Sana Ullah Khan
English

Roadmaps Security roadmaps Core domains

Cloud Security

Secure what organisations build and run on AWS, Microsoft Azure and Google Cloud, from accounts and permissions to containers and data.

Estimated time: 24–42 months · At about 10 hours a week.

  1. BeginnerCloud fundamentals and the shared responsibility model2–3 months
  2. IntermediateGuardrails, infrastructure as code and detection4–6 months
  3. AdvancedContainers, Kubernetes and cloud incident response6–9 months
  4. ExpertCloud security architecture and leadership12–24 months

Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.

Overview

Cloud security protects systems and data that run on cloud platforms. Under the shared responsibility model the provider secures the physical data centres and the platform, and the customer secures how they use it: identities, configuration, networks, data and workloads.

Most cloud incidents come from customer-side mistakes: public storage buckets, leaked access keys, over-privileged roles and unpatched workloads. The job is to prevent those through good design and guardrails, find them quickly when they happen, and respond to attacks in cloud environments.

Why it matters

Most new systems are built in the cloud, and attackers follow. Cloud skills are among the most requested in security job ads, and they combine well with almost every other security domain.

Typical job roles

  • EntryCloud security analyst Reviews cloud posture findings and fixes misconfigurations.
  • Mid-levelCloud security engineer Builds guardrails, logging, IAM and detection for cloud accounts.
  • Mid-levelDevSecOps / platform security engineer Secures infrastructure as code, pipelines and Kubernetes.
  • SeniorCloud incident responder Investigates and contains attacks in cloud environments.
  • SeniorCloud security architect Designs secure landing zones and multi-cloud architectures.
  • LeadHead of cloud security Owns cloud security strategy across the organisation.

Prerequisites

  • Linux administration and networking basics (subnets, routing, firewalls, DNS).
  • Hands-on use of at least one cloud: creating VMs, storage and networks.
  • Scripting in Python or Bash, and reading JSON and YAML.
  • Security basics, ideally the Security Operations or Network Security roadmap's beginner stage.

Foundations of computer science Cloud and DevOps

Learning path

  1. Beginner Cloud fundamentals and the shared responsibility model 2–3 months

    Topics

    • Shared responsibility model
    • Cloud service models (IaaS, PaaS, SaaS)
    • Accounts, subscriptions and projects
    • Cloud IAM basics
    • Storage security
    • Virtual networks and security groups
    • Encryption and key management services
    • Audit logging (CloudTrail, Azure Activity Log)

    Skills

    • Set up a cloud account securely: MFA on the root user, no root access keys, budget alerts.
    • Create users, roles and policies that follow least privilege.
    • Find a public storage bucket and lock it down.
    • Turn on audit logging and read the events it records.

    Hands-on projects and labs

    • Open a free-tier AWS or Azure account, secure it with the provider's security checklist, and set a billing alarm before anything else.
    • Play flAWS and flAWS2, free challenges that teach common AWS mistakes.
    • Run Prowler or ScoutSuite against your own account and fix every high finding.

    Done when you can…

    • Explain who is responsible for what in IaaS, PaaS and SaaS.
    • Read an IAM policy and say exactly what it allows.
    • Show your own cloud account passing a CIS benchmark scan with no critical findings.
  2. Intermediate Guardrails, infrastructure as code and detection 4–6 months

    Topics

    • Landing zones and multi-account design
    • Organisation policies (SCPs, Azure Policy)
    • Infrastructure as code (Terraform, OpenTofu)
    • IaC scanning
    • Cloud security posture management (CSPM)
    • Secrets management
    • Cloud-native threat detection (GuardDuty, Defender for Cloud)
    • Cloud attack techniques

    Skills

    • Build cloud infrastructure only through code, and scan it for mistakes before deployment.
    • Write preventive guardrails that block risky actions across all accounts.
    • Investigate a cloud alert using audit logs.
    • Understand how attackers escalate privileges in cloud IAM.

    Hands-on projects and labs

    • Write Terraform for a small web app (network, VM or container, database) and scan it with Checkov and Trivy in a GitHub Actions pipeline.
    • Deploy CloudGoat in your own AWS account and work through its vulnerable-by-design scenarios. Tear it down afterwards.
    • Use Stratus Red Team to simulate attacks in your account and check what your logging and detection catch.

    Done when you can…

    • Show a repository where every cloud resource is defined in code and checked automatically.
    • Explain three ways to escalate privileges in AWS or Azure, and how to prevent each.
    • Write a short incident report from CloudTrail or Azure activity logs.
  3. Advanced Containers, Kubernetes and cloud incident response 6–9 months

    Topics

    • Container image security
    • Kubernetes security (RBAC, admission control, network policies)
    • Runtime security
    • Serverless security
    • Workload identity
    • Data security and DSPM
    • Cloud forensics and incident response
    • Multi-cloud security

    Skills

    • Harden a Kubernetes cluster and check it against the CIS Kubernetes Benchmark.
    • Enforce policies at admission time with Kyverno or OPA Gatekeeper.
    • Detect suspicious container behaviour at runtime with Falco.
    • Respond to a compromised cloud workload: preserve evidence, contain, recover.

