Cloud Security Engineer
You make sure the cloud account nobody is watching is not the way in.
No degree needed Hard, and the blast radius of a mistake is unusually large.
Practise in your own account or a dedicated lab, and set a billing alarm before you start. Testing security controls on infrastructure you do not own is unauthorised access, and an unattended experiment can cost real money overnight.
Can I actually do this?
Open without a degree and in real demand, because most breaches now involve a misconfigured cloud resource rather than an exotic exploit. Not entry-level: you need to understand a cloud platform properly before securing it means anything. The usual route is cloud or devops work first, then a turn toward security. The vendor material below is free.
Who it suits. People who read a permissions policy and immediately wonder who else can use it.
Runway. Years. You need the cloud first, then the security on top.
Coming from cloud or devops? You have the harder half already. Most cloud security failures are configuration, not cryptography. Cloud Engineer DevOps Engineer Security Analyst
Also advertised as
The route
Four stations, in order. Each one is a thing you finish before the next matters.
-
Station one
Learn it free
Only the best few, deliberately. Every one of these is free to use — the pill on each card says exactly what is and isn't free.
AWS Well-Architected Framework
Free to learn · no certificate
The security pillar here is the clearest free statement of what good looks like on AWS. Free to read; the certifications that test it are separately paid.
Verified 2026-07-28
Google Cloud Well-Architected Framework
Free to learn · no certificate
The same discipline on another platform. Reading both is how you learn which principles are real and which are one vendor's habit.
Verified 2026-07-28
OWASP Cheat Sheet Series
Free to learn · no certificate
Cloud security still fails at the application layer. Free.
Verified 2026-07-28
-
Station two
Attest strategically
Start with a general cloud certificate rather than a security-specific one. Employers hiring for cloud security are checking that you know the platform; the security judgement is assessed in conversation. Vendor security specialty exams exist and are expensive — let an employer fund one once you are in, and check the current price yourself, since the page we read does not print it.
AWS Certified Solutions Architect – Associate
Amazon Web Services · SAA-C03
Free to learn · paid certificate Recognized
The honest cost Cost Not published
AWS does not print the exam fee on this page, and it is still absent when the page is fully rendered in a browser — so this is a genuine omission, not a JavaScript artefact. Check the AWS certification portal before booking.Validity 3 years — stated verbatim on the official page. Renewal Recertify before expiry by passing the latest version of the exam. Assessment Proctored exam Proctored Yes Verify via Credly Cost per active year Unknowncannot be computed — AWS does not print the exam fee on this page The most widely requested AWS credential in cloud engineering postings, a clear step above the entry-level Cloud Practitioner.
Read this before you buyThis is the step up from Cloud Practitioner, not a parallel option. Earning both at entry level signals little that the Associate alone does not.
Verified 2026-07-28 · Official page
-
Station three
Prove it
A certificate says you passed a test. These say you can do the job.
A misconfiguration you found and fixed
An over-permissive policy, a public bucket, an unrotated key — in your own account or a lab. Show the before, the fix, and how you would prevent it recurring.
Least privilege applied to something real
Take a working setup and narrow its permissions until it still works and nothing more. Show your reasoning.
Guardrails that catch it automatically
A policy or scan that fails the build when someone reintroduces the problem. Detection beats vigilance.
-
Station four
Get hired
Search these exact titles
Who hires for this. Anyone with a serious cloud footprint — fintech, health, SaaS, and consultancies doing cloud posture reviews.
Interviews here lean on configuration scenarios rather than trivia, which rewards hands-on account experience over study. That is our reading of the field, not a verified hiring statistic.
On salaryWe don't publish salary estimates. Numbers copied between blogs drift from reality, and a wrong number costs you real negotiating power. When we have a verified public source, it goes here with its date.
Where this route continues
- Security Analyst — broader defensive work
- Cloud Engineer — sideways move
- DevOps Engineer — sideways move
- Application Security Engineer — sideways move
This page last verified 2026-07-28 · How we verify
AWS and Google Cloud Well-Architected frameworks and the OWASP Cheat Sheet Series fetched and READ 2026-07-28.