Most cloud breaches come from identity and configuration mistakes that a competent cloud security engineer could have prevented, yet the role is hard to enter because it needs both cloud engineering and security depth. Cloud security engineers design the guardrails, identity patterns, logging and detection that let development teams move quickly without exposing data or keys. This guide explains what the job involves on AWS, Azure and Google Cloud, the skills and tools employers test for, practical routes in, the certifications that help (with the 2026 changes to Microsoft's and AWS's security exams), and where the role leads. It is written for cloud, DevOps and infrastructure engineers adding security, security staff moving into cloud, and managers building a cloud security team.
Key takeaways
- Identity is the main control surface. In cloud, IAM policies, roles, service accounts and federation decide who can reach data; most of the job is designing and reviewing access, for people and for workloads.
- Guardrails beat reviews. The role scales through preventive organisation-level policy (AWS SCPs, Azure Policy, Google Cloud Organization Policy) and secure infrastructure-as-code modules, not by approving every change by hand.
- You must be able to build. Employers expect Terraform or the provider's native templates, CI pipelines and scripting; a security person who cannot ship code will struggle in platform teams.
- Depth in one provider first. Learn one platform thoroughly, then map the concepts across; the shared responsibility model and logging differ in detail but not in principle.
- Certifications changed in 2026. Microsoft retired AZ-500 on 31 August 2026 in favour of SC-500, and AWS's Security Specialty is now SCS-C03; check the body's page before you book.
What the role does
A cloud security engineer owns the security of the organisation's cloud estate: the account or subscription structure, the identity model, network boundaries, data protection settings, logging and the detection and response that sits on top. NIST's NICE Framework has no cloud-specific work role; the work fits the Secure Systems Development role (DD-WRL-004), applied to cloud platforms. The US Bureau of Labor Statistics counts these jobs inside its information security analysts occupation.
Typical responsibilities
| Area | What you build or run | AWS examples | Azure examples | Google Cloud examples |
|---|---|---|---|---|
| Organisation guardrails | Account hierarchy, preventive policy, landing zones | AWS Organizations, SCPs, Control Tower | Management groups, Azure Policy | Resource hierarchy, Organization Policy |
| Identity and access | Federation, roles, workload identity, privileged access | IAM roles, IAM Identity Center, Access Analyzer | Entra ID, Azure RBAC, managed identities, PIM | Cloud IAM, Workload Identity Federation, Privileged Access Manager |
| Network | Segmentation, private endpoints, egress control | VPC, security groups, PrivateLink | VNets, NSGs, Private Link | VPC, firewall policies, VPC Service Controls |
| Data protection | Encryption keys, secrets, public exposure blocking | KMS, Secrets Manager, S3 Block Public Access | Key Vault, storage account settings | Cloud KMS, Secret Manager, Sensitive Data Protection |
| Logging and detection | Audit log collection, threat detection, posture | CloudTrail, GuardDuty, Security Hub | Activity Log, Defender for Cloud, Sentinel | Cloud Audit Logs, Security Command Center |
In a small company one engineer may own all five areas plus Kubernetes. In large organisations the work splits into platform security (guardrails and IaC), cloud identity, and cloud detection and response, each with its own team.
The threats you design against
Interviewers expect you to connect controls to real attack behaviour. These MITRE ATT&CK techniques come up constantly in cloud incidents:
| ATT&CK technique | What it looks like | Engineering control | Framework anchor |
|---|---|---|---|
| T1078.004 Cloud Accounts | Stolen access keys or session tokens used to sign in | Federation and short-lived credentials, MFA for humans, no long-lived user keys | NIST CSF PR.AA-05; SP 800-53 AC-6 |
| T1552.005 Cloud Instance Metadata API | Credentials pulled from the instance metadata service via SSRF | Enforce IMDSv2 on AWS, least-privilege instance roles | SP 800-53 CM-6; CSF PR.PS-01 |
| T1098.001 Additional Cloud Credentials | Attacker adds keys or secrets to a service principal for persistence | Alert on credential creation, restrict who can add credentials | SP 800-53 AU-6, SI-4; CSF DE.CM-01 |
| T1580 Cloud Infrastructure Discovery | Enumeration of instances, buckets and roles | Detection on unusual List and Describe call volumes | SP 800-53 SI-4 |
| T1530 Data from Cloud Storage | Bulk reads from storage buckets or blobs | Block public access, data event logging, key policies | CSF PR.DS-01; SP 800-53 SC-28 |
The Codefinger S3 ransomware campaign showed stolen AWS keys being used to encrypt buckets with AWS's own encryption, a scenario a cloud security engineer should be able to prevent and detect.
