Cloud Security Engineer Career Roadmap¶

A cloud security engineer secures what the organisation builds in AWS, Azure or GCP: identities, networks, data, logging and the guardrails that stop mistakes. The existing Security Engineer roadmap covers the whole field with a cloud emphasis. This page is the short, focused version: pick a primary cloud, go deep, add one more.

What the job is¶

Identity: least-privilege roles, federation, no long-lived keys. See IAM explained and Least privilege explained.
Posture: find and fix misconfiguration at scale. See CSPM and CNAPP explained.
Data protection: encryption, keys, secrets. See Encryption explained and Secrets management.
Detection and response: logs, alerts, runbooks. See Logging and detection and the playbooks.
Guardrails as code: policies and infrastructure as code that prevent the bad state.

Titles: cloud security engineer, cloud security architect, platform security engineer, DevSecOps engineer.

flowchart TB
  A[Foundations:<br/>networking, Linux, IAM] --> B[Security+ or CC]
  B --> C{Primary cloud}
  C --> D[Azure:<br/>SC-900, SC-200, SC-100]
  C --> E[GCP:<br/>Professional Cloud<br/>Security Engineer]
  C --> F[AWS:<br/>see note on the<br/>Security Specialty]
  D --> G[CCSK, then CCSP]
  E --> G
  F --> G
  G --> H[Containers: KCSA, CKS<br/>Secrets: Vault]

Pick one cloud, go deep, then add the vendor-neutral certificates and the container track.

Stage 1 - foundations¶

Networking, Linux, and one cloud's console and CLI. Read Shared responsibility model, Network security basics and Zero trust explained. The cloud sibling site covers fundamentals: Cloud Zero to Hero.

Stage 2 - first certificate¶

ISC2 CC or CompTIA Security+.

Stage 3 - your cloud's security certificate¶

Azure: SC-900 for vocabulary, SC-200 for operations, SC-300 for identity, and SC-100 Cybersecurity Architect for design. The AZ-500 guide is kept as reference because that exam is retired; see its notice.
GCP: Professional Cloud Security Engineer.
AWS: the current exam is the Security Specialty SCS-C03 guide. The SCS-C02 guide is kept as reference because that exam is retired. Check AWS's site for price and availability before booking.
IBM: IBM Cloud Security Engineer if your employer uses IBM Cloud.

Stage 4 - vendor-neutral and specialist¶

CCSK - cloud security principles; a good second certificate.
ISC2 CCSP - the cloud security professional credential, with an experience requirement.
KCSA then CKS - Kubernetes security; CKS is a hands-on exam.
HashiCorp Vault Associate and Boundary Associate - secrets and access.
Palo Alto PCNSA - firewalls, if the role is network heavy.
CISSP - later, for leadership.

Skills that matter more than certificates¶

Skill	How to practise
Least-privilege IAM	Take one role and cut it to what it uses, using the provider's access analysis tools
Logging and alerting	Centralized logging and alerting
Zero trust access	Implement zero trust
Incident handling	Walk the leaked key and exposed bucket playbooks in a sandbox account
Infrastructure as code	Write a guardrail policy and a template that passes it
Comparing clouds	Security tools comparison and Identity and IAM comparison

Getting the first job¶

Build a sandbox with a locked-down account, central logs and tested alerts. Write it up with diagrams.
Know one breach well enough to explain it: Capital One 2019.
Practise: Cloud security interview prep and the broader Security engineer interview prep.

Next steps¶

Study Hub and Budget study plan