If you’re trying to become a Cloud Security Engineer, you’re probably drowning in advice.

“Get certs.”
“Learn Kubernetes.”
“Do labs.”
“Build projects.”
“Master IAM.”

All true. Still not helpful.

What you actually need is a sequence. A ladder you can climb where each step makes the next step easier.

That’s what this newsletter is: a practical path from zero to “I can do the job”, using mostly free resources, and ending with portfolio projects you can publish.

The mindset shift: cloud security is not a toolset

Cloud security isn’t “learning Wiz” or “learning Prisma” or “learning GuardDuty.”

Cloud security is being the person who can answer questions like:

  • “How should we authenticate users and services in this architecture?”

  • “What’s the safest way to deploy quickly without creating a mess?”

  • “What telemetry do we need to detect abuse?”

  • “What permissions are actually required, and how do we prove it?”

You’re supporting engineering. You’re making real tradeoffs. Security is part architecture, part operations, part threat modeling, part communication.

So the right path is:

  1. Learn how cloud systems work

  2. Learn how they’re built and deployed

  3. Then layer in security

Now let’s climb the ladder.

Step 1: Pick ONE cloud platform and commit

Stop trying to learn AWS, Azure, and GCP at the same time.

Pick one primary cloud to go deep on first. You can add a second later.

AWS (most direct job signal)

Azure (great if you like SOC + detection)

GCP (underrated differentiation)

Goal of Step 1:
You should be able to explain, at a high level:

  • compute, networking, storage

  • IAM concepts (users, roles, policies)

  • what logging exists and where it goes

If you can’t explain those yet, don’t move on.

Step 2: Learn containers (because that’s what the cloud runs)

Cloud apps are built on containers. If containers are fuzzy, everything else will be fuzzy too.

Start here:

Core concept you need to internalize:
Containers are just processes with isolation controls.

That one sentence explains:

  • why container escape matters

  • why runtime permissions matter

  • why “container security” isn’t just scanning images

Goal of Step 2:
Run containers locally, understand images vs containers, and be able to describe what isolation actually means.

Step 3: Add Kubernetes (where security gets real)

Kubernetes is the orchestration layer behind modern cloud-native applications.

Start here:

Then learn the security layer:

What to focus on first (don’t boil the ocean):

  • RBAC and service accounts

  • network policies

  • secrets handling

  • admission control and policy

  • logging and detection at cluster level

Goal of Step 3:
Be able to explain how identity and permissions work inside Kubernetes. RBAC alone is an interview differentiator.

Step 4: Learn Infrastructure as Code (so you can build safely + tear down fast)

If you’re going to do labs, you need a way to avoid racking up cloud bills.

Infrastructure-as-Code solves that. You deploy, test, then destroy.

Recommended starting point:

Other IaC options (good to know exist):

The cheat code:
If you build with Terraform, you can run terraform destroy and wipe everything you created.

That enables fast iteration without fear.

Goal of Step 4:
Provision a small network + compute resource using IaC, and destroy it cleanly.

Step 5: Now layer in cloud security fundamentals (the real job)

Once you understand how the cloud is built, the security concepts click fast.

Here’s your core set:

IAM: the new perimeter

If you don’t understand IAM, you don’t understand cloud security. Period.

CSPM: posture and misconfigurations

CSPM is your “what did we misconfigure” view.

Secrets management

Most real breaches are still identity + secrets. Treat this as core.

Policy as Code

This is how mature teams scale security without becoming a bottleneck.

Detection and response

If you can’t detect abuse, you don’t have security. You have hope.

Security architecture

This is how you think like an engineer, not like a tool operator.

Step 6: Build portfolio projects that map to real cloud security work

This is where you separate yourself from 99% of applicants.

Project 1: AWS mini security program (Terraform + GuardDuty + Security Hub)

Build this with Terraform so you can destroy everything after.

What to deploy:

  • VPC + subnets

  • EC2 instance

  • security groups and network hardening

  • enable GuardDuty (detection)

  • enable Security Hub (posture/CSPM)

What to do next:

  • review Security Hub findings

  • monitor GuardDuty alerts

  • intentionally create a few misconfigurations to generate findings

  • document what happened and how you fixed it

Deliverable: a short security assessment report:

  • architecture diagram

  • threat assumptions

  • findings list

  • remediation steps

  • “what I would do next in a real company”

That report is interview fuel.

Project 2: Azure SOC lab (Sentinel)

Deliverable:

  • data sources you onboarded

  • 3 detections you built

  • 1 incident investigation writeup

Project 3: GCP hands-on security labs

Deliverable:

  • “what I learned about IAM/service accounts”

  • “how logging and monitoring works in GCP”

  • “common misconfigs and how to prevent them”

The weekly loop that makes you dangerous: simulate the job in public

Here’s the fastest way to turn knowledge into interview-ready output.

Go into ChatGPT and paste this:

“You are a software engineer building a cloud-native application.
I am a cloud security engineer supporting your team.
Ask me one realistic question you would need answered to move your project forward securely.
Your question should:
Be specific to cloud or application development
Reflect a real engineering decision (architecture, CI/CD, auth, data, infra, etc.)
Show awareness of tradeoffs (speed vs security, cost vs risk, MVP vs scale)”

When it gives you a question:

  1. answer it like you’re on the team

  2. draw the architecture in lucid.app

  3. write a short design review

  4. post it

Do that once per week for 8 weeks.

Your LinkedIn becomes your portfolio. Recruiters don’t need to guess if you can do the job.

A simple 6-week plan (if you want structure)

If you want a clean schedule, here’s one:

Week 1: Pick cloud + fundamentals
Week 2: IAM basics + logging basics
Week 3: Containers + threat model basics
Week 4: Kubernetes basics + RBAC
Week 5: Terraform + deploy a lab environment
Week 6: Add detection/CSPM + write your assessment report

After that, repeat with deeper projects.

Closing: don’t chase “more resources”, chase output

Courses don’t get you hired.

Proof gets you hired.

If you build one clean project, document it, and publish your thinking, you will beat candidates with more certifications but no portfolio.

Keep Reading

View more
caret-right
© 2026 The InfraSecOps Engineer.
beehiivPowered by beehiiv