Cloud Security Careers

The roles (and what they actually do)

Job titles vary wildly — "Cloud Security Engineer" at one company is "Detection Engineer" at another. Read the responsibilities, not the title. Most teams have at least two of these, sometimes blended into one person.

Each role below includes a "Natural fit if you currently…" note — the backgrounds and day-to-day work that map cleanly into that role. If two or three of the bullets describe your current job, that's the role you'll ramp fastest into.

Cloud Security Engineer (generalist)

The default role. Configures and reviews IAM, owns the CSPM tool and triages findings, writes guardrail policies (SCPs, Azure Policy, Org Policy), reviews cloud architectures during design, automates security tooling. Half the day is in code review and Terraform PRs; the other half is in IAM consoles and the SIEM. Demands breadth over depth.

Natural fit if you currently:

• Work as a DevOps / cloud / platform engineer and already write Terraform or CDK against a real cloud account
• Are a sysadmin who has moved workloads to AWS/Azure/GCP and now manages security groups, IAM, and patching there
• Did Security+ / SSCP / Network+ training and want a role that mixes security with infrastructure
• Came from a SOC and want broader scope than alert triage

Detection Engineer (cloud-focused)

Builds and maintains the rules that catch attackers in cloud environments. Writes Sigma / KQL / SPL detections, maps coverage to MITRE ATT&CK Cloud, tunes false positives, runs purple-team exercises with Stratus Red Team / Atomic Red Team. Highly technical, mostly written in code. Strong career arc into senior IC tracks.

Natural fit if you currently:

• Work as a SOC analyst (Tier 2/3) and have written or tuned Splunk / Sentinel / Chronicle / Elastic queries
• Did the SANS blue-team track (SEC555, SEC511, SEC503) or studied for GCDA / GCIA
• Were a threat hunter and enjoy the "what would I look for" thought experiment
• Are a developer or data engineer comfortable in SQL and event-stream pipelines and want to apply it to security

Cloud Incident Responder / DFIR

The pager-carriers. When GuardDuty fires or a customer reports a leak, this is who investigates. Knows what evidence each cloud actually retains (and what it doesn't), reads CloudTrail at speed, scopes blast radius, drives containment and recovery. Often blended with detection engineering at smaller orgs.

Natural fit if you currently:

• Work in traditional DFIR and want to add cloud to your range — most of the SANS DFIR (FOR500, FOR508, FOR572) skills carry directly
• Studied or hold GCFA / GCIH / GCFE
• Are a SRE who has handled high-pressure on-call and wants the security flavor of the same skill
• Came from a SOC and want to own end-to-end investigations rather than triage

Cloud Penetration Tester / Red Team

Offensive. Audits cloud environments by attacking them, often via consultancy or as an internal red team. Lives in Pacu, ROADtools, custom scripts. Reports look like breach kill chains. Smaller market than defensive roles, but high pay and prestige at the senior end.

Natural fit if you currently:

• Do traditional pentesting / web app testing and hold OSCP, OSEP, OSWE, or PNPT
• Did the SANS offensive track (SEC560, SEC588 — the cloud pentest course is the most direct on-ramp)
• Compete in CTFs and especially the cloud-focused ones (CloudGoat, IAM Vulnerable, AWSGoat) and write up your work
• Were a red-teamer in on-prem environments and want to add cloud to the engagement scope

CSPM / CNAPP Analyst

Lives inside Wiz, Orca, Lacework, Prisma Cloud, Defender for Cloud, or similar. Triages findings, drives remediation, builds custom policies, runs reporting for leadership. Common entry-level role at companies that bought a CNAPP and need humans to make it useful. Underrated path in.

Natural fit if you currently:

• Are an IT auditor or junior GRC analyst who already maps controls to evidence and wants more technical depth
• Did vulnerability management in an on-prem environment (Tenable, Qualys, Rapid7) — same skill, cloud-shaped
• Hold AWS Cloud Practitioner / AZ-900 / Cloud Digital Leader and want a first technical security role
• Were a NOC or ops engineer used to dashboards-and-tickets workflows

IAM / Identity Architect

The most strategically important specialization right now. Designs identity boundaries (cross-account access, federation, conditional access, service-to-service auth), builds least-privilege policy frameworks at scale, owns the IdP integration. Senior IC track in most large orgs, often the closest thing to "Cloud Security Architect" with a real job to do.

