careers
Cloud Security Engineer
Keep cloud environments configured, monitored and recoverable as they grow.
A cloud security engineer designs and verifies the controls of cloud environments: identities, networks, data protection, workloads and detection. The work is mostly about preventing misconfiguration at scale and noticing quickly when something drifts or is abused.
see this path on the journey mapA day in the job
- Design least-privilege identity and access, and review the permissions that creep in over time.
- Segment networks and protect data with encryption and well-managed keys.
- Watch posture continuously and fix drift before it becomes an incident.
- Secure containers and Kubernetes clusters, and watch workloads at runtime.
- Build the logging and response playbooks used when an account is compromised.
Stage 1· Foundations
Get identity, network and logging right: they underpin everything.
Study here
- IAM - identity and access
- Network - segmentation and zero-trust
- Logging & detection - signals and alerts
Learn elsewhere
- Core services of one cloud provider (compute, storage, networking)
- Networking fundamentals: TCP/IP, DNS, TLS
- The shared responsibility model
Build this
Set up a small cloud account with least-privilege roles, a private network and centralized audit logs.
Stage 2· Practitioner
Protect data, secrets and workloads, and verify posture continuously.
Study here
- KMS & crypto - keys and envelopes
- Secrets - vaults and rotation
- Containers - images and supply chain
- CSPM - cloud posture
- Zero-trust - trust model
Learn elsewhere
- A second cloud provider, to see which ideas are universal
- Scripting for automation (Python or similar)
- Compliance frameworks at a high level
Build this
Write checks for five common misconfigurations, run them against your account and fix what they find.
Stage 3· Advanced
Defend clusters and respond when something goes wrong.
Study here
- Kubernetes - secure runtime
- CWPP - workload protection
- Cloud incident response
- Secure infrastructure as code
- Policy as code
Learn elsewhere
- Cloud forensics and evidence handling
- Multi-account landing-zone design
- Threat modeling cloud architectures
Build this
Simulate a leaked access key, contain it using your own runbook and write the post-incident review.
What to show
- A reference architecture for a secure account structure, with the reasoning behind each control.
- Infrastructure-as-code modules that make the secure configuration the default.
- A runbook for a compromised credential, tested in a sandbox account.
Certifications (examples)
- AWS Certified Security – Specialty
- Azure Security Engineer Associate (AZ-500)
- Google Professional Cloud Security Engineer
Examples, not endorsements or requirements. Check the issuer for current details.