Core skills and tools
- Cloud platform depth: account structure, IAM policy evaluation logic (explicit deny, permission boundaries, resource policies), and networking in at least one provider. See the AWS IAM Policies and Roles Guide and the Azure RBAC and Service Principals Guide.
- Infrastructure as code: Terraform, CloudFormation or Bicep, with policy checks in CI so insecure resources fail before deployment. See the Infrastructure as Code Security Guide.
- Workload identity: replacing static keys with roles, managed identities and federation, including for CI systems such as GitHub Actions. See the Workload Identity Federation Guide.
- Containers and Kubernetes: image scanning, RBAC, admission control, Pod Security Standards and managed cluster settings. See the Kubernetes Security Guide.
- Posture management: reading CSPM and CNAPP findings, prioritising by exploitability and exposure, and fixing at the module level rather than per resource. See the CNAPP Guide.
- Logging and detection: centralising audit logs into a dedicated account or project, writing queries in KQL, SQL or similar, and knowing which API calls matter (for example CreateAccessKey, AttachRolePolicy, PutBucketPolicy on AWS).
- Cloud incident response: isolating resources, revoking sessions, rotating keys and preserving evidence. See the Cloud Incident Response Guide.
- Scripting: Python with the provider SDK (boto3, Azure SDK, Google Cloud client libraries) for audits and automated remediation.
Where identity fits
Cloud estates usually hold far more machine identities than people: roles, service principals, service accounts, keys and tokens used by pipelines and applications. Engineers who can inventory them, assign owners, remove long-lived keys and scope permissions stand out. The Football Australia exposure, where AWS keys in website code opened 127 storage buckets, is a typical example. See the Cloud Workload Identity Guide.
Routes into the role
- From cloud, DevOps or platform engineering: the strongest route. You already build infrastructure; take on IAM design, guardrails and security findings in your current team, then apply for platform security roles.
- From infrastructure or network security: map what you know (firewalls, segmentation, hardening) to cloud constructs, build in a personal account, and earn a provider security certification.
- From the SOC: specialise in cloud log sources and cloud incidents, then move into cloud detection and response. See the SOC Analyst Career Guide.
- From software development: serverless and container security, pipeline hardening and secure IaC modules suit developers well.
- From a general security engineering role: see the Cybersecurity Careers Guide for adjacent paths.
A lab that proves the skills
- Multi-account setup: a small organisation with separate security, logging and workload accounts or subscriptions, built entirely in Terraform.
- Guardrails: two or three preventive policies (deny disabling audit logging, deny public storage, restrict regions) tested against a deliberate violation.
- Keyless pipeline: a CI workflow that deploys using federation, with no stored secrets.
- Detections: alerts on root or break-glass use, new access keys and policy changes, each with a written test.
- Cost and safety: set budget alerts, never commit credentials, and tear the lab down when idle.
Certifications that help
Facts below are from the certifying bodies' pages, checked 24 October 2026. Exams change often, so confirm on the body's page before booking.
| Certification (body) | Level | Format and requirements stated by the body | Best for |
|---|---|---|---|
| AWS Certified Security Specialty, SCS-C03 (AWS) | Specialty | 65 questions (50 scored, 15 unscored), 170 minutes, USD 300, pass mark 750 of 1,000, valid three years; AWS recommends five years of IT security and two years securing AWS workloads. Largest domain: Identity and Access Management (20%) | AWS-heavy estates |
| Cloud and AI Security Engineer Associate, SC-500 (Microsoft) | Associate | Replaces Azure Security Engineer Associate (AZ-500, retired 31 August 2026); covers identity and governance, storage, databases and networking, compute including AI workloads, and posture with Defender for Cloud and Sentinel | Azure estates |
| Professional Cloud Security Engineer (Google Cloud) | Professional | Two hours, 50 to 60 questions, USD 200; Google recommends three years of industry experience including one year on Google Cloud; valid two years | Google Cloud estates |
| CCSK v5 (Cloud Security Alliance) | Foundation, vendor neutral | Open book, online, 60 questions, 80% pass mark, no prerequisites; 12 domains including AI and Zero Trust material | A vendor-neutral grounding |
| CCSP (ISC2) | Senior, vendor neutral | Five years' experience required (CCSK can substitute one year); six domains; adaptive exam of 100 to 150 items in three hours | Senior and governance-facing roles |
| CKS (Linux Foundation) | Specialist | Requires a passed CKA; two-hour performance-based exam; valid two years | Kubernetes-heavy platforms |
See the CCSP Certification Guide, the Microsoft Security Certifications Guide, the Google Professional Cloud Security Engineer Guide, the AWS Certified Security Specialty Guide, the CCSK Certification Guide and the Certified Kubernetes Security Specialist (CKS) Guide.
