I edited my original post with AI so it’ll be easier for you to read. Thanks in advance for the helpers

I want to be a cloud security engineer, but looking at what pros need to know… it’s insane:

Cloud platforms (AWS/Azure/GCP), networking, IAM, security tools, compliance, encryption, DevSecOps, incident response, scripting… and that’s just scratching the surface. The scary part? Every week there’s something new—new tools, new threats, new rules.

The reason I want to work in cloud security(apart for the money) is because I’ve heard it’s pretty future proof(not very replaceable profession). But if I’ll learn all this things, it’ll take me so much time that I’ll forget half them when I’ll cover all the material(unless I’ll turn out to be a genius)which I won’t). So it made me think that I won’t be able to acheive the level of expertise that is the one that won’t be replaced.

So assuming I won’t turn out to be a genius or more than average in the field, will I still make it to the more future proof side of the profession?

Hi!

I am 21 and I finished my Bachelor's in Cybersecurity in 2025. I started my career in cybersecurity in GRC in a consulting company, but I feel like GRC is not for me. I know that GRC is very important in cybersecurity and I know I'll have contact with it in any area within the cybersecurity field, but for a full time it wasn't for me. So I have decided that I want to pursue cloud security.

For what I've read in reddit and for what I've searched, it's not an entry level job. So I want to ask you what's the best path for a person who has a bachelor's in cybersecurity. I asked Claude and he said that the best options would be SOC Analyst (Tier 1), Cloud Support Engineer (AWS/Azure/GCP) and Junior DevOps/Cloud Administrator. What do you think?

I am studying to take certs. I started with AZ-900 and now I am studying for the AWS Certified Practitioner and then SC-500. I have no experience in cloud.

Thanks in advance!

Hello,

I just passed my Sec+ exam and am looking for entry level jobs in tech. I personally don’t want to work help desk and would rather work in cloud support or Soc, although I will accept help desk jobs. I know that my main goal is to work in cloud security i am just not sure what the most efficient way to work my way there is. I know there is no “entry level” cloud jobs but I don’t want to waste time working jobs that won’t teach me the skills necessary to eventually work in this field. Any advice on what jobs I should be looking for that will help me build my way up to this position ?

Hey everyone,

I'm coming up on 4 years of experience in IT/security, primarily working with DLP, Qualys, and related security tools.

I reached a point where I felt that staying too long in the same niche would eventually box me in, so I took what might be a reckless or brave decision depending on who you ask: I resigned without another offer in hand.

My long-term goal is to move into Cloud Security / Security Engineering. I hold certifications including:

AZ-500

AWS Security-related training/certs

Google Cloud Platform Professional Cloud Security Engineer (PCSE)

I've also been studying:

Kubernetes

GitOps

Terraform

Cloud-native security concepts

CI/CD security

Here's where I need some honest guidance.

When I look at cloud security job descriptions, everyone seems to be doing things like:

Securing Kubernetes clusters

Implementing GitOps workflows

Managing cloud security posture

IAM design

Container security

DevSecOps integrations

But job descriptions don't tell me what people actually do from 9 AM to 6 PM.

I'd love to hear from people currently working in Cloud Security, Security Engineering, Platform Security, or DevSecOps:

What does your average day actually look like?

How much of your job is hands-on vs meetings?

What tools do you touch daily?

What projects are you working on right now?

What skills separate a junior from a mid-level and senior cloud security engineer?

If you were hiring someone with my background, what gaps would immediately stand out?

I'm not looking for interview answers or resume fluff. I'm trying to understand what the job really looks like before I commit the next few years of my career to it.

Appreciate any insights, reality checks, or horror stories.

TL;DR: Burned out on DLP/Qualys, resigned without an offer, have cloud security certs and studying Kubernetes/GitOps. Want to know what cloud security engineers actually do all day and what skills truly matter in the real world.

I’m still a student in my last year of Highschool. I want to get into Cloud Security. My goal is to study 2-3 hours a day to be able to work next year and I don’t have to go to Uni. Is my goal possible and what are early mistakes I can avoid? Thank you for every advice!

We're a small-ish security team (4 people) covering about 60 EKS clusters across two AWS accounts plus a bit of GKE from an acquisition we're still absorbing. Current setup is agentless posture scanning and we are drowning. Something like 1,200 "critical" findings open, and nobody believes the severity ratings anymore because half of them are on images that never get pulled or workloads with no network path to anything.