Natural fit if you currently:

• Are an Active Directory / Entra ID admin and have lived in group policy, conditional access, and PIM
• Did Okta / Auth0 / Ping admin work or hold the Okta Certified Professional/Administrator track
• Built or maintained an SSO integration and understand SAML, OIDC, and OAuth 2 at depth
• Came from network security and want a specialty that's becoming more important, not less

Cloud AppSec / IaC Security

Sits between security and the application teams. Owns IaC scanning (Checkov, Terrascan, KICS, tfsec), container image scanning, dependency review in CI/CD, secret scanning, supply-chain controls. Strong fit for developers moving into security — very PR-driven, very code-centric.

Natural fit if you currently:

• Are a software engineer who already does code review and wants security as the deeper specialty
• Did web AppSec work, OWASP top-10 testing, or hold Burp Suite Certified Practitioner / GWAPT
• Are a build / release engineer who lives in GitHub Actions / GitLab CI / Jenkins pipelines
• Trained on the SANS DevSecOps track (SEC540) or did Snyk / GitGuardian / Semgrep work

Cloud GRC / Compliance Engineer

Translates frameworks (SOC 2, ISO 27001, FedRAMP, HIPAA, PCI) into cloud controls. Owns the audit relationship, automates evidence collection (Drata, Vanta, Secureframe), maps controls to AWS Config / Azure Policy rules. Less code-heavy, more cross-functional. Paths to security leadership.

Natural fit if you currently:

• Hold CISA, CRISC, ISO 27001 LA/LI, or have worked at a Big 4 audit practice
• Are a project manager or program manager who's run cross-functional security work
• Did paralegal / privacy / compliance work and want a more technical specialty (CIPP/T pairs well)
• Hold CISSP and want the management-track flavor of cloud security rather than the IC track

Security SRE / Platform Security

Builds the security platform other engineers use: shared SIEM pipelines, secret rotation services, golden VPC patterns, account-vending automation. The "security as a product" team. Often the highest-leverage role on a security org.

Natural fit if you currently:

• Work as an SRE / platform engineer and already think in terms of golden paths, error budgets, and self-service
• Are a backend engineer who has built and operated production services at scale
• Did data-engineering work and want to apply pipeline / event-bus skills to security telemetry
• Hold AWS / Azure / GCP DevOps Pro and want a security specialty next

Cloud Security Architect / Staff+ IC

Senior strategic role. Sets technical direction, reviews high-stakes designs, owns the security roadmap for a business unit or product area. Usually 8+ years of operational experience first. Often has no individual deliverables — the deliverable is alignment.

Natural fit if you currently:

• Hold CISSP-ISSAP, CCSP, or AWS / Azure / GCP solutions architect professional and have used those certs at depth
• Have 5+ years as a senior cloud security engineer in any of the IC tracks above and want broader scope without the manager track
• Were a TOGAF-trained enterprise architect and want a security focus
• Already act as the "go-to" security voice in design reviews even though it's not your title

Salary bands (US, late 2025 / early 2026)

Approximate ranges for general industry. Big-tech total comp can be 1.5-2x these numbers. Federal contractors and consulting firms tend lower on base, sometimes higher on cash bonus.

• Junior / Associate (0-2 yrs): $95K-$135K base. Often a SOC analyst or DevOps engineer with a security focus, not titled "cloud security."
• Mid-level (2-5 yrs): $140K-$190K base. The first true "Cloud Security Engineer" role for most people.
• Senior (5-8 yrs): $180K-$240K base. Owns a domain (IAM, detection, CSPM, etc.), mentors others.
• Staff / Principal (8+ yrs): $230K-$320K base, often $400K+ TC at large tech.
• Manager / Director: $180K-$260K base, plus larger bonus and equity components than IC at the same level.
• Consultant / contractor: $800-$1,500/day in the US, occasionally higher for incident response or specialty offensive work.

For real numbers, check levels.fyi for big-tech comp, the BLS information security analysts data for general industry, and recent salary threads on r/cybersecurity for anecdata. Bring real numbers to negotiations.

What hiring managers actually look for

Distilled from interviewing hundreds of cloud security candidates and from years of conversations with hiring peers. The order matters.

