Skip to main content

Learning path

Cloud Security Engineer learning path: everything to study, topic by topic

Assesses cloud-specific security — IAM hardening, CSPM, container security, and compliance automation in AWS/Azure/GCP.

Short answer

To learn Cloud Security Engineer, work through 6 modules and 24 topics in the order they build on each other. It starts with Cloud IAM & Identity, then moves on to Network & Data Security and Cloud Security Posture. Use the map as a checklist, or measure your level and study only what is missing.

6
modules
24
topics
50
min to assess

What you will study

Topics are grouped by module. Open one to see its objectives and key concepts.

1 · Cloud IAM & Identity4 topics
  • IAM Policies & Least Privilege

    Designing and managing cloud IAM policies that enforce least privilege, including policy evaluation logic, permission boundaries, and access reviews across AWS/Azure/GCP

    Objectives

    • Design an IAM policy that grants minimum required permissions for a given workload
    • Use IAM Access Analyzer to identify overly permissive policies

    Key concepts

    • IAM policy types
    • least privilege principle
    • permission boundaries
    • policy evaluation logic
    • access analyzer
    • service-linked roles
    • condition keys
  • Cross-Account Access

    Configuring secure cross-account access patterns using assume-role chains, resource-based policies, and AWS Organizations or Azure Lighthouse for multi-account environments

    Objectives

    • Design a cross-account access pattern that prevents the confused deputy problem
    • Implement centralized logging using cross-account role assumptions

    Key concepts

    • cross-account assume role
    • external ID
    • resource-based policies
    • AWS Organizations
    • Azure Lighthouse
    • trust relationships
    • confused deputy problem
  • Service Control Policies (SCPs)

    Implementing organizational guardrails using SCPs, Azure Policy, or GCP Organization Policies to enforce security invariants across all accounts and projects

    Objectives

    • Design an SCP strategy that prevents region sprawl without blocking legitimate workloads
    • Implement guardrails that block dangerous API calls while allowing break-glass access

    Key concepts

    • SCP inheritance
    • deny-list vs allow-list strategy
    • organizational units
    • Azure Policy
    • GCP org policies
    • guardrail patterns
    • SCP evaluation order
  • Federated Identity (SSO/SAML)

    Implementing federated identity with SAML 2.0, OIDC, and SSO for cloud console and CLI access, including session management and attribute-based access control

    Objectives

    • Design an SSO architecture that maps corporate groups to cloud roles with ABAC
    • Implement just-in-time privileged access using federated identity assertions

    Key concepts

    • SAML 2.0
    • OIDC
    • AWS IAM Identity Center
    • Azure AD / Entra ID
    • GCP Workforce Identity
    • ABAC
    • session tags
    • just-in-time access
2 · Network & Data Security4 topics
  • Security Groups & NACLs

    Configuring stateful and stateless network controls using security groups and NACLs, including default-deny patterns, reference-based rules, and troubleshooting connectivity

    Objectives

    • Design a security group architecture that isolates web, app, and database tiers
    • Troubleshoot network connectivity issues caused by conflicting SG and NACL rules

    Key concepts

    • security groups
    • NACLs
    • stateful vs stateless
    • default deny
    • inbound/outbound rules
    • CIDR ranges
    • security group chaining
  • Encryption at Rest & Transit

    Implementing encryption for data at rest (KMS, HSM, server-side/client-side) and data in transit (TLS, certificate management, mutual TLS) across cloud services

    Objectives

    • Design a KMS key hierarchy with automatic rotation for a multi-service application
    • Implement end-to-end encryption for data flowing between microservices

    Key concepts

    • KMS key management
    • envelope encryption
    • HSM
    • server-side encryption
    • client-side encryption
    • TLS termination
    • certificate rotation
    • mutual TLS
  • VPC Security Architecture

    Designing secure VPC architectures with proper segmentation, private subnets, NAT gateways, VPC endpoints, and flow log analysis for compliance and threat detection

    Objectives

    • Design a hub-and-spoke VPC architecture with centralized inspection
    • Analyze VPC flow logs to detect unauthorized lateral movement

    Key concepts

    • VPC design
    • subnet segmentation
    • NAT gateways
    • VPC endpoints
    • flow logs
    • transit gateway
    • private link
    • network firewall
  • WAF & DDoS Protection

    Implementing web application firewalls and DDoS protection using AWS WAF/Shield, Azure Front Door/DDoS Protection, or GCP Cloud Armor with custom rule sets and rate limiting

    Objectives

    • Design a WAF rule set that protects against OWASP Top 10 without blocking legitimate traffic
    • Implement a DDoS response runbook with automated scaling and WAF rule updates

    Key concepts

    • AWS WAF rules
    • rate-based rules
    • managed rule groups
    • AWS Shield Advanced
    • Azure Front Door WAF
    • GCP Cloud Armor
    • bot mitigation
    • geo-blocking
3 · Cloud Security Posture4 topics
  • Security Hub / Defender / SCC