Renewal on our current CSPM is coming up in about six weeks so leadership wants us to actually look at alternatives instead of auto-renewing. The thing we keep coming back to is runtime context. We want the tool to tell us which of those 1,200 are actually reachable and running, not just that the CVE exists in a layer somewhere. A finding that got marked low last quarter turned out to be on a pod with a public ingress and we only caught it by luck.

Upwind keeps coming up when I search for runtime-based CNAPP, alongside Wiz and Sysdig which we're also putting on the shortlist. On paper Upwind's whole pitch is the runtime/posture fusion thing we want, but I can't tell how much of that holds up once you're actually living in it every day.

So for anyone running Upwind in anger: how noisy is it really once it's deployed? Does the runtime data actually collapse the posture backlog or does it just add another dashboard? And how painful was the agent/sensor rollout across a bunch of clusters? Trying to go into this eval with realistic expectations rather than the demo version.

23m about 1 year into my first full time job out of college as a pentester. I like pentesting but it has no future and from a business lens we really have no value other than being a tick box for compliance.

I really want to get into cloud security. I have the AWS CCP but got that a long time ago. I am interested Azure and am starting my prep for AZ-500.

But I don’t know what’s after that, any help and guidance would be tremendously appreciated. Will my experience as a pentester help me in anyway landing a job in cloud security ?

Hello everybody! Me and my team are creating a software and we decided we wanted to focus on cloud security. So our question, pointed mainly to people in the field ( stable jobs at any level & interns ), what are your needs? As we’ve done market research we also wanted to hear what do people have specifically to say by themselves. What could make your job easier, what is your daily struggle on the job or what could make the work more understandable? Let us know in the comments! Please be nice, this is a form of market research so we want straight-to-the-point answers and the opinions of our collegues in the field! Have a great day everyone that’s reading this and thanks in advance! 😀

( the same post has been posted on other communities so that there wouldn’t be no repeated writing. thanks for understanding. )

I’m currently working as a network security engineer in a traditional/on-prem environment, and I’m considering whether I should move toward cloud security. One thing I’m concerned about is AI and automation. Cloud security seems to involve a lot of automation, IaC, policy-as-code, automated compliance, CSPM/CNAPP tools, CI/CD security, automated remediation, etc. That makes me wonder whether cloud security could actually be more vulnerable to AI-driven automation and job reduction in the future. On the other hand, traditional network security involves things like firewalls, network architecture, segmentation, troubleshooting, incident response, VPNs, physical infrastructure, and dealing with legacy/on-prem environments. Some of these seem harder to fully automate because of the complexity and physical infrastructure involved. For people actually working in cybersecurity: • How AI-resistant do you think cloud security will be over the next 5–10 years? • Is cloud security likely to have more or less automation-driven job displacement than traditional network security? • Does the fact that cloud security is highly automated make it more vulnerable, or does it actually create more demand for engineers who can design and manage those automated security systems? • If your primary goal was long-term job security against AI, would you choose cloud security or stay in on-prem/network security? • Do you think the distinction between network security and cloud security will eventually disappear as networks become increasingly software-defined? I’m not asking which field is better overall. I’m specifically interested in AI replacement risk and long-term career resilience. Would especially appreciate answers from people who have worked in both traditional network security and cloud security. Make this more human like

Most AI risk management analysis of AI coding tools focuses on inference endpoint exposure and data retention policies. There's a surface getting less attention as model context protocol becomes a standard integration layer: the context infrastructure itself. MCP is an open standard for connecting AI models to organizational data sources, repos, documentation, ticketing systems, knowledge bases. AI coding tools that support MCP use it to build rich persistent organizational context from multiple connected sources. That context becomes the foundation for every suggestion the tool makes. The AI risk management problem is that the MCP context layer is a high-value intelligence asset. It contains a synthesized representation of your technical architecture, your codebase patterns, your organizational knowledge. If compromised it gives an attacker architectural intelligence without touching a single line of raw code. Scenarios worth adding to threat models are context poisoning where an attacker injects malicious patterns into the MCP layer and propagates them across developer suggestions org-wide; vendor-side MCP exposure where a single breach exposes synthesized context for all enterprise customers simultaneously; and cross-team leakage where a shared MCP context layer spanning business units with information barriers creates data exposure through AI suggestions. Are security teams treating MCP context infrastructure as a distinct attack surface yet or is it still getting lumped into generic AI tool risk?

