# Best Cloud Security Training for SOC Analysts in 2026 (AWS, Azure, Google Cloud)

> Cloud security training for SOC analysts compared: Microsoft SC-200, AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, SANS SEC541 and FOR509, Pwned Labs, flaws.cloud, CloudGoat and browser labs. Prices as of October 2026, cloud incident response training for AWS and Azure, and a free 30-day plan.

Source: https://playciso.com/blog/best-cloud-security-training-soc-analysts-2026 · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

A SOC analyst does not need to become a cloud architect. You need to read cloud logs, understand cloud identities well enough to judge an alert, and know how to contain a leaked key without destroying the evidence. Most cloud security training is built for engineers who design and build. This guide picks out the options that train the SOC side, with prices as of October 2026. ## What cloud skills does a SOC analyst actually need? Six groups, roughly in this order: cloud foundations (shared responsibility, the account or subscription hierarchy, network and storage exposure), identity and access, logging and telemetry, detection and hunting, investigation and incident response, and containment and recovery. We list all 33 skills, with the AWS, Azure and Google Cloud services for each, in the [SOC analyst cloud skills checklist](/blog/soc-analyst-cloud-skills-checklist), and you can score yourself in the [interactive version](/tools/soc-cloud-skills-checklist). ## Which cloud security training is best for SOC analysts? OptionBest forWhy choose itMain drawbackPrice / free tier (Oct 2026) [Microsoft SC-200 (Security Operations Analyst Associate)](https://learn.microsoft.com/en-us/credentials/certifications/security-operations-analyst/)Analysts in a Microsoft Sentinel / Defender SOCTests triage, incident response and KQL hunting across Defender XDR, Sentinel, Entra ID and Defender for CloudMicrosoft-centricFree Microsoft Learn prep; exam priced by country; free annual renewal [AWS Certified Security – Specialty](https://aws.amazon.com/certification/certified-security-specialty/)Analysts and engineers in AWS-heavy environmentsCovers detection, incident response, logging and IAM on AWSBroad engineering scope beyond SOC work$300 exam; free AWS Skill Builder courses [Google Professional Cloud Security Engineer](https://cloud.google.com/certification/cloud-security-engineer)Google Cloud environmentsCovers IAM, network security, data protection and operations on Google CloudEngineering-heavy; less SOC-specific$200 exam SANS SEC541 (Cloud Security Threat Detection) → GIAC GCTDCloud detection engineers and threat huntersThreat-driven labs on cloud-native logging and detection across AWS, Azure and Microsoft 365CostSANS course pricing (several thousand dollars); GIAC attempt $999 SANS FOR509 (Enterprise Cloud Forensics and Incident Response) → GIAC GCFRIncident responders and forensic analysts23 labs on AWS, Azure and Google Cloud evidence sourcesCostSANS course pricing; GIAC attempt $999 [Pwned Labs](https://pwnedlabs.io/)Hands-on cloud attack and defence labsFree tier; hands-on certifications per cloud (ACRTP for AWS, MCRTP for Azure, GCRTP for Google Cloud) and a blue-team rangeOffensive emphasis; paid plans for full accessFree tier; paid plans [flaws.cloud and flaws2.cloud](http://flaws2.cloud/)A first taste of AWS mistakes and a CloudTrail investigationHosted by the author (Scott Piper); flaws2 has an attacker path and a defender pathAWS only; fixed scenariosFree [CloudGoat (Rhino Security Labs)](https://github.com/RhinoSecurityLabs/cloudgoat)Realistic AWS attack pathsVulnerable-by-design scenarios deployed with Terraform into your own accountRuns in your AWS account: cost and cleanup are your jobFree (you pay AWS usage) PlayCISO cloud labsPractising cloud incident decisions without a cloud accountBrowser labs: Leaked Cloud Key, IAM Privilege-Escalation, Cloud Posture, Cascade Incident (identity → cloud → data), plus checklistsSimulations, not a real console; no accredited certificationLabs free; Pro $5/month or $40/year TryHackMe and Hack The Box also have cloud content; as of October 2026 TryHackMe puts its advanced cloud content in the MAX tier. They are strong choices if you already use those platforms for general skills. ## What is the best cloud incident response training for AWS and Azure? Cloud incident response is mostly three things: knowing which logs exist and how long they are kept, handling compromised credentials correctly, and preserving evidence before resources disappear. The best paid course for it is SANS FOR509. The free route is surprisingly good: - AWS: the AWS Security Incident Response Guide and the GuardDuty guide to remediating compromised credentials; flaws2.cloud’s defender path for a CloudTrail investigation. - Azure and Microsoft 365: Microsoft’s incident response playbooks (phishing, password spray, app consent grant) and the SC-200 learning paths on Microsoft Learn. - Google Cloud: Google’s data incident response process and its guidance on compromised credentials. - Decision practice: the Leaked Cloud Key Lab (deactivate or delete, sessions that