SOC Analyst Cloud Skills Checklist
A SOC analyst working cloud alerts needs to know which log answers which question, how cloud identities get abused, and how to contain a leaked key without destroying the evidence. This checklist covers 33 skills in six areas, names the exact AWS, Azure or Google Cloud services for each, and turns your answers into a score and a gap list with a lab to practise and a free guide to read. Everything runs in your browser.
Rate each skill honestly: Not yet, Read about it, Done it in a lab or Done it for real. Anything below “done it in a lab” goes on your gap list. Triage alerts, read logs and policies, escalate well.
Cloud foundations
Enough architecture to know what you are looking at when an alert names a resource.
- Tier 1Explain the shared responsibility model for IaaS, PaaS and SaaS, and say which side owns a given finding.
Half of cloud triage is deciding whether a problem is yours to fix or the provider’s.
AWS: AWS shared responsibility model: AWS secures the cloud, you secure what you put in it (IAM, data, network config, OS on EC2).
- Tier 1Navigate the resource hierarchy and know where guardrails are applied.
An alert names an account, subscription or project; you need to know who owns it and what policy sits above it.
AWS: AWS Organizations: management account, organizational units, member accounts, service control policies (SCPs).
- Tier 1Read a network rule and say exactly what is reachable from the internet.
Open SSH, RDP or database ports are among the most common root causes of cloud compromise.
AWS: VPCs, subnets, route tables, security groups (stateful) and network ACLs (stateless); 0.0.0.0/0 on port 22 or 3389.
- Tier 1Tell whether a storage bucket or container is public, and how.
Public storage is the classic cloud data breach, and the alert rarely says which setting caused it.
AWS: S3 Block Public Access, bucket policies with "Principal": "*", ACLs, presigned URLs.
Identity and access
In the cloud, identity is the perimeter. Most cloud incidents are an identity doing something it should not.
- Tier 1Name every kind of identity in the platform, and which ones have long-lived secrets.
Long-lived keys are what leak into code repositories and get abused.
AWS: Root user, IAM users and access keys (long-lived), IAM roles and STS temporary credentials, IAM Identity Center users.
- Tier 1Read a permission grant and state what it actually allows, including wildcards.
You cannot judge blast radius without knowing what the compromised identity could do.
AWS: IAM policy JSON: Effect, Action, Resource, Condition; NotAction foot-guns; explicit deny wins.
Logging and telemetry
Know which log answers which question, and which logs are off by default.
- Tier 1Find who changed what in the control plane, and how far back you can look.
“What did the attacker change?” is the first question in every cloud incident.
AWS: CloudTrail management events; event history keeps 90 days without a trail.
- Tier 1Know whether you can prove who read a file, blob, secret or table.
Data-access logs decide whether a breach notification can rule out exfiltration.
AWS: CloudTrail data events for S3 (off by default) or S3 server access logs.
- Tier 1Pull sign-in and authentication events for a user or workload identity.
Impossible travel, MFA fatigue and token reuse all show up here first.
AWS: CloudTrail ConsoleLogin and AssumeRole events, IAM Identity Center sign-in events.
Detection and hunting
Turn telemetry into alerts you trust, and query it fast when you do not.
- Tier 1Triage the provider’s native threat findings and know what each finding type is based on.
These are the alerts a cloud SOC analyst sees most; you need to tell noise from a real key compromise.
AWS: Amazon GuardDuty findings (for example UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration).
- Tier 1Separate a posture finding (a misconfiguration) from a threat finding (someone using it).
A public bucket is a risk; a public bucket being downloaded from an unknown IP is an incident.
AWS: Security Hub controls and AWS Config (posture) versus GuardDuty (threat).
- Tier 1Write a basic query to answer “what did this identity do in the last 24 hours?”.
Console clicking does not scale; a query you can rerun is evidence.
AWS: CloudTrail Lake SQL, or Amazon Athena over CloudTrail logs in S3.
Investigation and incident response
Scope what happened across identity, cloud and data, and keep the evidence.
- Tier 1Scope a leaked credential: every action, every region, every source IP.
The most common cloud incident, and the one where people forget the other regions.
AWS: Search CloudTrail by access key ID in every region; check GuardDuty and the billing console for new resources.
What this tool is
- 33 cloud skills a SOC analyst needs, in six areas: cloud foundations, identity and access, logging and telemetry, detection and hunting, investigation and incident response, and containment and recovery.
- Pick AWS, Azure or Google Cloud and every skill shows the exact services involved (CloudTrail and GuardDuty; Entra ID, Sentinel and Defender for Cloud; Cloud Audit Logs and Security Command Center).
- Choose a target role (Tier 1, Tier 2 or IR lead), rate yourself from "not yet" to "done it for real", and get a score per area.
- Your gap list links a free PlayCISO browser lab to practise each skill and the provider’s own free documentation to read.
- Copy the result as a plain-text report for a one-to-one, a training plan or a promotion case. Runs in your browser; nothing is uploaded.
The full checklist
Every skill below is phrased as something you can do, not a topic you have heard of. Tier 1 skills are the minimum for triaging cloud alerts; Tier 2 adds investigation, detection engineering and containment; IR lead adds hunting, persistence removal and recovery.
