Who this roadmap suits
Learners who already have general security fundamentals and want to specialize, or system administrators and developers moving into security through the cloud angle.
Prerequisite skills
- General security fundamentals (CIA triad, least privilege, defense in depth).
- Basic networking, including how virtual networks and subnets are structured.
- Familiarity with at least one cloud provider's console, even at a beginner level.
Staged learning path
1. Foundations
Understand the shared responsibility model: the provider secures the underlying infrastructure, while you are responsible for configuring identity, network, and data controls correctly.
2. Core skills
- Identity and Access Management (IAM): roles, policies, and the principle of least privilege in a cloud context.
- Network security groups and segmentation within virtual networks.
- Data protection: encryption at rest and in transit, and secure storage configuration.
- Logging and monitoring services native to your chosen provider.
3. Tools
- Cloud-native logging and monitoring dashboards.
- Cloud security posture management concepts -- continuously checking configuration against best practice.
- Infrastructure-as-code tools, since most cloud environments are defined and reviewed as code.
4. Practice
Most major providers offer a free tier. Build a small environment, intentionally misconfigure a storage bucket or security group, then find and fix it using the provider's own tools.
5. Portfolio
Document a cloud misconfiguration you found and fixed in a lab environment, including screenshots of before/after settings (with account details redacted).
6. Interview readiness
Be ready to explain the shared responsibility model in your own words and walk through how you would review a cloud environment's access policies.
Key concepts to master
- Shared responsibility model.
- Least-privilege IAM policy design.
- Common cloud misconfiguration categories: public storage, overly broad permissions, exposed management ports.
- Multi-account or multi-subscription strategies for isolating environments.
Hands-on labs to attempt
- Build a small free-tier cloud environment and configure IAM roles from scratch.
- Enable and review cloud-native logging for a test resource.
- Try our Cloud Security Monitoring project idea in Projects & Labs for a structured build.
Certifications worth considering
Cloud providers offer their own security-focused certifications, alongside vendor-neutral options covering cloud security concepts broadly. Choose based on which provider your target roles or region use most.
How to know you are ready to apply
- You can explain the shared responsibility model clearly and give a concrete example.
- You have hands-on experience configuring IAM and reviewing logs in at least one provider.
- You can describe a misconfiguration you found and remediated in your own lab.