More and more companies run their systems in AWS, Azure or Google Cloud instead of their own data centers. Somebody has to decide how those systems are built, who can reach them and how anyone would know if something went wrong. That’s cloud security.
This roadmap is the order we’d learn it in. It starts with a free course, and we’ll be straight with you about which steps are open today and which are still being built.
What cloud security people actually do
Cloud security work sits between architecture and operations. The day-to-day:
- Decide where a workload should live and what it will cost to protect.
- Design identity and access so people and services get only what they need.
- Set network boundaries and encryption.
- Turn on logging and build detections that catch real problems.
- Review infrastructure as code before it ships.
- Explain risk to the people who own the systems.
The titles vary: cloud security engineer, cloud security architect, DevSecOps engineer and cloud-focused security analyst.
The cloud security ladder
- Cloud-literate analyst. Understand the shared responsibility model and make sound decisions across AWS, Azure and Google Cloud.
- Cloud security engineer. Build and secure workloads: identity, network controls, logging and detection.
- Cloud security architect / DevSecOps. Design secure architectures and build security into the delivery pipeline.
The cloud security roadmap, phase by phase
Phase 1: Make your first cloud decision (free)
Start with the basics every cloud conversation runs on. Our Cloud Security Fundamentals post covers the core ideas, from identity to detection.
Then make a real decision. Cloud Foundations is free. You decide where a university’s file service should live after a ransomware attack, how to protect it, what it costs, and who owns what. No cloud account or credit card needed, and you earn Cover6 Cloud Security I and 16 CPE hours.
Phase 2: Pick a provider and get certified
You don’t need every certification. Pick the provider your target employers use and start with its fundamentals exam:
- AWS: AWS Cloud Practitioner (CLF-C02) Exam Prep ($29)
- Azure: Microsoft AZ-900 Exam Prep ($29)
- Vendor-neutral: CompTIA Cloud+ (CV0-004) Exam Prep ($39)
Each prep includes a 25-question practice quiz, a timed practice exam, a study guide and unlimited retakes.
Phase 3: Build and secure cloud workloads (coming soon)
Cloud Security Engineer Prep ($249) is hands-on: identity, network controls, logging and detection, with practice that prepares you for cloud security certification exams. It isn’t open yet.
Phase 4: Design and automate (coming soon)
Cloud Security Architect & DevSecOps ($399) covers designing secure cloud architectures and building security into the delivery pipeline, from threat modeling to infrastructure as code to automated checks. It isn’t open yet.
Prove it (coming soon)
Cover6 Cloud Challenge ($299): working alone, secure a poorly built cloud environment in 72 hours, fix it in code and prove every fix holds. It isn’t open yet.
The senior certification
When you have real cloud experience, ISC2 CCSP is the senior, vendor-neutral cloud security certification. CCSP Exam Prep + Study Guide ($49).
Cloud or GRC? How to choose
If you’d rather design and build systems, cloud security fits. If you’d rather read requirements and prove a program works, look at the GRC Analyst Roadmap. Still not sure? Take the free career path assessment.
Start here
Cloud Foundations is free. Enroll on that page and make your first cloud decision. When you’re ready, pick a provider and prep for its fundamentals exam.