Learn/Cloud Security

Build the defenses

Cloud Security

Put guardrails, identity policies and monitoring around workloads on AWS, Azure and Google Cloud.

Entry barrier: HighFirst role: 2 to 4 years via cloud engineering$154k–$297k/yrtypical now

Looking for the salary side? Pay, the employers hiring and open cloud security roles, together on one page.

The job, briefly

Cloud security engineers protect what an organization runs on public cloud providers. The work centers on identity and permissions (who and what may call which service), guardrails that stop risky configurations across many accounts, network design, container and Kubernetes security, and the logging and detections that watch the cloud control plane. Most of it is done in code: policies, infrastructure templates and automation, reviewed and deployed like any other software.

Day to day

Write and review IAM policies, roles and permission boundaries so each service gets only the access it needs
Set organization-wide guardrails (AWS service control policies, Azure Policy, Google Cloud organization policies) that block risky configurations before anyone deploys them
Review Terraform and other infrastructure-as-code changes for public storage, open security groups and over-broad roles
Triage posture findings and route the real ones to the owning teams with a clear fix
Harden Kubernetes clusters and container images, and secure the pipelines that build them
Build detections on CloudTrail, Azure activity logs and Google Cloud audit logs for events such as disabled logging, new access keys or unusual role assumptions

Worked examples

Close a publicly readable bucket, and the cause behind it

A posture alert shows an S3 bucket anyone can read. You check what is inside (marketing images, plus one export of customer emails), lock it down, search the access logs for outside downloads of the export and tell the privacy team what you found. Then you trace the cause: a shared Terraform module defaulted to public. You fix the module, turn on account-level Block Public Access and add a policy check in the pipeline so the same change fails review next time.

Cut an over-privileged role down to size

A data pipeline runs with an administrator role because that was quickest to set up. You pull ninety days of CloudTrail activity for the role, list the dozen actions it really uses, write a least-privilege policy limited to those actions on the specific resources, test it in staging and roll it out with the pipeline's owners watching for access-denied errors during the first week.

Catch a stolen access key in use

A long-lived key belonging to the CI system suddenly calls GetCallerIdentity and ListBuckets from an address outside the build provider's ranges. Your detection fires; you deactivate the key, review everything else it called, rotate it and move the CI job to short-lived credentials through OIDC federation, so there is no long-lived key left to steal.

Who does well here

Cloud security is for people who already build or run things in the cloud: DevOps, platform and site reliability engineers, cloud administrators and developers who deploy their own infrastructure. Security people from on-premises backgrounds move in as well, after learning the providers' identity models and infrastructure as code. It suits people who like policy as code, read permission documentation closely and can tell an engineering team why a guardrail is worth the inconvenience.

Signs it suits you

You already deploy or operate workloads on AWS, Azure or Google Cloud
You can read an IAM policy document without dread
You would rather fix a whole class of problem in a shared module than each instance by hand
You can work with many engineering teams that each own their own accounts

Requirements

Hands-on experience with at least one major cloud provider, ideally from an engineering or operations job
Infrastructure as code (Terraform, CloudFormation, Bicep or Pulumi) and scripting in Python or Go
A grasp of networking, identity and Linux, and for many roles containers and Kubernetes

Useful skills

Cloud IAM and policy designPolicy as code (OPA, Checkov)Kubernetes and container securityCloud logging and detectionPosture management toolsPython or Go

A route in

1Get real cloud experience first, as a DevOps, platform or cloud engineer, or by taking on the cloud work in your current IT job
2If your cloud experience is thin on paper, earn an associate certification (AWS Solutions Architect Associate, Azure Administrator or a Google Cloud associate)
3Then go deeper on security: AWS Certified Security Specialty, Microsoft AZ-500 or Google's Professional Cloud Security Engineer, plus CKS if you work with Kubernetes
4Build in a personal account with a budget alert: an organization with guardrails, central logging and a detection for one risky action, written up so others can follow it
5Attack deliberately misconfigured setups such as flAWS and CloudGoat to see the attacker's side
6Apply for cloud security engineer, cloud platform security and DevSecOps roles, and bring your write-ups and code to the interview

Myths and reality

Myth: The cloud provider takes care of security.

Reality: Providers secure the infrastructure they run. Under the shared responsibility model the customer still owns its identities, configurations, data and code, and exposed keys, public storage and excessive permissions, all on the customer side, sit behind many of the cloud breaches that reach the news.

Myth: Cloud security is network security moved somewhere else.

Reality: Identity replaces the network edge as the main boundary. You still design networks, but the decisions that matter most concern roles, policies, federation and which service may assume which role, and those live in code.

Myth: One provider's security certification is enough to get hired.

Reality: A certification gets you past the screen; experience gets the offer. Interviewers ask you to read a policy, spot the flaw in a Terraform snippet or design guardrails for many accounts, and that comes from having built and broken things in a real environment.

Salary

Salary ranges on open cloud security roles currently center on $154k–$297k/yr. The median sits at $185000, measured over the 31 openings that publish a range.

Salaries, employers and open cloud security roles Every kind of security work, side by side →

Questions career changers ask

Which cloud provider should I learn first?

The one your current or target employer runs. AWS is common at startups and technology companies, Azure at enterprises already on Microsoft 365 and Entra ID, and Google Cloud at data-heavy companies. The ideas carry across, so depth in one and familiarity with a second is a sound shape.

Do I need to know Kubernetes?

For many roles, yes, because so much now runs in containers. Know how pods, service accounts, network policies and admission control work, and how an attacker moves from a compromised container to the cluster or the cloud account behind it. CKS is the certification that covers this ground.

Is cloud security a good move from a SOC role?

Yes, if you add the engineering half. Analysts who already investigate cloud alerts have a head start on detection, but these roles also expect you to write infrastructure as code and design policies. Spend time deploying and breaking things in your own account, and read the security engineering guide too.

What is CSPM, and will I spend all day in it?

Cloud security posture management tools scan accounts for misconfigurations against benchmarks and policies. They produce plenty of findings, and part of the job is deciding which matter, getting them fixed by the right team and then preventing them at the source with guardrails and pipeline checks, so the dashboard shrinks instead of becoming your whole day.