Cloud Security Engineer
Protect cloud workloads at scale. From IAM hardening and cloud posture management to workload protection and compliance automation across AWS and Azure.
Who this path is for
This path is for cloud engineers, system administrators and security analysts who want to own the security of AWS or Azure environments. You should already be able to deploy basic resources in at least one cloud. The target role is a cloud security engineer who hardens identity, watches posture and keeps workloads compliant at scale.
What you'll be able to do
- Audit cloud IAM for over permissioned users, roles and service principals, and reduce them to least privilege.
- Use a CSPM tool such as Microsoft Defender for Cloud or AWS Security Hub to find and prioritize misconfigurations.
- Protect virtual machines, containers and serverless workloads with the right workload protection controls.
- Automate compliance checks with policy as code so new resources are evaluated the moment they are created.
- Explain the trade offs between native cloud security tools and third party platforms to your team.
What you'll cover
Cloud IAM Deep Dive
Master IAM across AWS and Azure: roles, policies, service principals, managed identities, and permission boundaries.
Cloud Security Posture Management
Continuously detect and remediate misconfigurations across your cloud estate.
Workload & Container Protection
Protect VMs, containers, and serverless functions with runtime security and vulnerability management.
Compliance Automation
Automate evidence collection and policy enforcement for SOC 2, ISO 27001, PCI DSS, and CIS Benchmarks.
Knowledge Check
Related certifications
Microsoft Cloud and AI Security Engineer Associate
The current Microsoft cloud security exam. AZ-500 retired on August 31, 2026, so choose SC-500 if you are starting now.
Free SC-500 course →AWS Certified Security Specialty
The AWS specialist exam for securing workloads, identity and data on AWS.
Free AWS Security Specialty course →Kubernetes security skills
Container platforms are a large part of modern cloud estates, so cluster security pairs well with either exam above.
Free Kubernetes Security course →Frequently asked questions
How long does the Cloud Security Engineer path take?
About 13 hours covers the four topic areas and the knowledge check. Hands-on practice in a sandbox subscription or account is strongly recommended alongside it.
Should I study for AZ-500 or SC-500?
SC-500. Microsoft retired AZ-500 on August 31, 2026 and SC-500 replaced it, adding coverage of securing AI workloads.
What roles does this path prepare me for?
It targets roles such as cloud security engineer, Azure or AWS security engineer, cloud security analyst and security engineer on a platform team.
Path Summary
- Level
- Intermediate
- Estimated time
- 13 hours
- Topics
- 4
- Resources
- 12
- Quiz questions
- 10
- Passing score
- 70% (7/10)