1. Hands-on evidence with the cloud you'll be working in. Public CloudGoat write-ups, blog posts, GitHub repos, conference talks. One CTF write-up beats three certs every time.
2. The ability to explain IAM precisely. If you can't explain the difference between an identity-based and a resource-based policy, or between AssumeRole and trust policies, you fail the technical screen at most shops.
3. Comfort with the command line and Terraform/CDK/Pulumi. Cloud security is API-first. The console is for hiring managers, not engineers.
4. One cloud at depth, not three at surface. "I know AWS well, Azure passably, GCP barely" beats "I know AWS, Azure, and GCP" 90% of the time. Pick one.
5. Specific incident or breach knowledge. Be able to walk through Capital One, MOVEit, MGM/Scattered Spider, or whatever's recent. The breach kill chains are interview fodder.
6. A relevant cert as a baseline filter. Recruiters use certs to pass the resume screen. CCSK or your cloud's security specialty does the job. See the certifications guide.
7. Communication. Most senior cloud security work is influence — convincing engineering teams to fix things. Candidates who write well and explain trade-offs without jargon stand out fast.
8. Curiosity and momentum. "What did you learn last month?" If the answer is "nothing in particular," that's a no.

Interview formats you'll actually see

Loops vary, but the modules below cover ~90% of what shows up. Practice each one before you need to.

• Recruiter screen (30 min). Past experience, comp expectations, why this company. Bring a number.
• Hiring-manager screen (45-60 min). Deeper dive on your background and motivation. Often includes one technical question to filter obvious bluffers.
• Live IAM policy review. They paste an AWS or Azure policy. You read it and explain what it grants, what's wrong, and how you'd fix it. Practice with the AWS policy simulator and real-world examples from SummitRoute resources.
• Architecture review. They sketch a system (or share a real one). You identify the threats, controls, and trade-offs. STRIDE as a mental model. Don't be afraid to ask clarifying questions — interviewers are watching how you scope.
• Take-home lab. Increasingly common. Format is usually "here's a vulnerable AWS account or repo — find the issues, write up the kill chain and remediation." 4-8 hours of work, expect a follow-up call to walk through it.
• Live debugging / log analysis. They drop you in a CloudTrail / Sentinel / SCC console with a scenario ("user reports they think they were compromised"). You investigate aloud. Tests how you actually think.
• Detection design / threat modeling exercise. "Write a detection for this attack technique" or "what alerts would you build for this service?" Expect to map to MITRE ATT&CK.
• Behavioral / leadership. STAR-format stories. Specific, recent, with measurable outcomes. Have one for: a contentious security decision you won, one you lost, an incident you led, a time you changed your mind.
• Bar-raiser / cross-functional panel. Common at big tech. Less technical, more "would I want to work with this person." Don't underestimate.

Portfolio projects worth building

Your portfolio is your interview. Pick three of these, do them well, write each one up publicly. A blog (Substack, GitHub Pages, dev.to) plus a public GitHub is enough — no fancy site needed.

Each link below is a step-by-step walkthrough — prerequisites, the actual steps, what hiring managers look for in the write-up, and the common mistakes to avoid:

1. Walk every CloudGoat scenario. Publish your kill chain, screenshots, and remediation for each. The canonical project — most interviewers have done it themselves and will recognize you've done the work.
2. Build a multi-account AWS Organization with SCPs. Terraform a 3-account org, IAM Identity Center, and a baseline of SCPs. Push the code to GitHub. Real production-shaped work.
3. Run Prowler against your own account and remediate everything. Document the before/after. Bonus: turn the remediation into Terraform.
4. Build 5 detections in a lab SIEM. Spin up Wazuh, Elastic, or Matano; pick five MITRE ATT&CK Cloud techniques and write Sigma rules; validate with Stratus Red Team.
5. Take a real breach, rebuild it in a lab. Recreate the Capital One architecture in your own account, exploit it end-to-end, then build the controls and detections that would have stopped it. Best single portfolio piece you can ship.
6. Contribute to an open-source cloud security tool. Prowler, Cloud Custodian, Pacu, ROADtools, KICS, Steampipe — all welcome contributors. Even a small PR is a strong signal.
7. Write a CNAPP comparison. Pick three (Wiz, Orca, Defender for Cloud, Prisma, Lacework) and write an honest comparison. Hands-on trial work, false-positive sampling, and a who-should-pick-which section.

