The Cloud security engineer path
You make sure the cloud account nobody is watching is not the way in. Most breaches now involve a misconfigured cloud resource rather than an exotic exploit — and the blast radius of a mistake is unusually large, which is why this is not entry-level work.
Published 2026-10-09 · generated from the lesson data · serves Cloud security engineer
Work the groups in order. Each checkpoint is a gate: do not move on until you can do it unaided. The capstone is level 4 — original work, made public, verifiable by a stranger.
Foundations
Cloud fluency first
No guidebook lesson covers core cloud services yet — logged as a gap. Learn one major cloud’s compute, storage, networking, and IAM in your own account, billing alarm on before anything else (the role page’s warning), before the security content below.
Cloud security
4. Cloud security: concepts
Stage D · Specialist
5. SSRF: when the server fetches what you tell it to
Stage B · Practitioner
6. Identity and access management: who gets in, and to what
Stage E · Expert
SSRF is here for the cloud-metadata-service angle — the classic cloud attack path.
CISSP Domains 3 and 5
Checkpoints
- A misconfiguration found and fixed in your own lab account — before, after, and what stops it recurring.
- Least privilege applied to a working setup end to end, with the breakage notes.
- An automated guardrail that fails a deployment reintroducing the problem.
The capstone
Level 4 — Extend: Published cloud security baseline. A published cloud security baseline: an audited reference architecture with detective controls, or original research on a misconfiguration class with detection logic. That is the artifact a hiring stranger checks.