Careers guide

Cloud Security Roles: Skills, Pay, How to Get In

Cloud security roles split into seven common jobs: cloud security engineer, architect, cloud SOC analyst, DevSecOps or platform security engineer, cloud compliance analyst, cloud incident responder, and cloud penetration tester. They share a core of identity, network and storage policy, logging and key management, applied on AWS, Azure, Google Cloud and others.

BLS publishes no cloud-specific pay series. The closest group, Information Security Analysts, had a median of $129,180 in May 2025, with employment projected to grow +21% from 2025 to 2035. Below: what each role does, the skills, certifications and labs to practise, and a 90-day path.

Updated 4 November 2026

The seven roles at a glance

Role	Main question it answers	Closest BLS group
Cloud security engineer	How do we build and keep the controls working?	Information Security Analysts, or Software Developers
Cloud security architect	How should the environment be designed to be safe?	Computer Network Architects (covers network design, not all security architecture)
Cloud security analyst (cloud SOC)	What is happening in our cloud right now?	Information Security Analysts
DevSecOps / platform security engineer	How do we make the secure way the easy way in the pipeline?	Software Developers, or Information Security Analysts
Cloud compliance / GRC analyst	Can we show we meet the requirement?	Information Security Analysts
Cloud incident responder	How do we contain and recover from a cloud compromise?	Information Security Analysts
Cloud penetration tester	Where would an attacker get in, so we can close it?	Information Security Analysts

The mapping is ours: BLS has no cloud series and names no cloud roles, so these are the nearest published occupations, not official classifications.

What each role does, needs and practises on

1. Cloud security engineer

Day to day: builds guardrails (organisation policies, service control policies), hardens storage, keys and networks, automates posture checks, fixes findings with the owning teams.

Core skills: IAM on at least one cloud, networking, scripting, infrastructure-as-code, logging. Tools: native policy engines, CSPM, Terraform or similar.

Certifications: AWS Certified Security Specialty, with Security+ as a broad base. Practise: AWS Hardening Lab, Azure Hardening Lab, GCP Hardening Lab, IAM Privilege Escalation Lab, OCI Security Lab, IBM Cloud Security Lab.

2. Cloud security architect

Day to day: sets account and subscription structure, identity design, network segmentation and logging reference designs; reviews new projects; writes the standards engineers implement.

Core skills: threat modelling, landing-zone design, trade-off writing, stakeholder influence. Tools: reference architectures, threat modelling, diagrams.

Certifications: the cloud provider's security specialty plus CISM if moving towards management. Practise: read Secure AWS, Azure, GCP, OCI and IBM Cloud architecture guides, then use the threat model tool and CNAPP selector.

3. Cloud security analyst (cloud SOC)

Day to day: triages cloud alerts (anomalous sign-ins, unusual API calls, exposed resources), investigates with audit logs, escalates and tunes detections.

Core skills: reading control-plane logs, identity concepts, SIEM queries. Tools: native threat detection, SIEM, CSPM.

Certifications: Security+ to start; see the certifications guide. Practise: AWS Account Compromise Lab, Azure Identity Compromise Lab, GCP Incident Triage Lab, Cloud Logging Gap Checker, SOC cloud skills checklist.

4. DevSecOps / platform security engineer

Day to day: secures CI/CD, scans code, images and templates, manages secrets and pipeline credentials, builds paved paths so developers pick secure defaults.

Core skills: pipelines, containers and Kubernetes basics, secrets management, developer empathy. Tools: CI systems, IaC scanners, container scanners.

Certifications: cloud specialty plus a container or Kubernetes credential where the employer uses them. Practise: Kubernetes Log Triage Lab, DevSecOps breach response checklist, Leaked Cloud Key Lab, Cloudflare Security Lab, DigitalOcean Security Lab.

5. Cloud compliance / GRC analyst

Day to day: maps cloud controls to frameworks, collects evidence, runs control assessments, tracks exceptions and reports posture to risk owners.

Core skills: framework fluency, evidence collection, enough technical depth to challenge a screenshot. Tools: CSPM dashboards, GRC platforms, benchmark checklists.

Certifications: CISM or similar; see the cert roadmap. Practise: AWS, Azure, GCP, OCI and IBM Cloud security checklists, CIS AWS benchmark checklist, CSPM readiness scorecard.

