How to become a cloud security engineer

It’s no secret that cloud security is a hot field. 

In fact, when we analyzed the skills of 657 cybersecurity teams that competed in our 2022 Business CTF event, we discovered that many underperformed when tackling cloud security challenges. This gap demand for talent presents a massive opportunity for those willing to specialize in cloud cybersecurity. 

But where should your journey to becoming a cloud cybersecurity engineer (CSE) start? And what does a CSE actually do?

In this guest post, we invite Mateusz Gierblinski, a former Cloud Security Engineer at NVISO, to share insights about breaking into this fast-growing field. 

Forever hungry for his next challenge, Mateusz started off in entry-level IT support and progressed to Sysadmin (ironically after being frustrated with the practices of other admins) before his role as Cloud Security Engineer at NVISO. He was also ranked among the top three HTB players in Belgium at one point! 

Why become a cloud security engineer? 

90% of 610 IT leaders surveyed in the 2022 IDC/Cloudreach survey consider cloud technology essential for survival, and 70% see the gaping cloud skills gap as an urgent concern. In other words, the tech world cannot ignore the cloud for much longer as its presence and importance continue to grow. 

Job security and pay are therefore some of the many obvious benefits of choosing a career in cloud security. I’ve also noticed that the cloud market is less saturated with talent in comparison to other fields (such as penetration testing) and holds many opportunities for progression. 

And if you get bored easily or simply enjoy challenging yourself (like me), specializing in cloud security means exciting opportunities to learn new technologies and grow your skills!

Suggested read: 18 SOC analyst interview questions and answers

What does a cloud security engineer do? 

CloudSec centers around building and maintaining security for anything deployed with given cloud providers. As a former cloud security engineer, I’d help build, maintain, upgrade and continuously improve cloud networks and cloud-based systems that are responsible for the operation of secure infrastructure, platforms, and software.

It’s a field that’s still emerging and defining itself, so responsibilities may differ from role to role. Examples of tasks and projects I’ve worked on include: 

• Investigating and creating technologies to enhance the security of cloud-based environments.

• Implementing security solutions such as Microsoft Defender for Endpoint.

• Conducting cloud security assessments based on industry best practices.

• Assessing client environments.

• Performing threat simulations.

How to become a cloud security engineer: 5 critical skills

Most cloud security engineers come from various backgrounds, but I’ve noticed some prerequisite skills and foundational knowledge that are crucial for a career in cloud security:  

1. Master computer networking

I worked for several companies in my early 20s where I learned about servers and networking systems (often poorly configured) by setting up shares, group policy objects (GPOs), users, group permissions, and roaming profiles. The foundational knowledge and experience I gained (alongside extracurricular learning) enabled me to improve system security and still serves me well today.

I encourage anyone looking into a cloud security career to prioritize developing a solid grasp of networking fundamentals because cloud environments still need servers, switches, and routers. So spend plenty of time learning about TCP/IP and the fundamentals of networking. Learn Linux. Take the Introduction to Networking course on the HTB Academy. I’d also recommend IppSec’s videos, LiveOverflow, Github, and Hacktricks.

 

2. Assume the attacker’s mindset 

Practical, offensive experience within cloud environments is essential. Learning how to attack vulnerabilities will teach you how to defend against them. Even if you’re aiming for a more blue team role, defensive teams need to have some red teaming experience to understand how attackers think. 

 

Hands-on experience also makes your resume stand out to potential recruiters. This is where HTB’s offensive cloud security training will help. You can pick Azure, AWS, and GCP cloud environments and learn: 

• Enumeration (specific to the cloud environment you choose) 

• Exploitation of serverless applications

• Exploiting misconfiguration 

• Lateral movement

• Local privilege escalation

• Mitigations and best practices

• Cloud penetration testing

• Situational awareness

Tip: Hack The Box's Cloud Track is a great way to exercise your knowledge of cloud exploitation vectors. 

Security is job zero at AWS. As a penetration tester, it’s crucial to continuously learn and hone new techniques. Lots of our cloud security engineers across Amazon use Hack The Box and the various challenges they offer to keep their skills up to date.  

 

Tobias Grimm, Penetration Testing Engineer at Amazon Web Services 

3. Learn (some) programming languages

Good IT is lazy. Learn to automate as much as possible to limit the number of mistakes you can make. 

Computers are good at repetition; we humans are not. Invest the time to learn languages like Python for scripting, Kusto Query Language (KQL) to query data, and Terraform to build your infrastructure using code. 

4. Get familiar with your tools, systems, and environments

As a cloud security engineer, you will be monitoring your environment for anomalies and fixing any security issues. But you cannot protect what you do not understand, so spend enough time reading documentation and trying things yourself.

5. Sharpen your communication and presentation skills

“Hey Mateusz, would you be interested in joining our cloud security team?” 

I didn’t expect to receive a response from NVISO, but here was the invitation to present to the recruiting team and prove my knowledge. 

I had to prepare a case study and give a presentation to an audience of three. It was of the most nerve-racking experiences of my life, and I felt like I butchered the presentation. 

The days following the panel presentation were hard. I didn’t hear back from the team, so I chalked it up as a loss and started applying for other cybersecurity jobs. But then I got a call from the hiring manager. I landed the job on the CloudSec team! 

The point of this story? Adequate presentation and communication skills are vital for leveling up your cybersecurity career. I wouldn't have got the job offer If I relied solely on my technical skills and knowledge. 

The days of being awkward, socially challenged nerds are behind us. As cybersecurity professionals, we need to communicate effectively with our team members, manage conflicts, set boundaries, clear misunderstandings, and secure buy-in from executives and decision-makers – especially in a field like cloud cybersecurity where responsibilities and job roles may vary. 

Recommended cloud security certifications (Azure & AWS) and training  

Everything felt alien to me when I started working in cloud security. I had (and still do) learn a lot. If you're interested in becoming a cloud security engineer yourself, I’d recommend the certifications listed below. Start with whatever is most relevant to the role you’re looking for and your current skill level: 

• AZ-900: Microsoft Azure Fundamentals

• AZ-500: Microsoft Azure Security Technologies

• SC-200: Microsoft Security Operations Analyst

• SC-300: Microsoft Identity and Access Administrator  

• SC-400: Microsoft Information Protection Administrator

• SC-100: Microsoft Cybersecurity Architect 

For Amazon Web Services (AWS) Certified Cloud Practitioner certifications I’d recommend:   

• AWS Certified Solutions Architect - Professional

• AWS Certified Advanced Networking - Specialty

• AWS Certified Security - Specialty

Being both an expert in Azure and AWS can be difficult, if not impossible, so choose one provider to begin with. 

 

Author bio: Mateusz Gierblinski (mto), Senior Linux System Administrator at IDalko Mateusz Gierblinski is a former NVISO Cloud Security Engineer and consultant. You can connect with him on LinkedIn or find him helping out in the Hack The Box community.