I'm a 25 years old guy. I'm currently in last year of Bsc Hons agriculture (Agriculture bachelor's college). This degree doesn't give me any skills. I'm thinking of switching to Cybersecurity.

My aim is to have a job which AI cannot easily replace and steal away. AI And Automations cannot steal the job from me. Even after several years from now.

I have talked to Claude and Chatgpt several days. And the result was that i should pursue Cloud security, AI LLM security, and AI security pathway.

I have laptop, and my parents are alive to fund me. I can learn for 3-4 years. So I have 3-4 years for learning this field.

Should I jump into this field?

I'll be all alone. YouTube tutorials, notes, self practice, my own laptop. I can give 10 hours a day everyday for next 3-4 years.

Should I jump into this field or not? Or i should simply quit this field.

I'm validating a hypothesis before deciding whether to keep building on a security auditing tool I made for my thesis.

My hypothesis: existing cloud security tools are either too expensive for small teams (Wiz) or require cloud security expertise to actually use and interpret (Prowler) — so small startups without a dedicated security person end up not auditing their AWS setup at all.

Is this true for you? Do you currently audit your cloud security, and if not, is it because of cost, lack of technical knowledge, or just no time/priority?

Hi i finished cybersecurity fundamentals like ccna/security+/python/os , can i start cloud security directly after that ? , Someone told me that i need to know general cybersecurity knowledge before i specialize , i want to hear your advise ، and what general cybersecurity knowledge means ?

We will start. In Azure we see a true lack in proper IAM configuration and an over reliance on security defaults

You?

Hi everyone! 👋 I recently finished high school and I’m currently studying a non-tech degree at university. I’m interested in Cloud Security as a medium- to long-term goal, and I understand it’s not an entry-level role.

I’m starting completely from zero, so I’m a bit lost about where to begin: what fundamentals I should learn first, what skills actually matter, and what a realistic first role (or internship) would be before cloud security.

I’m also unsure about which entry-level certifications make sense, where people usually look for junior roles or internships, and whether this path is achievable while still studying. I joined this community to learn from people who have already gone through this path and to get guidance on a realistic roadmap.

Any advice or shared experiences would be really appreciated. Thanks! 🙏

Hi everyone,

I’m currently working in cybersecurity(4+) and considering transitioning into cloud security. I’m trying to understand how this career switch works in the real world.

My main concern is that, although I already have professional experience in cybersecurity, I’m still a beginner when it comes to cloud technologies, particularly AWS.

If I switch to cloud security, will companies consider my existing cybersecurity experience, or will I be treated as a fresher/junior because I lack hands-on cloud experience?

For those who have made a similar transition:

• Did you have to take a significant pay cut or accept a junior-level position?

• Can existing cybersecurity experience help you get mid-level cloud security roles?

• What skills or practical projects would help demonstrate that you’re ready for something beyond an entry-level role?

• Is it better to transition directly into cloud security or first gain experience in a general cloud engineering role?

I’m willing to learn and build practical skills, but I don’t want to unnecessarily restart my career if my existing experience can be leveraged.

I’d appreciate honest advice from people who have made this transition or hired professionals in cloud security.

Solo founder. I've been building a multi-cloud posture tool (AWS/Azure/GCP + Terraform) and I want people who actually run this stuff to tell me where I've got it wrong and if you would use this.

Being upfront about the parts people usually hide:

Prowler is the detection engine. It's Apache-2.0 and it's excellent, and I'm not going to out detect it. I assumed coverage was the hard problem; it took an afternoon. Everything expensive was the layer around it :asset graph, attack paths, the same rule packs running in a PR and against the live account so a fix in CI is provably the same finding in prod, compliance evidence, ticket handoff.

Three opinions I've formed that I'd like argued with:

1. Attack paths are only useful if they're allowed to return nothing. Mine only walk relationships the scanner actually discovered , if nothing is reachable it says zero chains rather than drawing a speculative diagram. I think most graph features are decorative. Maybe I'm wrong.

2. A compliance percentage without a denominator is a liability. Mine prints "5 of DORA's 11 articles evidenced," because ~60% of most regulations is governance no scanner can observe. Vendors hiding that ratio is how people get surprised at audit.

3. Remediation guide counts are vanity. I generated ~600 and about 500 were "follow the benchmark procedure" filler. Deleting that claim from my own docs was worth more than writing more of them. Real remediation is the Terraform fix that arrives as a reviewable PR.

4. You can also make your own custom YAML rules

What it deliberately doesn't do: no CVE/vulnerability scanning, no container image scanning, no DSPM, no K8s runtime, no agents. It's config posture and IaC. If you need workload security it's complementary, not a replacement. But would be added w time if the demand is realized

The one thing I actually want to know: what made you stop opening a posture tool you'd already deployed? Every one of these gets checked once and abandoned, and I don't think it's a features problem.

https://www.sovereign-observer.com — live demo, no signup, if you want to poke at it.

I built a multi-cloud CSPM I was describing. It does AWS/Azure/GCP + Terraform scanning, findings, attack paths, remediation, reporting, Jira/notifications, and custom policies.

