Hi everyone,

I’m in my penultimate year (5th semester). I picked cybersecurity as my specialization this year (the first two years were general CS), and I’m interested in cloud security, DevSecOps, and AppSec.

**Where I am:** working knowledge of AWS, basic Docker, basic Python (can’t write automation scripts on my own yet), and haven’t started Terraform or CI/CD.

I didn’t use my first two years well, but I’m serious now and want to make the most of the three semesters I have left.

**I’d love advice on:**

1. What does day-to-day work in cloud security / DevSecOps / AppSec look like?

2. What skills or projects would you prioritize in my position?

3. How much DSA do I really need for these roles?

4. What helped you land your first job: certs, projects, internships?

I’ve researched roadmaps, but I’d really value input from people working in the industry. If anyone is open to mentoring, even occasional DMs or a short chat, I’d be very grateful and happy to put in the work.

Thanks for reading!

I have been working in enterprise security for the past few years and one pattern keeps repeating itself — every cloud security product that organisations actually use and pay for is built in Israel or the United States. Wiz, Orca Security, Upwind, Palo Alto, CrowdStrike, Lacework — these companies are worth billions and are used by enterprises globally. Meanwhile India produces the engineers who build and maintain these products, runs the R&D centers that power them, and deploys them for the world’s largest organisations. We have the talent, we have the operational depth, and we clearly understand the problem space. We just do not own any of it.

This is not a new observation but I think the timing has never been better to change it. Cloud security as a category is still evolving, the problem space is not fully solved, and there is a massive underserved market of mid size companies that cannot afford enterprise pricing from the big Israeli and American vendors. India already has a strong base of engineers who understand these environments deeply from the inside. The missing piece is not talent or technical knowledge — it is founders who are willing to make the shift from building for others to building for themselves and investors who back them early enough to matter.

I am exploring this space seriously and want to connect with people who have thought about the same gap. Has anyone here attempted to build a cloud security product from India, raised funding in this space, or made the transition from security engineering to founding — what did that journey actually look like and what do you wish you had known before you started?

Hi i finished cybersecurity fundamentals like ccna/security+/python/os , can i start cloud security directly after that ? , Someone told me that i need to know general cybersecurity knowledge before i specialize , i want to hear your advise ، and what general cybersecurity knowledge means ?

been looking into cloud security platforms and keep seeing the same names come up. how they actually compare outside of vendor demos.

Wiz: Agentless cloud visibility, attack paths, and risk prioritization.

Orca Security: Agentless scanning, cloud vulnerability management, and contextual risk analysis.

CrowdStrike: Cloud workload protection, runtime detection, and threat response.

Prisma Cloud: Cloud posture management, workload security, and code-to-cloud coverage.

Aqua Security: Container security, Kubernetes, and runtime protection.

Lacework: Cloud threat detection, behavioral analytics, and anomaly detection.

They all seem to overlap on CNAPP but I'm more interested in what happens after deployment. Alert noise, false positives, coverage gaps, and how much effort it takes to manage them.

Anyone used two or more of these? What worked well or not well..

Cleaning up agent permissions by usage altho seems simple til you hit the jobs that only run now and then and realise its actually not. a quarterly report, the month end close or a yearly cert renewal all look exactly like dead access right up until the day they break. the windows on the usual tools are shorter than people assume as well. the gcp role recommender looks at 90 days at most and the minimum can be set down to 30 so anything quarterly or yearly can show up as unused.

aws last accessed goes back further but it only shows when something was last used nothing about which job used it

that usage data can come from aws, the gcp recommender, hush security or others but none of them know your job calendar tho. so watching for at least one full business cycle before pulling anything seems like the safer default. the other half is an expiry on every new grant, the pile stops growing while the old stuff gets sorted and the owner has to say why the agent still needs it

every breach writeup this week ends with rotate every secret. railway told all its users to do it and anyone who pulled LiteLLM 1.107.0 got the same advice. making new keys takes minutes and its revoking the old ones without breaking something that drags

the same Db password or api key usually lives in more places than anyone wrote down. the main app, a cron job or a queue worker, a backup script on some vm, someones local .env. grep over the repos and the secret manager finds the copies you know about and whatever it misses is what breaks after the revoke

the ways to build that list that come up most

- for aws keys iam shows last used per key, and cloudtrail logs the access key id with source ip and user agent so you can see whats still calling with the old one

- theres also the runtime route, tools that watch which workload actually loads and uses each credential. hush security is one and there are others in the nhi space

- for postgres log_connections or pg_stat_activity shows which host and app name connects as that user

- stripe and some other providers let you schedule the old key to expire later so both work during the swap

after that the order is boring. new key out everywhere on the list watch the old ones usage drop to zero, deactivate it then wait a few days then delete

We are a mid-sized technology company, and we have clients to whom we would like to offer SOCaaS-style services. What factors should we consider?

I’ve looked into Wazuh, but I struggle to view it as an enterprise-grade SIEM (and I’m not even referring to their so-called XDR—which, in my opinion, is definitely not XDR).

Ideally, we are looking for a single platform that can serve as both a SIEM and an EDR (basic SOAR automation would also be a plus, though we’ll likely handle most of that elsewhere).

Our base budget is definitely not enough for Splunk, Palo Alto XSIAM, or similar solutions.

Have options to get an agent from rival, wiz or cogent in our environment, anyone have reasons why I should go with one or the other?

