Career roadmap
Cloud Security Engineer
Secure the accounts, identities and workloads that everything now runs on, with guardrails rather than tickets.
Before you start Cloud Security
- Working knowledge of one cloud provider
- Security fundamentals: identity, network, crypto
- Infrastructure as code basics
Cloud identity
In cloud, identity is the perimeter, and IAM is where the real attack paths live.
Policy evaluation logic is subtle and heavily interviewed.
- Policy evaluation and explicit deny
- Roles, trust policies and assume-role chains
- Permission boundaries and SCPs
- Resource-based versus identity-based policy
Knowing the escalation primitives is what makes an IAM review meaningful.
- PassRole and service escalation paths
- Policy modification escalation
- Cross-account trust abuse
- Automated path analysis tooling
Eliminating long-lived keys is the single biggest cloud credential improvement.
- SSO federation into cloud
- OIDC for CI pipelines
- Workload identity for Kubernetes
- Eliminating static access keys
KMS design and key policy, including who can decrypt what.
- KMS key policies and grants
- Envelope encryption
- Secret rotation automation
- Customer-managed keys and BYOK
Blast radius is decided by account boundaries more than by any control.
- Multi-account strategy
- Organisational policies and guardrails
- Environment isolation
- Break-glass access design
BuildAudit an account's IAM, find three privilege escalation paths, and remediate them.
Workload and data security
Securing what runs and what is stored, across compute types.
Private by default, with deliberate and reviewed exceptions.
- VPC design and private subnets
- Security groups versus NACLs
- Private endpoints and egress control
- Perimeter services and WAF
Public buckets remain the most reported cloud data exposure.
- Storage access controls and public access blocks
- Encryption at rest configuration
- Data classification and tagging
- Backup immutability
Most cloud workloads are containerised, which adds a whole control surface.
- Image scanning and admission control
- Pod security and workload identity
- Network policy in the cluster
- Runtime detection
Different attack surface: permissions, event sources and dependencies.
- Function permissions and least privilege
- Event source validation
- Dependency and layer risk
- Cold start and timeout abuse
Continuous configuration assessment across accounts.
- CSPM tooling and benchmarks
- Drift detection and auto-remediation
- Prioritising findings by exploitability
- Reporting posture over time
BuildApply and verify encryption, network isolation and least privilege for a real workload.
Detection in cloud
Cloud incidents look nothing like on-premises ones. Detection must be built for it.
Control plane logs are the primary evidence source in any cloud incident.
- CloudTrail and equivalent audit logs
- Data plane versus control plane events
- Centralised log aggregation
- Log integrity and tamper protection
Specific detections for specific cloud attacker behaviours.
- Anomalous API call patterns
- New region and new principal activity
- Credential exfiltration indicators
- Persistence via IAM changes
Containment in cloud is different, faster, and more reversible if planned.
- Isolating a compromised instance or role
- Revoking sessions and rotating credentials
- Snapshot-based forensics
- Cross-account investigation
Knowing how cloud attacks actually unfold, rather than generic threat talk.
- Metadata service SSRF chains
- Exposed credential harvesting
- Supply chain into cloud pipelines
- Cryptomining as an early indicator
Testing your detections against real technique execution in a safe account.
- Cloud attack simulation tooling
- Purple team exercises in cloud
- Detection coverage mapping
- Safe execution boundaries
BuildBuild detections for five cloud attack techniques and validate them with simulated activity.
Automation and governance
Guardrails that prevent, and automation that remediates without a ticket queue.
Blocking a misconfiguration is worth more than detecting a hundred.
- Service control policies
- Policy as code in pipelines
- IaC scanning before apply
- Deny-by-default patterns
Closing findings without a human, safely and reversibly.
- Event-driven remediation functions
- Safety rails and dry-run modes
- Notification and audit trails
- Handling remediation failures
The pipeline has production credentials, which makes it a primary target.
- CI credential scoping with OIDC
- Protecting IaC state files
- Artefact signing and verification
- Preventing pipeline privilege escalation
Continuous evidence rather than an annual scramble.
- Mapping controls to frameworks
- Automated evidence collection
- Audit reporting
- Shared responsibility boundaries
Security tooling and log retention can become the biggest line item.
- Log retention tiering
- Tool consolidation decisions
- Cost of detection coverage
- Justifying spend to leadership
BuildShip a preventive guardrail and an auto-remediation for one high-risk misconfiguration class.
Certification and interviews
Cloud security interviews combine IAM depth, incident scenarios and automation.
Cloud security certifications carry weight and are usually employer-funded.
- AWS Security Specialty
- Azure or Google security certifications
- CCSK and CCSP
- Kubernetes security certification
Expect a policy to read and an escalation path to find.
- Evaluate a policy out loud
- Identify the escalation path
- Design least privilege for a workload
- Explain cross-account access safely
Credentials leaked publicly: what do you do, in what order.
- Leaked access key response
- Compromised instance containment
- Determining blast radius from logs
- Communicating during a cloud incident
Design a secure multi-account landing zone with guardrails.
- Account structure and isolation
- Centralised logging design
- Network topology and egress
- Balancing control with developer velocity
Public guardrail and detection code is the strongest possible evidence.
- Open-source policy repository
- Cloud detection rules
- A misconfiguration remediation project
- Write-ups of cloud attack paths
BuildA public repository of security guardrails and detections for one cloud provider.
Cloud Security tools on your CV
- AWS / Azure / GCP
- Terraform
- OPA / Cloud Custodian
- Prowler / ScoutSuite
- CloudTrail
- Kubernetes
- Python
What Cloud Security employers ask to see
- An IAM audit with escalation paths found and fixed
- A guardrail repository preventing real misconfigurations
- Cloud detection rules with validation evidence
- A cloud security certification
Cloud misconfiguration is the leading cause of large data exposures, and the specialism is short-staffed everywhere. Combines the two highest-demand areas in the market.
Content last reviewed 2026-08-31. Guidance only — no institute or paid placement is endorsed anywhere in this book.