Cloud Security Engineer

When to Use

• Design and implement org/account guardrails — SCPs, policy constraints, landing zone security
• Harden cloud IAM — roles, trust policies, permission boundaries, federation, break-glass
• Secure cloud networking — segmentation, SG/NSG rules, private endpoints, egress control
• Configure encryption — KMS/CMK policies, default encryption, TLS, secrets managers
• Enable audit and detective controls — CloudTrail/Audit Logs, Config, GuardDuty, CSPM
• Remediate misconfigurations from scans, audits, or Well-Architected security pillar
• Review workload designs for cloud threat patterns (IMDS, public buckets, open SGs)
• Integrate cloud findings into vulnerability and exception workflows
• Support incident forensics with cloud log analysis (with SOC/IR partners)

When NOT to Use

• Company security strategy, policies, board metrics → cybersecurity
• SSO/PAM/SIEM/EDR for corp-wide stack (non-cloud-specific) → information-security-engineer
• SAST/SCA/SBOM and GitHub Actions hardening → devsecops
• Live SOC alert triage and playbooks → soc-analyst
• Cloud telemetry threat hunts and ATT&CK campaigns → threat-hunter
• Authorized exploitation and pentest validation → penetration-tester
• Network/AD/infra pentest from corp paths → network-pentester
• Web/API OWASP testing → web-pentester
• GRC program, audit prep, vendor questionnaires → compliance-specialist
• SOC 2 control narratives and audit binders → compliance-engineer, cloud-compliance-specialist
• Build VPC/RDS without security as primary goal → cloud-engineer
• Landing zone business architecture and migration → cloud-architect
• Cloud program strategy and CCoE investment themes → vp-of-cloud
• Product multi-tenant isolation in app layer → product-infrastructure-security-engineer
• Cloud access tickets and patching → cloud-system-administrator
• Entitlement design, access reviews, federation, PAM → iam-specialist
• Customer security questionnaires, deal compliance fit (architecture) → solutions-architect

Related skills

Core Workflows

1. Scope and shared responsibility

Cloud security boundaries, provider vs customer duties.

See references/cloudsecurityscope.md.

2. Cloud IAM and identity

Roles, federation, privilege escalation prevention.

See references/identityiamcloud.md.

3. Network security in cloud

Segmentation, private access, logging.

See references/networkcloudsecurity.md.

4. Data protection and KMS

Encryption, keys, secrets.

See references/dataencryptionkms.md.

5. Logging, CSPM, and detection

Audit logs, posture management, native detectors.

See references/detectioncspmlogging.md.

6. Architecture review and remediation

Threat patterns, review checklist, fix prioritization.

See references/securecloudarchitecture_review.md.

Outputs

• Guardrail definition — SCP/policy JSON, exceptions, rollout plan
• IAM policy set — least-privilege roles with trust boundaries documented
• Network security diagram — zones, flows allowed/denied, private endpoints
• Remediation backlog — finding, severity, owner, compensating control
• Control evidence — Config rules, scan exports, sample audit log queries
• Architecture review notes — risks, required controls before launch

Principles

• Deny by default — explicit allow for network and IAM
• Security as code — guardrails versioned and reviewed like application code
• Detect and prove — every preventive control has a detective check
• Break-glass is rare and monitored — not a bypass for convenience
• Minimize blast radius — account segmentation and permission boundaries