SOC Analyst Cloud Skills Checklist: 33 Skills for AWS, Azure and Google Cloud (2026)

Most SOC job descriptions now say “cloud experience preferred” without saying what that means. This checklist makes it concrete: 33 skills a SOC analyst needs to triage, investigate and contain cloud incidents, each phrased as something you can do, tagged by level, and linked to a place to practise. Use it to plan your own training, to build a team skills matrix, or to structure an interview. The interactive version scores you per area and lists your gaps with the exact AWS, Azure or Google Cloud services for each skill.

How should you use this checklist?

1. Pick the cloud your SOC monitors most. Learn it deeply; learn the others as “what is the equivalent?”.
2. Pick your target level. Tier 1 is the minimum for triaging cloud alerts; Tier 2 adds investigation, detection engineering and containment; IR lead adds hunting, persistence removal and recovery.
3. Rate each skill honestly: not yet, read about it, done it in a lab, done it for real. Anything below “done it in a lab” is a gap, because in an incident you fall back on what you have actually done.
4. Close gaps in order: Tier 1 first, then by area.

What are the AWS, Azure and Google Cloud equivalents?

The concepts transfer between providers; the names do not. This is the translation table most analysts wish they had on day one.

Two defaults catch people out on every provider. Control-plane history is kept for you for a while (90 days of CloudTrail event history and of the Azure Activity Log; 400 days of Google Cloud Admin Activity logs), but data-access logging is mostly off by default, so “who downloaded the bucket?” is often unanswerable unless someone turned it on before the incident. Check yours with the Cloud Logging Gap Checker.

What is on the SOC analyst cloud skills checklist?

Cloud foundations

Enough architecture to know what you are looking at when an alert names a resource.

• Explain the shared responsibility model for IaaS, PaaS and SaaS, and say which side owns a given finding. (Tier 1)
• Navigate the resource hierarchy and know where guardrails are applied. (Tier 1)
• Read a network rule and say exactly what is reachable from the internet. (Tier 1) Practise: Cloud Posture Lab.
• Tell whether a storage bucket or container is public, and how. (Tier 1) Practise: S3 Bucket Policy Auditor.
• Explain how a workload gets cloud credentials, and how an attacker steals them. (Tier 2)
• Know where serverless and container workloads log, and what “compromised” looks like for each. (Tier 2)

Identity and access

In the cloud, identity is the perimeter. Most cloud incidents are an identity doing something it should not.

• Name every kind of identity in the platform, and which ones have long-lived secrets. (Tier 1) Practise: Service-to-service auth lab.
• Read a permission grant and state what it actually allows, including wildcards. (Tier 1) Practise: IAM Policy Analyzer.
• Spot the common privilege-escalation paths in an identity’s permissions. (Tier 2) Practise: IAM Privilege-Escalation Lab.
• Understand how workforce sign-in is federated and where conditional rules apply. (Tier 2) Practise: Conditional Access Lab.
• Find third-party access: consented apps, cross-account roles and delegated permissions. (Tier 2) Practise: OAuth Consent Lab.
• Know which credentials and sessions survive a password reset or key deletion. (Tier 2) Practise: Leaked Cloud Key Lab.

Logging and telemetry

Know which log answers which question, and which logs are off by default.

• Find who changed what in the control plane, and how far back you can look. (Tier 1) Practise: Cloud Logging Gap Checker.
• Know whether you can prove who read a file, blob, secret or table. (Tier 1) Practise: Cloud Logging Gap Checker.
• Pull sign-in and authentication events for a user or workload identity. (Tier 1) Practise: ITDR Lab.
• Use flow logs to confirm or rule out data leaving, or lateral movement. (Tier 2)
• Explain where logs are centralised, who can delete them, and how long they are kept. (Tier 2)

Detection and hunting

Turn telemetry into alerts you trust, and query it fast when you do not.

• Triage the provider’s native threat findings and know what each finding type is based on. (Tier 1) Practise: Virtual SOC cases.
• Separate a posture finding (a misconfiguration) from a threat finding (someone using it). (Tier 1) Practise: Cloud Posture Lab.
• Write a basic query to answer “what did this identity do in the last 24 hours?”. (Tier 1) Practise: Detection Lab.
• Detect defence evasion: logging disabled, new keys, new admins. (Tier 2) Practise: Detection Lab.
• Map cloud activity to MITRE ATT&CK techniques for the cloud. (Tier 2)
• Run a hypothesis-led hunt across a month of cloud logs. (IR lead)

Investigation and incident response

Scope what happened across identity, cloud and data, and keep the evidence.