Cloud foundations
- Explain the shared responsibility model for IaaS, PaaS and SaaS, and say which side owns a given finding. (Tier 1)
- Navigate the resource hierarchy and know where guardrails are applied. (Tier 1)
- Read a network rule and say exactly what is reachable from the internet. (Tier 1)
- Tell whether a storage bucket or container is public, and how. (Tier 1)
- Explain how a workload gets cloud credentials, and how an attacker steals them. (Tier 2)
- Know where serverless and container workloads log, and what “compromised” looks like for each. (Tier 2)
Identity and access
- Name every kind of identity in the platform, and which ones have long-lived secrets. (Tier 1)
- Read a permission grant and state what it actually allows, including wildcards. (Tier 1)
- Spot the common privilege-escalation paths in an identity’s permissions. (Tier 2)
- Understand how workforce sign-in is federated and where conditional rules apply. (Tier 2)
- Find third-party access: consented apps, cross-account roles and delegated permissions. (Tier 2)
- Know which credentials and sessions survive a password reset or key deletion. (Tier 2)
Logging and telemetry
- Find who changed what in the control plane, and how far back you can look. (Tier 1)
- Know whether you can prove who read a file, blob, secret or table. (Tier 1)
- Pull sign-in and authentication events for a user or workload identity. (Tier 1)
- Use flow logs to confirm or rule out data leaving, or lateral movement. (Tier 2)
- Explain where logs are centralised, who can delete them, and how long they are kept. (Tier 2)
Detection and hunting
- Triage the provider’s native threat findings and know what each finding type is based on. (Tier 1)
- Separate a posture finding (a misconfiguration) from a threat finding (someone using it). (Tier 1)
- Write a basic query to answer “what did this identity do in the last 24 hours?”. (Tier 1)
- Detect defence evasion: logging disabled, new keys, new admins. (Tier 2)
- Map cloud activity to MITRE ATT&CK techniques for the cloud. (Tier 2)
- Run a hypothesis-led hunt across a month of cloud logs. (IR lead)
Investigation and incident response
- Scope a leaked credential: every action, every region, every source IP. (Tier 1)
- Build one timeline across identity, cloud control plane and data access. (Tier 2)
- Preserve evidence before anyone terminates a resource. (Tier 2)
- Know the provider’s incident response guidance and when to open a support case. (IR lead)
- Run the incident against a framework and decide severity and notification. (IR lead)
Containment and recovery
- Disable a compromised credential the right way (and know why disable beats delete). (Tier 2)
- Isolate a workload on the network without stopping it. (Tier 2)
- Sweep every region, subscription or project for resources the attacker created. (Tier 2)
- Find and remove persistence: new identities, keys, trust relationships and scheduled code. (IR lead)
- Recover and harden: rotate secrets, close the root cause, verify with a benchmark. (IR lead)
Why “done it in a lab” is the bar
Reading the CloudTrail documentation and finding one access key’s actions across seventeen regions at 2 a.m. are different skills. The checklist treats anything you have only read about as a gap, because in an incident you fall back on what you have done before. The free labs linked from the gap list (the Leaked Cloud Key Lab, IAM Privilege-Escalation Lab, Cloud Posture Lab and Cascade Incident Lab) are decision drills in the browser: no cloud account, no bill, no risk of touching production. For hands-on work in a real console, use a sandbox account with a budget alert, or hosted challenges such as flaws.cloud.
Frequently asked questions
What cloud skills does a SOC analyst need?
Six groups. Cloud foundations (shared responsibility, the account or subscription hierarchy, network rules, storage exposure). Identity and access (identity types, reading a policy, privilege-escalation paths, federation, third-party app access, sessions that survive a reset). Logging (control-plane, data-access, sign-in and flow logs, and what is off by default). Detection (native findings such as GuardDuty, Defender for Cloud and Security Command Center, a query language such as KQL or CloudTrail Lake SQL, and ATT&CK mapping). Investigation (scoping a leaked key across regions, building a timeline, preserving evidence). Containment (disabling credentials correctly, isolating workloads, sweeping for attacker-created resources and persistence).
Which cloud should a SOC analyst learn first?
The one your employer, or the employers you are applying to, runs. Learn it deeply and the other two at the level of "which service is the equivalent". The concepts transfer: every provider has a control-plane audit log, data-access logs that are mostly off by default, a native threat-detection service and an identity layer that is the real perimeter.
What should I study for incident response in the cloud?
Start with logging: know which log answers "what did this identity change?" and "who read this data?", and how long each is kept. Then credentials: how to disable a leaked key, why existing sessions can outlive it, and how to sweep every region for what the attacker created. Then evidence: snapshot before terminating. The free provider guides are the AWS Security Incident Response Guide, Microsoft’s incident response playbooks and Google Cloud’s data incident response process; NIST SP 800-61 Rev. 3 gives the lifecycle.
Are there free resources to learn cloud identity and access management?
Yes. The provider documentation is free and good: the AWS IAM User Guide and its policy evaluation logic page, Microsoft Entra ID and Azure RBAC documentation on Microsoft Learn, and the Google Cloud IAM and service account overviews. For practice, flaws.cloud and flaws2.cloud are free hosted AWS challenges, and PlayCISO’s IAM Policy Analyzer, IAM Privilege-Escalation Lab and Conditional Access Lab run free in the browser.
Is this checklist an assessment or a certification?
Neither. It is a self-assessment to plan training. A score here proves nothing to an employer; a lab completed or a real incident handled does. Use it to decide what to practise next and to have a concrete conversation with your manager.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.