    Operating cloud-native CSPM tools — AWS Security Hub, Azure Defender for Cloud, or GCP Security Command Center — for centralized finding aggregation and posture scoring

    Objectives

    • Configure Security Hub with cross-account aggregation and automated finding triage
    • Build custom insights that prioritize findings by business impact

    Key concepts

    • AWS Security Hub
    • Azure Defender for Cloud
    • GCP Security Command Center
    • security score
    • finding aggregation
    • ASFF format
    • custom insights
    • integration partners
  • Misconfiguration Detection

    Detecting and preventing cloud misconfigurations using tools like AWS Config, Prowler, ScoutSuite, Checkov, and tfsec across infrastructure-as-code and running resources

    Objectives

    • Implement a multi-layer misconfiguration detection pipeline from IaC to runtime
    • Design Config rules that detect S3 public access and auto-remediate

    Key concepts

    • AWS Config rules
    • Prowler
    • ScoutSuite
    • Checkov
    • tfsec
    • drift detection
    • preventive vs detective controls
    • shift-left security
  • CIS Benchmark Compliance

    Implementing and measuring CIS Benchmark compliance for AWS, Azure, and GCP foundations, including automated scanning, exception management, and evidence collection

    Objectives

    • Implement automated CIS Benchmark scanning with exception tracking and reporting
    • Design a compliance dashboard that tracks CIS adherence across multiple cloud accounts

    Key concepts

    • CIS Benchmarks
    • AWS Foundations Benchmark
    • Azure CIS Benchmark
    • GCP CIS Benchmark
    • automated compliance scanning
    • exception management
    • evidence collection
    • continuous compliance
  • Automated Remediation

    Building automated remediation pipelines using Lambda, Azure Functions, Cloud Functions, EventBridge, or Step Functions to fix security findings without human intervention

    Objectives

    • Design an automated remediation pipeline with blast-radius controls and rollback
    • Implement event-driven remediation for critical Security Hub findings

    Key concepts

    • event-driven remediation
    • Lambda remediation
    • Step Functions workflows
    • guardrail automation
    • safe remediation patterns
    • rollback mechanisms
    • remediation SLAs
    • blast radius control
4 · Container & Workload Security4 topics
  • Image Scanning & Hardening

    Implementing container image scanning in CI/CD pipelines using Trivy, Snyk, ECR scanning, or Aqua, plus hardening base images with minimal attack surfaces

    Objectives

    • Build a CI/CD pipeline gate that blocks container images with critical CVEs
    • Design a base image hardening strategy using distroless and multi-stage builds

    Key concepts

    • Trivy
    • Snyk Container
    • ECR image scanning
    • distroless images
    • multi-stage builds
    • CVE severity
    • image signing
    • admission controllers
  • Runtime Security (Falco/Sysdig)

    Monitoring container workloads at runtime using Falco, Sysdig, or cloud-native tools to detect anomalous system calls, file access, and network behavior

    Objectives

    • Write Falco rules that detect cryptocurrency mining in container workloads
    • Design a runtime security monitoring strategy for a production Kubernetes cluster

    Key concepts

    • Falco rules
    • Sysdig Secure
    • system call monitoring
    • file integrity monitoring
    • network policy enforcement
    • anomaly detection
    • eBPF
    • runtime profiling
  • Kubernetes Security (RBAC/PSP/OPA)

    Securing Kubernetes clusters using RBAC, Pod Security Standards, OPA/Gatekeeper, network policies, and secrets management for multi-tenant environments

    Objectives

    • Design a multi-tenant Kubernetes RBAC strategy with namespace isolation
    • Implement OPA Gatekeeper policies that enforce Pod Security Standards

    Key concepts

    • Kubernetes RBAC
    • Pod Security Standards
    • OPA Gatekeeper
    • network policies
    • secrets management
    • service mesh mTLS
    • audit logging
    • namespace isolation
  • Supply Chain Security (SBOM)

    Implementing software supply chain security using SBOMs, image signing (Cosign/Notary), provenance attestation (SLSA), and dependency tracking for container workloads

    Objectives

    • Design an end-to-end supply chain security pipeline with SBOM and attestation
    • Implement binary authorization that only allows signed images in production

    Key concepts

    • SBOM generation
    • Cosign signing
    • Notary v2
    • SLSA framework
    • provenance attestation
    • dependency tracking
    • vulnerability feeds
    • binary authorization
5 · Detection & Response4 topics
  • CloudTrail / Activity Log Analysis

    Analyzing cloud audit trails (CloudTrail, Azure Activity Log, GCP Audit Log) to detect unauthorized access, policy violations, and suspicious API call patterns

    Objectives

    • Write Athena queries to detect unauthorized IAM key usage across accounts
    • Design a centralized audit log architecture for a multi-account environment

    Key concepts

    • CloudTrail events
    • management vs data events
    • Azure Activity Log
    • GCP Audit Log
    • Athena queries
    • log centralization
    • event correlation
    • anomalous API calls
  • Threat Detection (GuardDuty/Sentinel)