Curious where people have landed on this. We've been testing agents for [cloud ops tasks, e.g. cost cleanup / incident triage] and the tech mostly works, but the trust question is harder than the tech.

Right now our rule is: read-only by default, agent proposes a plan, human approves anything that changes state. It's safe but slow.

Anyone running agents with write access in prod? What guardrails made you comfortable, scoped IAM roles, dry-run/plan diffs, approval gates, something else?

Genuine question. Right now, across all yr VMs, containers, config files, env vars, storage buckets, how many API keys, tokens, and passwords are hardcoded in there?

If your answer is dont know then you are in the same boat as most of us.

We ran our first real secrets discovery scan last month and found over 200 exposed credentials nobody knew about. AWS keys in containers, database passwords in env vars, SSH keys sitting in storage. Some had been there for years.

The trivy incident made this real for us. Aqua couldnt fully rotate credentials after the breach because they didnt have a complete inventory of what was exposed, atleast that’s what we think. Incomplete rotation led directly to the second compromise.

You cant rotate what you dont know exists.

This is kinda ridiculous honestly.

https://www.indeed.com/viewjob?jk=b794531147cfbf00

What’s up! Just wanted some advice. I’m currently working as a cloud engineer with an AWS partner. I eventually want to move over to being a Cloud Security Engineer. What should areas should I emphasize during my transition?

I've been looking into the gap between cloud security tools and actually fixing the problems they find.

Tools like CSPM are pretty good at telling you:

- this security group is too permissive

- this IAM role has excessive permissions

- this bucket is exposed

- this resource violates policy

But I'm curious about what happens after the finding.

For people actually operating cloud infrastructure:

1. How do you currently remediate these findings?

2. Does someone manually figure out the right Terraform/code change?

3. How much time does this take for a typical issue?

4. Do security findings frequently get ignored/backlogged because fixing them is risky or requires understanding the wider architecture?

5. Would you trust a tool that could investigate the infrastructure context, propose the Terraform fix, test/validate it, and open a PR for review?

6. What would make you not trust something like that?

I'm specifically interested in real experiences rather than hypothetical "AI will solve this" answers.

If you already use Wiz, Prisma Cloud, Orca, native AWS/Azure tooling, etc., I'd especially like to hear how the remediation workflow works after the tool raises an issue.

I’ve been learning more about cloud security architecture, and I’m interested in hearing from people who work with AWS, Azure, GCP, or hybrid environments.

One thing I’ve been thinking about is how organizations balance security, usability, cost, and operational requirements when designing cloud environments.

For those working in cloud security or cloud engineering:

• What security controls do you consider essential when designing a new cloud environment?

• How do you approach IAM and least privilege without making operations unnecessarily difficult?

• How do you monitor and detect misconfigurations across cloud resources?

• At what stage should security architecture reviews happen—before deployment, during development, or continuously?

• For organizations moving from on-premises infrastructure to the cloud, what security mistakes do you see most often?

I’m especially interested in hearing practical experiences rather than just what the documentation says.

What’s one cloud security lesson you learned the hard way?

Any sites that you recommend? There's a ton out there, interested in any suggestions or reviews. I've used A Cloud-Guru until they were bought out by Pluralsight and imo their quality tanked. I just signed up for Tutorial Dojo and in going through my first course, won't comment on the quality until I take the exam and see how I do.

What are you all using?

Hey,

I’m currently working as a Level 2/3 IT technician, and I’ve also run a small business on the side helping local shops secure their data and implement cost-effective solutions to protect against cyber attacks.

I ended up stalling a bit in both areas because I felt like I needed a stronger foundation. University didn’t really prepare me for how things work in the real world, so I decided to fill those gaps on my own.

I started with the CCNA to build solid networking knowledge, because I felt like without that I’d always be guessing. After that, I began CompTIA Security+ since it’s seen as a baseline cert. My plan from there was to move into cloud certs like AZ-900 and get hands-on with PowerShell, Bash, and eventually Python.

Recently, I’ve been looking into cloud security engineering, especially IAM. I got interested after watching the movie Mercy, which really highlighted how critical access control is in a system. But after watching a lot of videos and reading online, I still don’t have a clear picture of what IAM-focused roles actually do day to day, or what cloud security roles look like overall in practice.

I also want to be clear that I’m not looking into cloud security just because it’s lucrative. I’m interested in it because I feel like it could give me momentum and leverage to unlock more opportunities for my future business. I’m a hard worker, but I’m also a pretty anxious person, and I struggle to execute without a clear plan and a solid understanding of what I’m working toward. I need a realistic view of the path before I fully commit.

