (Security Command Center, Cloud Logging, Cloud Monitoring) for visibility, compliance, and anomaly detection
• Develop automation scripts and tooling (Python, PowerShell, Go) to detect, notify, and remediate misconfigurations or security drift
• Build and maintain CI/CD integrations for vulnerability scanning, policy validation, and data protection controls
• Use APIs and SDKs to connect cloud security data to central logging, SIEM, or analytics platforms (Chronicle, Splunk, Elastic)
• Implement automated workflows for security posture management, access reviews, and incident response
• Configure and tune alerts from CSPM tools (e.g., Prisma Cloud, Wiz) and GCP-native monitoring solutions for network and IAM anomalies
• Respond to cloud-related security incidents, including unauthorized access, network exposure, or data exfiltration attempts, by isolating resources and applying remediation
• Develop and maintain detection logic and dashboards to visualize network flows, IAM changes, and workload health
• Participate in post-incident reviews to strengthen controls for IAM, encryption, and workload security
• Execute security assessments on cloud workloads, data storage, network segmentation, and CI/CD processes
• Enforce compliance baselines (CIS, NIST 800-53, Google Blueprint standards) through automated policy checks and reporting
• Document security controls, policies, and exceptions with clear technical evidence and audit readiness
• Evaluate and report on data security risks, IAM misconfigurations, and network exposure across cloud environments
• Partner with DevOps, Infrastructure, and Application teams to embed security into pipelines, networks, and workloads
• Provide technical guidance on secure networking, identity federation, workload segmentation, and encryption
• Support operational troubleshooting for GCP IAM, firewall rules, policy enforcement, and resource access issues
• Participate in on-call rotations or off-hours support for security incidents, vulnerability patching, and data protection reviews

Requirements:

• 5+ years of experience in cloud security engineering, cloud operations, or DevSecOps (GCP preferred)
• Hands-on GCP expertise with strong understanding of IAM, networking, KMS, audit logging, and policy enforcement
• Strong scripting proficiency in Python, PowerShell, or similar languages
• Experience automating with Terraform, Cloud SDK, or GCP API integrations
• Familiarity with CI/CD tools (Jenkins, GitLab, Cloud Build) and integrating security scanning (e.g., Snyk, Trivy)
• Experience with CSPM solutions (Prisma Cloud, Wiz, Orca) and log analysis tools (Chronicle, Splunk, or Elastic)
• Working knowledge of federated identity, SAML, and Google Cloud Directory Sync (GCDS)
• Strong understanding of cloud security frameworks (CIS GCP, NIST CSF, ISO 27001)
• Google Cloud Certified – Professional Security Engineer
• ISC² CISSP or CCSP
• ISACA CISM, CISA, or equivalent
• Experience with container security (GKE, Artifact Registry, or Cloud Run)