outlive the key, sweeping every region), the Cascade Incident Lab (phished identity → new cloud keys → bucket export → extortion) and the Cloud Breach Response Checklist. - Framework: NIST SP 800-61 Rev. 3, which aligns incident response with NIST CSF 2.0. ## A free 30-day cloud plan for SOC analysts - Week 1, logs. Read your provider’s audit log documentation. Use the Cloud Logging Gap Checker to learn which logs are off by default. - Week 2, identity. Read the IAM documentation, then run the IAM Policy Analyzer and the IAM Privilege-Escalation Lab. Azure shops: the Conditional Access Lab. - Week 3, detection. Learn ten native findings (GuardDuty, Defender for Cloud or Security Command Center) and write three queries: what did this identity do, who created access keys, who disabled logging. Practise rule logic in the Detection Lab. - Week 4, response. flaws2.cloud defender path, then the Leaked Cloud Key Lab and the Cascade Incident Lab. Finish by scoring yourself in the skills checklist. ## What should a cloud learning path look like by role? RoleFocusCredential to consider Tier 1 SOC analystLog sources, native findings, reading a policy, scoping a leaked keySC-200, or the provider’s security fundamentals first Tier 2 analyst / detection engineerQueries, detection rules, privilege-escalation paths, containmentSC-200, AWS Security – Specialty, GIAC GCTD Incident responder / IR leadTimelines across identity, cloud and data; evidence; persistence; recoveryGIAC GCFR (FOR509) SOC managerLogging coverage, retention, playbooks, metricsNone required; use the checklists and tabletop labs ## Where does PlayCISO fit, and where does it not? PlayCISO trains decisions in the browser: which credential to disable first, what to snapshot before terminating, which finding actually reaches data. It does not give you a real cloud console, an accredited certification or a full cloud range; for those, use the provider courses, Pwned Labs, CloudGoat or SANS. The labs are free; Pro ($5/month or $40/year) unlocks the paid tools. The [Cloud & Identity Security track](/projects/cloud-identity-security) gives a verifiable certificate of completion, which is a training record, not an industry certification. ## Checklist: choosing cloud security training as a SOC analyst - Does it match the cloud and the SIEM your SOC actually uses? - Does it teach logs and detection, not only architecture? - Is there hands-on work with leaked credentials and containment? - Does it cover what is off by default and how long logs are kept? - Can you practise without risking a real bill or a real tenant? - Do you need the credential now, or the skill first? ## Frequently asked questions ### What is the best cloud incident response training for AWS and Azure? For depth, SANS FOR509 (Enterprise Cloud Forensics and Incident Response, leading to GIAC GCFR) covers AWS, Azure and Google Cloud evidence sources in 23 labs. For a lower-cost credential, Microsoft’s SC-200 covers incident response in Microsoft Sentinel, Defender XDR and Defender for Cloud, and AWS Certified Security – Specialty covers detection and incident response on AWS. Free practice: flaws2.cloud’s defender path, the AWS Security Incident Response Guide, Microsoft’s incident response playbooks, and PlayCISO’s Leaked Cloud Key Lab and Cascade Incident Lab. ### What is the best cloud security training for beginners? Start free with the provider you are most likely to use: Microsoft Learn for Azure, AWS Skill Builder’s free courses for AWS, or Google Cloud Skills Boost. Add hosted challenges such as flaws.cloud, and browser labs such as PlayCISO’s Cloud Posture Lab for misconfigurations. Take a paid course or certification once you know which cloud and role you are aiming for. ### Is self-paced or live cloud security training better? Self-paced suits fundamentals, shift workers and global teams across time zones, and it is cheaper. Live training suits complex topics such as cloud forensics, where questions and a guided lab environment save time. Many teams use self-paced provider material for everyone and send one or two people on a live course such as SANS FOR509 or SEC541. ### What training helps with zero trust in cloud environments? Microsoft Learn has free Zero Trust material for Azure and Entra ID, and each provider documents its identity-centric controls (Conditional Access, IAM Identity Center, context-aware access). Pair that with a maturity model: PlayCISO’s Zero Trust Maturity Assessment scores you against CISA’s Zero Trust Maturity Model 2.0 across identity, devices, networks, applications and data. ### Which cloud security certification is best for a SOC analyst? SC-200 if your SOC runs Microsoft Sentinel or Defender, because it tests exactly that work. AWS Certified Security – Specialty if you are AWS-heavy. Google Professional Cloud Security Engineer if you work on Google Cloud. GIAC GCTD (with SANS SEC541) or GCFR (with FOR509) if your employer pays and you specialise in cloud detection or forensics. _Exam prices and course details were checked on aws.amazon.com, learn.microsoft.com, cloud.google.com, sans.org, giac.org, pwnedlabs.io and tryhackme.com in October 2026._