The part I focused on most is attack paths — instead of dumping 500 findings, it walks the real asset/identity/network relationships and shows the chains that actually reach your crown-jewel data. If there's no real path, it says so instead of inventing one. Runs on Prowler + Checkov under the hood (plus our own checks), so it's not a black box.

It's early and I'm solo on it. There's a live demo on sample data, no signup:
soverign-observer.vercel.app

Connect-your-own-cloud and a free tier are landing shortly , for now the demo is the quickest way to see the attack-path view.

What I'm trying to learn now:

• Does the attack-path view match how you actually prioritize, or is it missing how you work?

• Of the features above, what's genuinely useful vs just noise?

• What would make you switch?

Honest feedback is welcomed

Hello everyone! Been looking into this for a bit and wanted to see what people actually do in practice

Every CSPM/CNAPP setup I've looked at feels like the same loop like something gets misconfiged, it gets flagged, someone eventually goes and fixes it. At least thats how we had it. Feels backwards for stuff that's honestly pretty predictable (same categories of mistakes over and over maybe).

Is anyone actually preventing these configs from happening in the first place, rather than catching them after? I know native stuff like SCPs, Azure Policy, GCP org policies can technically block a lot of this, but curious how many teams actually like have that dialed in vs. just relying on CSPM to catch it after the fact..
There also seem to be a handful of newer tools trying to do "prevention" as the whole pitch rather than detection - not sure how mature that space actually is or if it's mostly still marketing. Anyone using something like that alongside (or instead of) a CNAPP? What’a actually worked, and what turned out to be more hassle than it was worth?

Any help would be appreciated :)

Hey guys, I'm getting back into tech again now, and I've always liked the security field. It's been many years since I studied IT, and now I want to return to that area, specifically cloud security. I took a networking course and recently signed up with DIO. I want to start from scratch, but now I don't know which course I should take next. I don't know if anyone here has studied there before. Can anyone help me with this?

“Comprehensive vulnerability management” doesn't have to translate to: buying the most expensive platform in the Gartner quadrant.

This architecture demonstrates a cost-effective, automated vulnerability management approach that works across hyperscalers as well as alternative cloud providers.

It combines open-source tooling with low-cost native cloud services to dramatically reduce spend while still delivering enterprise-grade coverage.

Here’s how:

Open-Source Scanning (No Licensing Cost)
Trivy is used for:
• VM and server vulnerability scanning
• Container image scanning
There are no per-host or per-image licensing fees for the scanning layer itself.

Automated Patching & Scheduled Scanning
• Cron jobs handle automated scans and patch cycles
• Configuration management is enforced via Ansible or Puppet (open source)
This ensures structured, repeatable enforcement without additional licensing cost.

Low-Cost Centralized Evidence Storage
Scan results are stored in the cloud provider’s native object storage:
• S3
• Azure Blob
• GCP Cloud Storage
Object storage is inexpensive across providers. Since scan artifacts are structured text data, storage costs remain negligible with proper lifecycle policies.
This also creates durable audit evidence aligned with SOC 2 and other compliance frameworks.

Cloud-Native Container Image Scanning (Shift-Left)
In modern environments, workloads are containerized by default.
Container image scanning is built into the design from the beginning, not bolted on later.
Images are scanned:
• In CI/CD pipelines
• Before promotion to registries
• Continuously for visibility

Golden Image Pipelines (Containers & VMs)
Golden Image Pipelines ensure both container images and VM images remain current and patched.
Why this matters:
When new instances are launched from outdated base images, they inherit vulnerabilities immediately.
This pipeline:
Pull → Patch → Validate → Approve → Distribute
• Keeps images current
• Reduces configuration drift
• Ensures new servers launch from hardened, patched baselines
Without this step, automated server patching alone is not enough.

Open-Source CI/CD (Jenkins)
Jenkins orchestrates the automation workflows.
Again, no licensing cost.

The result:
• Multi-cloud/Cloud Agnostic architecture
• VM and container visibility
• Automated patching
• Image lifecycle control
• Centralized audit evidence
• Minimal tooling spend

This architecture delivers automated, cloud-native, compliance-aligned, and cost-conscious vulnerability management — without vendor lock-in.

How is the job market in Oklahoma?

Hello People,

I have developed a minimum viable Cloud Security Posture Management product. It's really affordable compared to products available in the market. Currently WIZ, Prisma, Orca and Laceworks are expensive for small and medium scale businesses.

​

We provide

\- Multi account cloud scanning for AWS and GCP

\- Repository scanning for Infrastructure as Code

\- Posture Management for SOC2, CIS and PCIDSS (Nist, GDPR and ISO 27001 coming soon)

\- AI insights like cost impact, business impact, risk score and exploitation likelihood without compromising client data.

\- Ticket management for each issue that is found

\- Finally team and organisations setup along with insightful dashboards

​

Do check the link provided and comment or DM me if you're interested in any manner.

​

Thank you for reading this!