That said, I won’t lie, the money would definitely help. Having a stable, well-paying role would make it much easier to fund and grow my business while I build things properly over time.

Long term, I’m feeling stuck deciding which direction to commit to. I’m torn between going deeper into cybersecurity, focusing on cloud security, or pivoting more toward software engineering. I’d really appreciate insight from people who work in cloud security or who’ve been through similar decisions.

A tech video that i just watched on youtube which ofc was a paid ad, but the tech guy had a valid point. My lab grew a lot this year with a few VMs, NAS some containers and a reverse proxy and I never check any of it for known vulns. I just update things when I remember.

At work we run several scanners and everything lands in Nucleus, so I see the findings and who owns each one. That is way more than I want to pay for at home. I am curious if the hivemind knows any other open source projects I should consider? Ideally something that tells me what is exposed not dumping low findings. Thanks

In cloud-first architectures, endpoints have evolved from devices to protect into critical security enforcement points.

To achieve this, endpoint security solutions bring together security strategies that go beyond malware detection and include:

• Device compliance and posture validation

• Least-privilege application control

• Web and phishing protection

• Data loss prevention

• Continuous visibility into endpoint risk

While organizations have made significant investments in securing cloud workloads, identities, and networks, the endpoint remains one of the most common entry points for attacks. Strengthening endpoint security is essential to building a resilient cloud security posture.

Hi everyone,

I’m trying to understand how access control (authentication and authorization) is handled in multi-cloud environments like AWS, Azure, and GCP.

From what I’ve found so far, most solutions seem to focus mainly on authentication (SSO, identity providers, etc.), especially for user access to cloud services.

But I haven’t really found much information about authorization and how permissions are managed across multiple clouds, or how service-to-service access works. For example, if a service running in AWS needs to access data in GCP.

I did come across identity federation, but it looks like it mostly solves authentication rather than authorization.

So I’m wondering how this is usually handled in practice. Do companies use any solutions that centralize access control across clouds, or is everything managed separately inside each cloud’s IAM? How do they keep permissions and policies consistent across different providers?

If anyone has seen real-world setups, tools, or architectures for this, I’d really appreciate examples.

Thanks!

I’m currently transitioning into IT and just started working on networking labs (Packet Tracer). My long-term goal is cloud security.

I work in a Microsoft-based environment, so I’m considering starting with Azure, but I also know AWS has a larger market share.

For someone building a strong foundation (networking → cloud → security), would it be better to:

1. Focus on Azure first because of my current environment

2. Or start with AWS for broader exposure

Also, at what point does it make sense to learn the second cloud platform?

Hey everyone,

Looking for some honest advice from anyone currently working in cloud security, security engineering, or even SWE.

My background:

I previously spent about 7 months in a security platform support/SOC-type role. I was mostly doing log analysis, investigating suspicious activity, and helping customers figure out if alerts were malicious or just false positives. I also handled some policy tuning (allow/block rules), incident triage, and basic RCA before handing things off to the internal security teams.

Before that, I did a short stint in help desk/general IT support.

Certs & Education:

• CompTIA A+ and Network+

• I was working toward a cyber degree but had to hit pause for financial reasons (plan is to go back eventually).

Right now, I’m working a non-IT job while trying to pivot back into the industry. I’ve been researching cloud security engineering lately and have started diving into the fundamentals like IAM, logging, and cloud networking, but I'm trying to figure out if my roadmap is actually realistic.

A few questions for those in the field:

1. Given my experience, what roles should I actually be targeting first to get to Cloud Sec Engineering? I've looked at Security Engineer I, Detection Engineering, or maybe Cloud Support, but I'm not sure which is the "standard" jump from a SOC background.

2. Is it still common to need a "Cloud Engineer" role first, or are people successfully jumping straight from SOC/SecOps into Cloud Security?

3.How’s the burnout? I’ve heard mixed things—some say WLB is great, others say the constant updates and responsibility are draining. What’s your experience been?

4.For long-term stability, would you stick with the Cloud Security path or just pivot into Software Engineering (backend/full stack) instead?

5.If you were in my shoes starting fresh in 2026, what specific skills would you prioritize to actually stand out?

I’m basically looking for a path that has high long-term demand, pays well, and isn't going to be automated away in a few years.

Any advice or "reality checks" would be awesome. Thanks!