See the full portfolio playbook for time estimates, difficulty, and how to talk about each one in interviews.

What not to do: don't build a "cloud security dashboard" toy webapp. Hiring managers see hundreds. Build operational artifacts that look like real work.

Translating from an adjacent role

Most people don't enter cloud security cold. They pivot. The fastest path is usually one role-step from where you are now, not a leap straight to "Cloud Security Engineer."

From SOC analyst

You already understand alerts, triage, and incident workflow. Add: cloud-native log sources (CloudTrail, Activity Log, Audit Logs), GuardDuty / Defender / SCC, and one cloud's IAM model. Target: cloud-focused SOC roles or detection engineering.

From DevOps / SRE

You already know IaC, CI/CD, and at least one cloud at depth. Add: IAM specifics, threat modeling, posture management, common misconfigurations. Target: Cloud AppSec, IaC security, or platform security. Often the fastest pivot — security teams are desperate for engineers who can actually ship code.

From software developer

You know systems and code review. Add: AppSec fundamentals (OWASP Top 10), IaC scanning, supply-chain controls, container security. Target: Cloud AppSec, secure-by-design consulting roles. Strong pivot if you're a senior dev — security pays similarly and the work is varied.

From sysadmin / network engineer

You understand systems, networks, and "how things actually break." Add: IaC, the cloud-native equivalents of what you already do (security groups vs. firewall rules, IAM vs. AD, etc.), and one cloud's services. Target: cloud security generalist or network-security-in-cloud roles.

From traditional security (on-prem, GRC, AppSec)

You have the security mental model. Add: at least one cloud at operational depth, cloud-specific tooling, IaC. Target: the equivalent of your current role but cloud-flavored. Easiest pivot conceptually, hardest practically because hiring managers look hard for hands-on cloud evidence.

From totally outside tech

Longest road, but doable. Stage 1: get into IT (helpdesk, sysadmin, junior cloud). Stage 2: pivot to security from there. Trying to leap directly into a cloud security role is rarely successful. Plan for 18-36 months.

The application game

• Resume: results, not responsibilities. "Reduced critical CSPM findings from 1,200 to 80 in 6 months" beats "responsible for cloud security posture." Numbers force specificity.
• One page if you're early-career, two pages max otherwise. Recruiters skim for 20 seconds. Make every line count.
• Tailor to the JD. Mirror the language of the posting (within reason). ATS systems literally pattern-match keywords.
• LinkedIn matters more than people admit. Recruiters source heavily from LinkedIn. Headline, banner, and "About" should make it obvious in 5 seconds what you do and what you want next. Post your write-ups there.
• Cold applications work, but referrals work better. Roughly 5-10x conversion rate from referral vs. cold apply. Coffee chats with people at companies you want to work at are the highest-leverage hour you'll spend in a job search.
• Show up where hiring happens. CSOH Friday Zoom, fwd:cloudsec, BSides, DEF CON Cloud Village, local meetups. Half of cloud security hiring happens through someone who knows someone.
• Negotiate. Always. The first number is rarely the best number. "Based on my research and other conversations, I was hoping for X" is the whole script.

Common mistakes

• Stacking certs without a portfolio. Three certs and zero CTF write-ups looks worse than one cert plus a public CloudGoat repo.
• Applying only to "cloud security engineer" roles. The titles you can land first might be "DevSecOps Engineer," "Security Analyst II," or "Cloud Engineer (Security focus)." Same work, broader funnel.
• Chasing big-tech FAANG comp before you have the experience. Big tech raises the bar; mid-market companies will hire you sooner and pay you to learn. You can move up later.
• Going dark for 6 months to "get ready." You learn faster in a job adjacent to your target than you do studying alone. Take the SOC role; pivot in 12 months.
• Treating the interview as a test. It's a conversation. The interviewer is also being evaluated by you — ask the questions you'd want answered before accepting.
• Skipping the take-home. If they ask for one, it usually means they value evidence over interviews. Strongest signal you can send.
• Not asking about the team's actual work. "What's the team's biggest unsolved problem this year?" tells you everything about whether you'd be happy. Ask it every loop.