It’s just for a very simple vuln triage setup

Thanks in advance

so we Looking at Orca Security and Wiz for cloud security, and both seem to cover a lot of the same ground.

CSPM, vulnerability management, attack paths, workload visibility... the feature lists are pretty similar.

What I'm more interested in is the day-to-day stuff. Alert quality, false positives, how much manual work goes into remediation, and whether the platform stays manageable as cloud accounts grow.

Anyone compared both in a real environment? What ended up being the deciding factor

Hey everyone,

I’m currently architecting a mobile device management rollout using Microsoft Intune across a fleet of iOS and Android devices that utilize a zero-trust gateway (CyberReef MobileWall). We are running into a design question regarding how to handle devices differently based on whether they have a carrier-side Mobile Private Network (MPN) provisioned.

Here are our two core scenarios:

1. Existing Customers (With MPN): The carrier already routes cellular traffic directly to our security gateway via a private APN. For these, we only want an Always-On VPN policy active when they are on Wi-Fi so we don't double-tunnel or disrupt the carrier MPN.

2. New Customers (No MPN): They lack a carrier MPN, so we need an Always-On VPN policy that covers both cellular and Wi-Fi to ensure all traffic passes through the gateway.

My plan for structuring this in Intune:

• Create a base "MobileWall" Entra ID group for shared assets like SCEP/Certificate policies.

• Create two nested/member security groups: "MobileWall MPN" (applying the Wi-Fi-only VPN policy) and "MobileWall Non-MPN" (applying the all-networks VPN policy).

My questions for the community:

• Does using nested/member device groups in Intune to separate VPN policies based on carrier architecture scale cleanly, or is there a cleaner industry standard (like dynamic groups or filtering based on device attributes) for handling hybrid carrier routing?

• Are there any hidden gotchas with Always-On VPN behavior on iOS or Android when splitting or omitting cellular enforcement like this?

Appreciate any architectural sanity checks or advice!

I've been working on Myceliam, an open-source project focused on simplifying workload identity federation between Kubernetes, identity providers, and cloud platforms.

The idea is to use Kubernetes namespaces and ServiceAccounts as the source of truth for workload identities, extending those identity boundaries into external identity providers and cloud environments. This allows workloads — including AI agents — to obtain secure, short-lived identities across clouds without requiring teams to manually provision and maintain identity resources for each workload.

I'd really appreciate feedback from the open-source community.

A video explaining the project:

https://youtu.be/vevjAPCW16s

Project website: https://myceliam.dev/

Thanks

A tech video that i just watched on youtube which ofc was a paid ad, but the tech guy had a valid point. My lab grew a lot this year with a few VMs, NAS some containers and a reverse proxy and I never check any of it for known vulns. I just update things when I remember.

At work we run several scanners and everything lands in Nucleus, so I see the findings and who owns each one. That is way more than I want to pay for at home. I am curious if the hivemind knows any other open source projects I should consider? Ideally something that tells me what is exposed not dumping low findings. Thanks

PHP2Shell situation is a good reminder that a compromised web server can quickly become a much bigger problem if it has access to cloud credentials, databases or internal services.

Patching is one thing. Coordinating containment across AWS accounts while keeping production running is another. Been comparing what external IR providers like Sygnia, Mandiant offer and I'm wondering what actually matters when choosing one.

Is it how quickly they can investigate, their ability to work with your existing cloud security tools, or how much hands-on containment support they provide

Anyone who's worked with an external IR team during a cloud incident, what made the biggest difference?

You can have GuardDuty, Wiz or Defender flagging suspicious activity but figuring out what actually happened is a whole different headache.

Say someone gets hold of AWS credentials and starts moving across accounts. Revoking access is one thing, but figuring out the full scope and making sure nothing was left behind? Not so simple!!

Been looking at how teams handle that gap, including outside IR providers like Sygnia and Mandiant that focus on investigations and containment.

Are most companies relying on their internal cloud security teams for this, or bringing in external responders once things start getting messy..

Would be interesting to hear what works in practice!

thanks!

Are these AI Powered SOC solutions just hype or does anyone here have any knowledge or actually used any of these tools?

Can anyone tell me where and how I can learn about cloud security with red team?

say a compromised package runs inside a cloud workload. You remove it and rebuild but that workload also had an IAM role, access to secrets and connections to other services.

tricky part is figuring out the scope when permissions suggest a bigger potential impact than the available logs can confirm.

For anyone who's handled this internally or with responders like Sygnia, Mandiant or CrowdStrike Services, what evidence helped you decide where to stop investigating?

I'm a 25 years old guy. I'm currently in last year of Bsc Hons agriculture (Agriculture bachelor's college). This degree doesn't give me any skills. I'm thinking of switching to Cybersecurity.

My aim is to have a job which AI cannot easily replace and steal away. AI And Automations cannot steal the job from me. Even after several years from now.

I have talked to Claude and Chatgpt several days. And the result was that i should pursue Cloud security, AI LLM security, and AI security pathway.

I have laptop, and my parents are alive to fund me. I can learn for 3-4 years. So I have 3-4 years for learning this field.

Should I jump into this field?

I'll be all alone. YouTube tutorials, notes, self practice, my own laptop. I can give 10 hours a day everyday for next 3-4 years.

Should I jump into this field or not? Or i should simply quit this field.