    Hands-on projects and labs

    • Build a local Kubernetes cluster with kind or minikube, run Kubernetes Goat, and fix each scenario after exploiting it in your own lab.
    • Add Kyverno policies that block privileged containers and images without a signature.
    • Write a cloud incident response playbook for a leaked access key, and test it in your account.

    Done when you can…

    • Show a hardened cluster with admission policies, network policies and runtime alerts.
    • Run a full response to a simulated cloud compromise and write the post-incident review.
  4. Expert Cloud security architecture and leadership 12–24 months

    Topics

    • Enterprise cloud security architecture
    • Security for AI services in the cloud
    • Cloud security programmes and metrics
    • Compliance in the cloud (ISO 27001, SOC 2, PCI DSS)
    • Sovereign and regulated clouds
    • Cost and risk trade-offs

    Skills

    • Design secure landing zones for a large organisation across several clouds.
    • Build a cloud security programme with clear ownership, guardrails and metrics.
    • Map cloud controls to compliance requirements and evidence them automatically.

    Hands-on projects and labs

    • Write a cloud security reference architecture and threat model for a regulated workload, such as payments or health data.
    • Publish research, tooling or a detailed write-up on a cloud attack or defence technique.

    Done when you can…

    • Defend a cloud architecture to auditors, engineers and leadership.
    • Show how your design limits the damage of a stolen admin credential.

Tools and technologies

  • Prowler Open source Security checks and CIS benchmark scans for AWS, Azure, Google Cloud and Kubernetes.
  • ScoutSuite Open source Multi-cloud security auditing tool.
  • Checkov Open source Scans infrastructure as code for misconfigurations.
  • Trivy Open source Scans container images, code and IaC for vulnerabilities and misconfigurations.
  • Terraform Free community edition The most widely used infrastructure as code tool.
  • OpenTofu Open source Open-source fork of Terraform.
  • Cloud Custodian Open source Rules engine to find and fix cloud resources that break policy.
  • Falco Open source Runtime threat detection for containers and Kubernetes.
  • Kyverno Open source Kubernetes policy engine.
  • Open Policy Agent Open source General-purpose policy engine, used with Kubernetes and IaC.
  • kube-bench Open source Checks a Kubernetes cluster against the CIS benchmark.
  • CloudGoat Open source Vulnerable-by-design AWS environments to practise in your own account.
  • Stratus Red Team Open source Simulates cloud attack techniques to test your detections.
  • Microsoft Defender for Cloud Commercial Microsoft's cloud security posture and workload protection service.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

  1. Entry AWS Certified Cloud Practitioner Amazon Web ServicesOptional first step on AWS. Pick one cloud and stay with it.Cost and exam details
  2. Entry Azure Fundamentals (AZ-900) MicrosoftThe same for Azure.Cost and exam details
  3. Intermediate AWS Certified Solutions Architect – Associate Amazon Web ServicesProves you can build on AWS, which you need before securing it.Cost and exam details
  4. Intermediate Azure Administrator Associate (AZ-104) MicrosoftThe Azure equivalent.Cost and exam details
  5. Intermediate Certificate of Cloud Security Knowledge (CCSK) Cloud Security AllianceVendor-neutral cloud security knowledge.
  6. Advanced AWS Certified Security – Specialty Amazon Web ServicesFor AWS security roles.Cost and exam details
  7. Advanced Cloud and AI Security Engineer Associate (SC-500) MicrosoftFor Azure security roles.Cost and exam details
  8. Advanced Professional Cloud Security Engineer Google CloudFor Google Cloud security roles.
  9. Advanced Certified Kubernetes Security Specialist (CKS) The Linux FoundationHands-on Kubernetes security; needs CKA first.
  10. Advanced CCSP ISC2For cloud security architects with several years of experience.

Resources

Frameworks and standards

  • CSA Cloud Controls Matrix (CCM) A cloud-specific control framework, mapped to ISO/IEC 27001, NIST and others.
  • AWS Well-Architected Framework, Security Pillar AWS's own design principles and best practices for securing workloads in the cloud.
  • CIS Benchmarks Free, consensus hardening guides for operating systems, cloud accounts, network devices and software.
  • NIST Cybersecurity Framework (CSF) 2.0 A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
  • ISO/IEC 27001 The international standard for an information security management system (ISMS), and the one organisations get certified against.
  • SOC 2 An audit report on how a service provider protects customer data, very common for SaaS companies.
  • MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
  • NIST SP 800-207 Zero Trust Architecture Defines zero trust: never trust a request because of where it comes from, check identity and context every time.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

  1. Cloud or systems engineer, or SOC analyst0–3 years
  2. Cloud security engineer2–5 years
  3. Senior cloud security engineer or cloud incident responder5–8 years
  4. Cloud security architect8+ years
  5. Head of cloud security or CISO10+ years

Related domains to move into

  • Identity and Access Management (IAM) Cloud IAM is the heart of cloud security.
  • Application and Software Security Secure the applications that run in the cloud.
  • Container Security Coming soon Go deeper into images, runtimes and Kubernetes.
  • DevSecOps Coming soon Build security into the pipelines that deploy to the cloud.
  • Cloud Security Assessment Coming soon Test cloud environments as an authorised assessor.
  • AI Infrastructure Security Coming soon Secure the cloud platforms AI models are trained and served on.

All security roadmaps Back to top

Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact