This is explained in the Age of Ultron prelude comic, The Sceptre’d Isle.
SHIELD had recovered the sceptre from Stark Tower, and are studying it a la Tesseract. (Indeed, one of their scientists makes comments about how similar it is to the Tesseract.) One of the technicians working on the sceptre is a disgruntled agent called Mark Smith. He’s just been pulled from field duty to work in the lab after failing a psychological assessment.
Smith is approached by Baron von Strucker, who offers him a position in HYDRA. (Apparently his psych results shows that he’s unhappy with the running of SHIELD, and might be sympathetic to HYDRA.) He accepts, and kills his lab partner, then steals the sceptre and takes it to von Strucker’s base in Sokovia.
We get further detail in Avengers: Endgame (spoilers, obviously):
When Steve travels back in time to 2012, he sees his old STRIKE team and Agent Sitwell have picked up the sceptre. For consistency with the events described above, I’d suggest they couldn’t steal it immediately (too obvious and suspicious), but took it to a lab with some techs they knew they could probably turn.
Simply wandering off with it straight after the Battle of New York would draw a lot of unwanted attention – but if they take it to a SHIELD lab and it happens to be stolen from the lab by somebody else… well, wouldn't that be a shame.