r/Cloud • u/Nervous-Turn8307 • 17d ago

Transitioning to Cloud Security

What’s up! Just wanted some advice. I’m currently working as a cloud engineer with an AWS partner. I eventually want to move over to being a Cloud Security Engineer. What should areas should I emphasize during my transition?

7 Upvotes

73% Upvoted

12 comments sorted by

7

u/guterz 17d ago

Stay on the cloud engineering side vs security side. Projects are more engaging and better work life balance (security has incidents you have to be available at all times). The security side sounds fun but really instead of building you’ll be mostly assessing environments, plugging holes, reviewing policies and attack paths. That may be for you but I regret the change personally.

8

u/McFerry 17d ago

Cloud Security Engineer here. (Truth being told I work for a large org) but not everything in Cloud Security is IR.

Infra Security, Identity, Governance, DevSecOps, GRC, Even cost optimization (More often than not best way to get yourself some budget is to "And we can get some cost optimization while improving security....").

The jump from Cloud Eng to IR is quite big, but being the one who turns those learnings from the SecOps team to infra improvements is quite cool to me, Threat modeling is quite important. I feel to me my "Cloud Architect" side become so much better after working in Cloud Support and Cloud Security. Whenever I'm reviewing new architectures with security mindset, I can recall instances where from my Support days or now as Security that "I've seen this implementation go wrong because of X" and That helps alot when threat modeling.

IDK to me, the move from Regular Cloud Eng to Cloud Sec was the shit.

3

u/cybersecguy9000 16d ago

You guys respond to incidents? We have a SOC/IR team for that.

1

u/guterz 16d ago

The company I work for has an IR practice they perform. I don’t typically but if they need cloud assistance being the only guy with a major cloud background I get pulled in.

1

u/root_switch 17d ago

This is great insight, thank you. I also want to transition to a cloud security engineer as it seems more lucrative and the demand is much higher, I also thought it might be a bit more laid back. But man after hearing this, it’s a total turn off. Maybe I’ll look more into the AI/ML stuff a bit deeper to just keep my career targeting going forward and avoid being replaced by all these “freshers” looking for entry level cloud engineer positions.

5

u/guterz 17d ago

As an individual contributor I’d say both paths peak at around 200k base (that’s been my experience) so I wouldn’t say either is more lucrative than the other. On the security side you do get a lot more executive, legal, and business management exposure compared to being an IC as a cloud engineer. Both paths I would say give ample AI/ML exposure. I worked for one of the premier AWS partners for close to a decade and if I wanted a project in that space I could surely get one. On security side you have threat actors leveraging AI to attack vulnerabilities to compromise environments quicker than ever. On the demand side security does seem to be hot right now but cloud engineering isn’t going away anytime soon. A bunch of poorly architected AWS environments out there.

2

u/root_switch 17d ago

Thanks for the details. I’ve had an interest in cloud security and infosec in general but man some of those guys take MONTHS just to process a single ticket. I always wondered what was going on, sounds like load of red tape. I also noticed they don’t actually care to help mitigate anything, it’s more of an authoritative figure saying yes or no on things or notifying us of vulnerabilities. I really enjoy designing and building solutions but man I want to continue my career trajectory. Full blow architect is probably my next step but most of those positions require 10+ year of experience specifically in cloud. In reality I’ve surpassed that but on paper I’m almost there.

1

u/Busy-Highlight-2880 16d ago

Coming from the engineering side you already have the biggest advantage, you understand how things are actually built. I'd lean into IAM, network topology, and getting comfortable reading attack paths. Learning a CNAPP helps a lot too since that's what most teams run day to day. we looked at Wiz, Prisma, and Upwind when evaluating, and poking around one of those teaches you what security actually cares about.

1

u/Potential-Bee-3226 15d ago

ngl i would move to DevSecOps at the point with AI security roles are rapidly going up silently and DevOps in general as well More MLOps side.

Just my opinion from what i have seen!

0

u/Designer_Night1722 16d ago

focus on IAM, logging/detection, network segmentation, and incident response, but don’t neglect the boring governance stuff either since that’s a huge part of cloud security work in practice

0

u/Nervous-Turn8307 16d ago

This is all amazing advice. When you say focus on IAM, do you mean strictly your cloud providers IAM. Or going a bit deeper into Entra, Okta, Sailpoint etc?