Cloud Security

Level by level: what to learn and do

1. 1

   Foundations

   0–1 year

   IT support · Junior system administrator · Cloud support associate

   What you do

   Support users and servers, manage accounts and learn how one cloud platform works by building small things in a free account.

   Skills to learn

   • Networking fundamentals
   • Linux and Windows server basics
   • Identity basics: users, groups, MFA
   • Core cloud ideas: regions, VMs, storage, the shared responsibility model

   Certifications to consider: Microsoft AZ-900 or AWS Certified Cloud Practitioner; CompTIA Security+

   To reach the next level: Pick one main cloud (Azure or AWS) and go deep before learning a second.

2. 2

   Cloud administrator or engineer

   1–3 years

   Cloud administrator · Cloud engineer · Systems engineer

   What you do

   Build and run cloud resources: virtual networks, VMs, storage, backups, access permissions and monitoring.

   Skills to learn

   • Virtual networks, subnets and security groups
   • Identity and access management (IAM, Entra ID)
   • Command line and scripting (PowerShell, Bash, Python)
   • Infrastructure as code basics (Terraform, Bicep)
   • Monitoring and logging

   Certifications to consider: Microsoft AZ-104, or AWS Solutions Architect – Associate

   To reach the next level: Volunteer for security tasks: access reviews, logging, hardening and fixing audit findings.

3. 3

   Cloud security engineer

   3–5 years

   Cloud security engineer · Security engineer (cloud)

   What you do

   Design and enforce secure configurations, manage keys and secrets, monitor for threats, respond to cloud incidents and fix risky settings.

   Skills to learn

   • Least-privilege IAM and conditional access
   • Encryption, key and secret management
   • Cloud security posture management (CSPM)
   • Cloud logging, SIEM and incident response
   • Network security in the cloud: firewalls, private endpoints, VPNs

   Certifications to consider: Microsoft AZ-500, AWS Certified Security – Specialty, or Google Professional Cloud Security Engineer

   To reach the next level: Move security earlier: into code, pipelines and automation.

4. 4

   Senior / DevSecOps

   5–8 years

   Senior cloud security engineer · DevSecOps engineer

   What you do

   Build security into deployment pipelines, write policy as code, secure containers and Kubernetes, and lead cloud security projects.

   Skills to learn

   • Security in CI/CD pipelines
   • Policy as code and automated guardrails
   • Container and Kubernetes security
   • Zero Trust design
   • Threat modelling

   Certifications to consider: ISC2 CCSP; Certified Kubernetes Security Specialist (CKS)

   To reach the next level: Learn governance and compliance so you can design for a whole organisation.

5. 5

   Architect and leadership

   8+ years

   Cloud security architect · Head of cloud security

   What you do

   Design secure cloud foundations (landing zones), set standards across teams, meet compliance requirements and advise leadership on risk.

   Skills to learn

   • Secure landing zones and reference architectures
   • Multi-cloud strategy
   • Compliance frameworks such as ISO 27001 and SOC 2
   • Risk management and communication

   Certifications to consider: Microsoft SC-100, ISC2 CCSP or CISSP

   To reach the next level: Balance security, cost and speed so the business can move safely.

Years of experience are typical ranges, not rules: some people move faster, others take longer. Certification names and versions change, so always check the exam provider's website before you book.