Decision guidance: start with the provider certification for the platform you work on; add CCSK if you need vendor-neutral vocabulary early; save CCSP for when you have the experience and want governance or architecture options. In multi-cloud organisations, depth in the primary provider plus working knowledge of the second is more valuable than three provider certificates at associate level.
Progression
| Level | Scope | Typical evidence |
|---|---|---|
| Cloud security engineer | Implements guardrails and fixes findings in one platform | Shipped IaC modules and policies, reduced open findings |
| Senior cloud security engineer | Owns the identity model or detection for a whole estate | Designs adopted by several teams, incident leadership |
| Principal or staff | Multi-cloud strategy, standards, platform roadmap | Organisation-wide patterns, mentoring |
| Cloud security architect or lead | Design authority or team management | Architecture decisions, budgets, hiring |
Common next steps are cloud security architecture (see the Security Architect Career Guide), cloud identity specialisation, leading a cloud security team, and AI platform security as AI workloads move onto the same cloud foundations.
Pay: there is no official cloud-specific pay series. The US BLS reports a median annual wage of USD 129,180 in May 2025 for information security analysts, the occupation that includes these roles, with 21% growth projected from 2025 to 2035.
Measuring your progress
- Guardrail coverage: share of accounts, subscriptions or projects under your preventive policies.
- Long-lived credentials: number of static user access keys and secret-based service principals, trending to zero.
- Critical findings age: median days open for critical posture findings in your scope.
- Log coverage: share of accounts sending audit and data events to the central log store.
- Detection tests: share of your cloud detections with a working automated test.
Common failure patterns
- Console-only skills: knowing where settings live in the portal but not how to enforce them as code across hundreds of accounts.
- Treating posture findings as the job: closing tickets resource by resource instead of fixing the module or policy that keeps creating them.
- Ignoring workload credentials: long-lived keys in code and containers remain the leading cloud entry point, as the Tesla Kubernetes cryptojacking case showed with credentials exposed through an open console.
- Breaking pipelines with untested policy: deploying deny policies without an audit or dry-run phase and a documented exception route.
- Multi-cloud breadth without depth: collecting associate badges on three providers but unable to explain IAM policy evaluation in any of them.
Practitioner checklist
- Pick a primary provider and learn its IAM evaluation logic, organisation structure and logging in depth.
- Build a multi-account or multi-subscription lab in Terraform with central logging.
- Write and test at least three preventive guardrails and three detections.
- Replace every static credential in your lab and pipelines with federation or managed identity.
- Learn Kubernetes security basics if your target employers run containers.
- Earn the provider security certification for your platform, checking the current exam code first.
- Map your controls to ATT&CK cloud techniques and to NIST CSF 2.0 and SP 800-53.
- Track the progress metrics above in your current role and use them in interviews.
Standards and references
- CISA NICCS: NICE Framework Work Role, Secure Systems Development
- AWS: Certified Security Specialty (SCS-C03) Exam Guide
- Google Cloud: Professional Cloud Security Engineer
- Microsoft Learn: Cloud and AI Security Engineer Associate
- Cloud Security Alliance: CCSK
- ISC2: CCSP
- MITRE ATT&CK: Valid Accounts, Cloud Accounts
- US Bureau of Labor Statistics: Occupational Outlook Handbook, Information Security Analysts
Related NHI Mgmt Group resources: Cloud Security Guide · AWS Security Guide · Microsoft Azure Security Guide · Google Cloud Security Guide