Cloud Security Engineer

Cloud Security Engineers secure workloads in AWS, Azure, GCP, or multi-cloud estates. The role spans landing zone design, IAM, KMS, network policy, container/runtime security, and detective controls. It is the highest-velocity hiring market in UK cyber today. ## Career milestones ### Year 0 — Cloud Engineer / DevOps moving into security _Salary: £55k–£70k_ Solid AWS/Azure/GCP fundamentals, IaC (Terraform), CI/CD. ### Year 1–2 — Cloud Security Engineer _Salary: £70k–£95k_ Own landing zone guardrails (SCPs, Azure Policy), IAM design, KMS, secrets management, detection. ### Year 2–4 — Senior Cloud Security Engineer _Salary: £95k–£125k_ Multi-account/multi-cloud architecture, platform engineering with security as code, container/runtime security, FedRAMP/UK Gov-equivalent posture. ### Year 4+ — Principal Cloud Security Engineer / Cloud Security Architect _Salary: £120k–£170k_ Define cloud security platform, build paved roads, mentor team, represent in vendor architecture reviews. ## Core skills - AWS IAM (policy evaluation, SCPs, permission boundaries, ABAC) - Azure Entra ID + conditional access + PIM - GCP IAM + Org Policy + VPC-SC - Terraform / Pulumi for security primitives - Kubernetes (Pod Security, OPA/Gatekeeper, Falco, Cilium) - KMS / Key Vault / Cloud KMS + envelope encryption - Detective controls (GuardDuty, Defender for Cloud, SCC) - CSPM (Wiz, Prisma Cloud, Defender CSPM) ## Recommended certifications - `aws-security` - `azure-security` - `ccsp` - `ccsk` ## First 90 days in the role Inventory every account, subscription, or project. Map your IAM blast radius — who can do what, where. Establish a baseline of detective controls (CloudTrail org-trail, Defender for Cloud at standard tier, GCP Audit Logs). Then start hardening the top 5 highest-risk paths. ## Common pitfalls Becoming a single-cloud specialist when the market is multi-cloud. Even if your day job is AWS, learn Azure fundamentals — 60% of UK enterprise estates are Azure-first.