6. Cloud incident responder

Day to day: contains compromised identities and workloads, preserves evidence, reconstructs timelines from audit logs, and writes the post-incident review.

Core skills: cloud forensics basics, log analysis, calm decision-making, communication. Tools: audit logs, snapshots, SIEM, IR playbooks.

Certifications: a cloud specialty plus an incident response credential from the certifications guide. Practise: AWS Account Compromise Lab, Leaked Cloud Key Lab, GCP Incident Triage Lab, IR Playbook Lab.

7. Cloud penetration tester (defensive framing)

Day to day: with written authorisation, tests cloud accounts for privilege escalation paths, exposed storage and weak trust relationships, then reports fixes. The defender's aim is closing the path, so the best practice is understanding why each path works.

Core skills: IAM internals, attack-path reasoning, reporting. Tools: provider CLIs, policy analysers, authorised testing frameworks.

Certifications: a penetration testing credential plus a cloud one. Practise (defender view): IAM Privilege Escalation Lab, IAM Policy Analyzer, S3 Bucket Policy Auditor, Cloud Posture Lab.

Related topic roles: CASB Lab, CSPM Triage Lab and AISPM Lab suit analysts and engineers working on SaaS, posture and AI workloads.

A 90-day cloud security learning path

This is a suggested sequence, not a guarantee of a job. Adjust to the time you have.

Days	Focus	Do this
1 to 14	Concepts and the shared responsibility model	Read the cloud security hub, then What is CSPM and What is CASB. Run the Cloud Posture Lab.
15 to 35	Identity on your first cloud	IAM Privilege Escalation Lab, IAM Policy Analyzer, then your cloud's hardening lab (AWS, Azure or GCP).
36 to 50	Storage, keys and logging	S3 Bucket Policy Auditor, Cloud Logging Gap Checker, CIS AWS benchmark checklist.
51 to 65	Detection and incident response	Your cloud's incident lab (AWS, Azure, GCP) and the Leaked Cloud Key Lab.
66 to 78	Posture management and prioritisation	CSPM Triage Lab, CSPM readiness scorecard, CNAPP selector, CASB Lab.
79 to 90	Second cloud, architecture and interview prep	One checklist on a second cloud (AWS, Azure, GCP, OCI, IBM Cloud), the matching architecture guide, then the interview questions below and interview prep.

Pick a certification near the end of the path using the cert roadmap, and use the AISPM Lab if your target employer runs AI workloads in the cloud.

Pay and outlook: what BLS can and cannot tell you

BLS has no cloud security series and does not mention cloud in its Information Security Analysts profile. The figures below are for the whole occupation, accessed 4 November 2026 (page last modified 27 August 2026).

Measure	Information Security Analysts
Median pay, May 2025	$129,180 a year
Lowest 10% earned less than	$75,090
Highest 10% earned more than	$199,850
Jobs, 2025	192,900
Projected change, 2025 to 2035	+21% (40,600 jobs), much faster than average
Typical entry-level education	Bachelor's degree

These are base wages across all experience levels and all security analysts, not cloud offers. We quote no vendor salary survey because none was fetched and attributed for this guide. Compare roles in the Cybersecurity Salary Explorer.