    Operating cloud-native threat detection services — GuardDuty, Microsoft Sentinel, or GCP Chronicle — for identifying compromised instances, crypto mining, and data exfiltration

    Objectives

    • Configure GuardDuty across an Organization with automated finding routing
    • Design alert triage workflows that reduce false-positive fatigue

    Key concepts

    • GuardDuty finding types
    • Microsoft Sentinel
    • GCP Chronicle
    • threat intelligence feeds
    • suppression rules
    • multi-account enablement
    • custom threat detection
    • finding severity
  • Cloud Forensics

    Conducting forensic investigations in cloud environments — evidence preservation, disk/memory acquisition, timeline reconstruction, and chain of custody in ephemeral infrastructure

    Objectives

    • Execute a forensic investigation of a compromised EC2 instance preserving chain of custody
    • Reconstruct an attack timeline using CloudTrail, VPC Flow Logs, and system artifacts

    Key concepts

    • evidence preservation
    • EBS snapshot forensics
    • memory acquisition
    • timeline reconstruction
    • chain of custody
    • volatile evidence
    • forensic workstation
    • legal hold
  • Automated Incident Response

    Building automated incident response playbooks using Step Functions, Logic Apps, or SOAR platforms to contain threats, isolate resources, and notify stakeholders

    Objectives

    • Design an automated incident response playbook that isolates compromised instances within minutes
    • Build a Step Functions workflow that orchestrates containment, evidence collection, and notification

    Key concepts

    • SOAR integration
    • automated containment
    • instance isolation
    • credential revocation
    • Step Functions playbooks
    • PagerDuty/OpsGenie integration
    • runbook automation
    • escalation workflows
6 · Governance & Compliance4 topics
  • Compliance as Code

    Implementing compliance requirements as programmatic policies using OPA, Sentinel, AWS Config, or custom frameworks that integrate into CI/CD pipelines

    Objectives

    • Write OPA policies that enforce encryption and tagging standards in Terraform plans
    • Design a compliance-as-code pipeline that validates infrastructure before deployment

    Key concepts

    • policy as code
    • OPA Rego
    • HashiCorp Sentinel
    • AWS Config custom rules
    • CI/CD policy gates
    • compliance drift
    • evidence automation
    • continuous compliance
  • SOC 2 / HIPAA / PCI-DSS Automation

    Automating evidence collection and control mapping for SOC 2 Type II, HIPAA, and PCI-DSS compliance using cloud-native tools and GRC platforms

    Objectives

    • Map AWS services and configurations to SOC 2 Trust Service Criteria
    • Design automated evidence collection that satisfies auditor requirements for HIPAA

    Key concepts

    • SOC 2 Type II controls
    • HIPAA safeguards
    • PCI-DSS requirements
    • control mapping
    • evidence collection
    • audit trail
    • GRC platforms
    • continuous monitoring
  • Multi-Account Security Governance

    Designing and operating multi-account security governance using AWS Organizations, Azure Management Groups, or GCP Resource Hierarchy with centralized policy enforcement

    Objectives

    • Design a multi-account landing zone with security baselines and automated account vending
    • Implement centralized security governance across 100+ accounts with delegated administration

    Key concepts

    • AWS Organizations
    • Azure Management Groups
    • GCP Resource Hierarchy
    • account vending
    • centralized logging
    • security baseline
    • delegated administrator
    • guardrail inheritance
  • Cloud Security Architecture Patterns

    Designing reference security architectures for cloud workloads including zero trust, defense in depth, shared services, and security control planes for enterprise deployments

    Objectives

    • Design a zero trust reference architecture for a multi-cloud enterprise deployment
    • Create a security architecture decision record for migrating from perimeter to zero trust

    Key concepts

    • zero trust architecture
    • defense in depth
    • security control plane
    • shared security services
    • reference architectures
    • threat modeling for cloud
    • security decision records
    • multi-cloud security strategy

Levels: Junior, Mid, Senior, and Expert

Explain it in your own words

Graded by AI · no account · 1 question

No options to guess from: you write, the AI grades against the topic's rubric and tells you what level your answer reads at.

0 / 600

Already studying Cloud Security Engineer?

The assessment measures topic by topic, and your plan skips what you already know.

Measure my level

Open to read. An account is only needed to be measured.

Frequently asked questions

Where should I start studying Cloud Security Engineer?

Start with Cloud IAM & Identity: IAM Policies & Least Privilege, Cross-Account Access, and Service Control Policies (SCPs). The map orders topics by what they depend on, so each one prepares the next.

How long does a full Cloud Security Engineer assessment take?

A full assessment of this path takes about 50 minutes. Study time depends on where you start; a diagnostic shows which topics you can skip.

Do I need an account to use this page?

No. The map, objectives and key concepts are open. You only need an account to be measured, get your gap by topic and receive a plan.