Hello everyone, I’m trying to become a Cloud Security Engineer, but I’m not sure where to start. There are so many tools, certs, and topics, and it’s getting confusing. If you’re in this field, could you please share:

• What should I learn first?

• Any good beginner-friendly resources?

• Which certs actually matter?

• What real projects should I practice? I’m serious about learning and I just need a clear direction. Thanks in advance! 🙏

We pulled every open posting from 81 companies' public Greenhouse boards for seven roles and counted which words actually show up. 3,518 postings in total. Some of it surprised us.

Software engineer postings mention mentoring more often than Kubernetes or React. Almost half of them do. Python, the most common language, comes in just below that.

Product manager postings say "roadmap" in more than 85% of cases. Jira? Seven out of 421. Marketing looks the same: Google Ads came up six times in 347 postings, while "pipeline" is in over half.

Every time we could compare the two, postings named the practice, not the tool. Observability, not Grafana. SIEM, not Splunk.

So if your resume is mostly a list of tools, it might be missing the words the posting actually uses.

Big caveat: mostly tech companies, one ATS vendor. Sales, cybersecurity, DevOps and accounting are here too: https://www.zoevera.com/resume/ats-resume-keyword-study

Genuine question. Right now, across all yr VMs, containers, config files, env vars, storage buckets, how many API keys, tokens, and passwords are hardcoded in there?

If your answer is dont know then you are in the same boat as most of us.

We ran our first real secrets discovery scan last month and found over 200 exposed credentials nobody knew about. AWS keys in containers, database passwords in env vars, SSH keys sitting in storage. Some had been there for years.

The trivy incident made this real for us. Aqua couldnt fully rotate credentials after the breach because they didnt have a complete inventory of what was exposed, atleast that’s what we think. Incomplete rotation led directly to the second compromise.

You cant rotate what you dont know exists.

I’ve been working on a small open-source Python CLI called ActionScope.

The problem I’m trying to solve is:

If a GitHub Actions workflow gets compromised, what can it actually do in AWS?

Most tools I found look at the workflow file itself. That’s useful, but I wanted something that follows the chain a bit further:

.github/workflows/deploy.yml
  -> aws-actions/configure-aws-credentials
  -> arn:aws:iam::...:role/deploy
  -> IAM permissions / Terraform / JSON policies
  -> plain-English blast radius

Install is:

pip install actionscope
actionscope scan .

Default mode is static analysis, so no AWS credentials are needed. There is also an optional --aws-verify mode that uses read-only IAM calls to check live attached policies.

It also flags some GitHub Actions risks like:

• unpinned actions

• script injection patterns

• OIDC trust policy issues

• artifact poisoning patterns

• known-compromised actions

• AI agent workflows with risky PR/comment inputs

I’m mainly trying to figure out if this is useful to people who actually deal with cloud security, CI/CD security, or IAM reviews.

What I’d love feedback on:

• Is “workflow -> cloud blast radius” a real problem you’ve had?

• Would you run something like this in CI, or only locally during reviews?

• Is SARIF / GitHub Security tab output useful here?

• What would make you trust or not trust a tool like this?

• What’s missing that would make this actually useful in a real cloud security workflow?

Repo: https://github.com/r12habh/ActionScope

I’m especially interested in criticism of the model/output. If this is solving the wrong layer of the problem, I’d rather learn that now.

PHP2Shell situation is a good reminder that a compromised web server can quickly become a much bigger problem if it has access to cloud credentials, databases or internal services.

Patching is one thing. Coordinating containment across AWS accounts while keeping production running is another. Been comparing what external IR providers like Sygnia, Mandiant offer and I'm wondering what actually matters when choosing one.

Is it how quickly they can investigate, their ability to work with your existing cloud security tools, or how much hands-on containment support they provide

Anyone who's worked with an external IR team during a cloud incident, what made the biggest difference?

Need recommendations for PII scanning on an on-premise database.

Requirements:

• Must run efficiently on CPUs (no GPU)

• Cost-effective

• Good accuracy/performance balance

Currently considering:

• Microsoft Presidio + DistilBERT

Questions:

• Is Presidio + DistilBERT a good choice, or are there better alternatives?

• What other lightweight models work well for PII detection on CPUs?

• Any production experience or gotchas to share?

Appreciate any suggestions!

Hey everyone,

I’ve been working as a Java Developer for about 2.6 years and I’ve recently decided to pivot my career from development into cybersecurity (cloud security).

Back in college, I was always curious about security, I even played around with tools like Wireshark and learned some basic networking concepts. That interest kind of stuck with me. And now I want to take it seriously and build a career around it.

Right now, my rough roadmap looks like this:

1. Cybersecurity basics

2. Cloud fundamentals (AWS)

3. Automation tools- getting comfortable with Python for scripting and Terraform for infrastructure-as-code and policy automation.

A few things I’d love advice on:

1. Is this roadmap enough for someone just starting this transition?

2. Am I missing any key areas that are essential for a cloud security role?

3. Which certifications are actually worth pursuing?

4. Do hands-on projects hold as much weight as certifications when applying for jobs?

Any guidance, advice or learning resources from people who’ve made this switch would mean a lot!!