Ten cloud security interview questions

Walk me through the shared responsibility model for a VM, a managed database and a SaaS app. A strong answer covers: Provider secures the facility and the layers it operates; you secure identity, data, configuration and, for IaaS, the guest OS. Strong answers show the line moving as you go from IaaS to PaaS to SaaS, and name one thing the customer always owns (identity and data).
A bucket or storage container is publicly readable. How do you find out why and fix it? A strong answer covers: Check resource policy, ACLs and account-level block settings, then logs for who read what. Fix at the guardrail (account or organisation policy), not only the one bucket. Strong answers mention preventing recurrence and checking for data already taken.
An access key is found in a public repository. What do you do in the first hour? A strong answer covers: Disable or restrict the key before deleting it, review audit logs for its activity, look for new users, roles, keys and resources it created, rotate dependent secrets, then remove it from history. Strong answers keep evidence and separate containment from cleanup.
How do you review an IAM policy for least privilege? A strong answer covers: Look for wildcard actions and resources, permissions that allow privilege escalation (creating policies, passing roles), missing conditions, and unused access. Strong answers use access analysis tools and propose a narrower policy rather than only criticising.
What logs do you want switched on in a new cloud account, and where do they go? A strong answer covers: Control-plane audit logs, network flow logs, storage and key access logs, and identity sign-in logs, sent to a separate, write-restricted account or project. Strong answers cover retention, tamper resistance and who can read them.
Your CSPM shows thousands of findings. How do you prioritise? A strong answer covers: Combine severity with exposure (internet reachable), data sensitivity, identity reach and exploitability, and group by owner. Strong answers describe exceptions with expiry and automation for the repeat offenders.
How would you secure infrastructure-as-code pipelines? A strong answer covers: Scan templates before merge, restrict who can approve and apply, give the pipeline short-lived scoped credentials, and keep state files protected. Strong answers treat the pipeline itself as a high-value target.
Explain how you would contain a compromised workload identity. A strong answer covers: Revoke or restrict sessions, apply a deny policy, snapshot for forensics, rotate secrets it could read, and trace what it assumed or created. Strong answers note that deleting a role can erase evidence and break dependent systems.
What is the difference between CSPM, CWPP, CIEM and CNAPP? A strong answer covers: Posture of cloud configuration, protection of running workloads, entitlement analysis, and the platform that combines them. Strong answers say what each misses and avoid vendor marketing terms.
Tell me about a security control you made easier to adopt for a developer team. A strong answer covers: A behavioural question. Strong answers describe the friction, the paved path or default you provided, how you measured adoption, and what you gave up. Prepare one real story.

Rehearse out loud in interview prep and tune the CV with Resume Review.

Frequently asked questions

What is a cloud security engineer?

A cloud security engineer designs, builds and maintains the controls that protect workloads on cloud platforms: identity and permissions, network and storage policy, key management, logging, and posture checks. The work is closer to engineering than to alert triage, and most of it is about preventing misconfiguration rather than reacting to attacks.

What are the main cloud security roles?

Cloud security engineer, cloud security architect, cloud security analyst (cloud SOC), DevSecOps or platform security engineer, cloud compliance or GRC analyst, cloud incident responder, and cloud penetration tester. Titles overlap between employers, so read the duties in the job ad rather than the title.

How do I become a cloud security engineer?

Most people arrive from systems administration, networking, software or a security analyst role. Learn one cloud platform in depth (identity, networking, logging), add scripting, then practise securing real configurations. A broad entry certification helps screening, and a cloud security specialty exam helps for engineer roles. The 90-day path in this guide sequences hands-on labs for each step.

How much do cloud security engineers get paid?

The U.S. Bureau of Labor Statistics has no cloud-specific series. The closest group is Information Security Analysts, with a median of $129,180 in May 2025. Many cloud security engineers are counted there, others are counted as software developers or network architects. Treat the BLS band as a reference and check real job ads for your location and level.

Is cloud security a good career?

Demand evidence is indirect. BLS projects employment of information security analysts to grow +21% from 2025 to 2035, described as much faster than average, and it does not break out cloud work separately. Cloud skills widen the roles you can apply for within security; they do not guarantee a job.

Is cloud security hard to learn?

It is learnable in steps. The hard parts are the volume of services and the permission models, which differ on each cloud. Start with identity and storage policy on one platform, because that is where many real incidents begin, then add logging, networking and a second cloud.

Do I need a degree or certifications for cloud security?

BLS lists a bachelor’s degree as the typical entry-level education for information security analysts, and employers vary. Certifications are a screening signal rather than a substitute for hands-on proof. See the certifications guide and the cert roadmap to pick one that matches the role.

Which cloud should I learn first?

The one your target employers use. If you have no target, AWS has the largest body of public learning material; Azure is common where the organisation runs Microsoft 365; Google Cloud is common in data-heavy teams. The concepts (IAM, network policy, logging, key management) carry across, which is why the labs here cover all of them.

Will AI replace cloud security engineers?

No source we fetched supports a firm answer, so we do not predict. What is observable: tools now automate parts of posture management and triage, which shifts human time towards design, exception handling and judgement. Skills in reviewing automated findings, such as the CSPM triage lab, stay relevant either way.