• Scope a leaked credential: every action, every region, every source IP. (Tier 1) Practise: Leaked Cloud Key Lab.
• Build one timeline across identity, cloud control plane and data access. (Tier 2) Practise: Cascade Incident Lab.
• Preserve evidence before anyone terminates a resource. (Tier 2) Practise: Cloud Breach Response Checklist.
• Know the provider’s incident response guidance and when to open a support case. (IR lead)
• Run the incident against a framework and decide severity and notification. (IR lead) Practise: Incident Severity Router.

Containment and recovery

Stop the attacker without destroying evidence or the business, then make sure they cannot come back.

• Disable a compromised credential the right way (and know why disable beats delete). (Tier 2) Practise: Leaked Cloud Key Lab.
• Isolate a workload on the network without stopping it. (Tier 2)
• Sweep every region, subscription or project for resources the attacker created. (Tier 2) Practise: Leaked Cloud Key Lab.
• Find and remove persistence: new identities, keys, trust relationships and scheduled code. (IR lead) Practise: IAM Privilege-Escalation Lab.
• Recover and harden: rotate secrets, close the root cause, verify with a benchmark. (IR lead) Practise: CIS AWS Benchmark Checklist.

Which skills matter most in a real cloud incident?

If you only have time for five, take these. They are the ones that decide whether a leaked-key incident is contained in an hour or becomes a breach notification:

• Data-access logging. Without it you cannot rule out exfiltration.
• Scoping a credential across every region. Attackers mine crypto in regions nobody watches.
• Sessions that survive key deletion. Temporary credentials issued before you acted keep working until they expire unless you revoke them.
• Disable, do not delete. Deleting the key first loses the identifier you are searching logs for.
• Snapshot before terminate. A terminated instance takes its disk and memory with it.

All five are rehearsed in the Leaked Cloud Key Lab, and the cross-layer version (a phished identity leading to new keys and a storage export) in the Cascade Incident Lab.

Where can you learn each area for free?

For structured courses and certifications (SC-200, AWS Security – Specialty, SANS SEC541 and FOR509), see the best cloud security training for SOC analysts.

How do managers use this as a team skills matrix?

Have each analyst complete the self-assessment and paste the copied report into a shared sheet. Look for skills nobody on a shift has at “done it in a lab” or above; those are single points of failure at 2 a.m. Then run one lab per fortnight as a team exercise and re-score each quarter. Self-ratings drift upward over time, so pair them with evidence: a completed lab, a written-up incident, or a detection rule merged into production.

Frequently asked questions

What is a SOC analyst cloud skills checklist?

A list of the cloud skills a security operations analyst needs to triage and investigate cloud alerts, phrased as things you can do. This one has 33 skills in six areas (foundations, identity, logging, detection, investigation, containment), each tagged Tier 1, Tier 2 or IR lead, with the AWS, Azure and Google Cloud services involved.

What cloud skills should a Tier 1 SOC analyst have?

At minimum: explain shared responsibility, navigate the account or subscription hierarchy, read a network rule and a storage policy, name the identity types and read a permission grant, find control-plane, data-access and sign-in logs, triage the provider’s native findings, tell a posture finding from a threat, write a basic query, and scope a leaked credential across regions.

Which cloud logs should a SOC analyst know?

For AWS: CloudTrail management and data events, S3 server access logs, VPC Flow Logs and GuardDuty findings. For Azure: the Activity Log, Entra ID sign-in and audit logs, storage and Key Vault diagnostic logs, and virtual network flow logs. For Google Cloud: Admin Activity and Data Access audit logs, VPC Flow Logs and Security Command Center findings. Know which are off by default: data-access logs are, almost everywhere.

How do I prove cloud skills without a cloud job?

Do the work in labs and write it up. Complete hosted challenges such as flaws.cloud and flaws2.cloud, deploy one CloudGoat scenario in a sandbox account with a budget alert, and practise incident decisions in browser labs. A short write-up of how you scoped a leaked key, with the queries you used, says more in an interview than a list of courses.

Service names and defaults were checked against AWS, Microsoft and Google Cloud documentation in October 2026. Providers change defaults; confirm against your own configuration.