Meijer, founded in 1934, is a privately owned, family-operated retail chain running more than 500 locations across six states - from supercenters and grocery stores to neighborhood markets and express formats. That footprint means the attack surface is massive: point-of-sale infrastructure spanning hundreds of sites, a sprawling supply chain, payment processing at scale, and the usual enterprise IT backbone supporting over 70,000 team members. The threat model is standard big-box retail - credential stuffing, POS malware, third-party vendor risk, and the perpetual pressure to keep checkout lanes and inventory systems running while hardening environments that were never designed to be air-gapped.
Cybersecurity here isn't theoretical. It's protecting transaction data flowing through one of the Midwest's largest retail operations, securing cloud and on-prem hybrid infrastructure, and managing endpoint diversity across stores, distribution, and corporate. The company's community-first philosophy - donating more than 6 percent of net profit annually - suggests a long-term orientation, which in practice tends to mean stability for security teams rather than constant reorg-driven churn.
For security practitioners, the draw is operational gravity. You're defending real infrastructure at real scale, dealing with concrete domains: network segmentation across hundreds of sites, identity and access management for a workforce that turns over, vulnerability management across a heterogeneous estate, and incident response that has to account for physical and digital vectors simultaneously. It's not a startup pivoting every quarter - it's a 90-year-old retailer that needs its security posture to match the weight of its operations.
