Cloud Security Engineer
What the work looks like, the stacks behind the title, what each level means and the training that helps, then how interviews run and how to prepare for each step.
What a cloud security engineer actually does
An engineer who protects the cloud platforms of a company, from identities and access to posture, Kubernetes and the response to incidents.
A cloud security engineer designs and runs the security controls of the cloud: identity and access management, Zero Trust rules, network protection and the security of Kubernetes clusters.
They watch the security posture of the cloud with CNAPP tools, model threats with engineering teams, fix findings with them and respond to incidents in the cloud. Much of the work is done as code, close to DevOps and platform teams.
They also help the company meet the rules and standards that apply to it, which differ between Europe and the US.
- Reviewing access rights or a new cloud design
- Fixing findings from the posture tool with a team
- A threat modeling session on a new service
- Work on Kubernetes security policies
- Evidence and documents for an audit
In the European Union, NIS2 sets cybersecurity rules for many sectors, and DORA sets rules on digital resilience for financial companies. In the US, SOC 2 reports and FedRAMP, for cloud services sold to the federal government, often shape the work.
ISO 27001 is used on both sides. The rules that apply to the company, and how close the role is to audits, show a lot about the day to day work.
The same title, very different stacks
Most cloud security searches are defined first by the part of the cloud the team protects, then by the ground every cloud security engineer shares.
What each level means in practice
Titles vary from one company to the next. What changes from one level to the next is the scope you own and the decisions you take.
- Works on controls designed by a senior engineer
- Learns the cloud, the tools and the rules
- Fixes findings with review and guidance
- Runs security controls on their own
- Handles findings and cloud incidents
- Works directly with engineering teams
- Designs the security of a cloud platform
- Takes choices on controls, tools and priorities
- Mentors other engineers and leads reviews
- Sets cloud security standards across the company
- Leads choices on architecture and compliance
- Writes the design documents others build on
The paths into the role, and what really counts
Companies look first at the controls you have put in place and the incidents or findings you handled. In security, some certifications also weigh a lot in hiring.
- Engineering school or master's in cybersecurityThe most common path in France, and often expected by large companies.
- University degree in computer science or securityThe most common path in the US, at bachelor's or master's level.
- Cloud or DevOps engineering firstMany cloud security engineers start as cloud or DevOps engineers.
- Security analyst firstSecurity analysts who learn the cloud also move into the role.
Our view: for this role, certifications open doors, and controls you deployed at scale and can walk through count even more.
A conversation with a senior tech recruiter
Your first interview is with one of our senior tech recruiters, who knows the role, the stacks and the levels in this guide. The conversation covers your own work through real examples, and the technical exercises come later, with the company. Before the call, we send you the six themes we will cover so you can prepare your examples.
- What you owned yourselfThe security controls, cloud accounts or audits you were responsible for, and your own part in the team's work.
- Your environment and its constraintsRules such as NIS2 or SOC 2, team size, legacy systems or deadlines: what shaped your technical choices.
- The decisions you madeWhich controls, which tools and which priorities, the options you compared and the reasons for your choice.
- The impact of your workWhat changed thanks to your work, with numbers when you have them: findings fixed, time to fix, audit results or incidents.
- How you work with other teamsYour work with engineering, DevOps, legal and leadership, and how you settle a disagreement.
- What you want nextThe kind of cloud, rules and scope you are looking for in your next role.
- Controls deployed at scale
- Work with engineering teams
- Response to findings
The same ground for every candidate. For a given role, every candidate answers the same final questions, built with the hiring manager around what the role really needs.
Ready for the next steps. After our call, we tell you how the company runs its interviews, who you will meet at each step and what each step is meant to assess.
What the company will assess, step by step
Each company runs its own process, and we walk you through its steps before you start. Cloud security processes often combine the steps below, and the depth expected at each step grows with your level.
- A design reviewA cloud architecture to review, and the security risks and controls you would point out.
- An incident scenarioA cloud incident to investigate, such as leaked keys or a public bucket, and how you respond.
- A deep dive on your past workOne control or project you led, discussed in depth: the context, your choices and the results.
- Meeting the manager and the teamHow you work, how you take decisions with others and what the team expects in your first months.
- ConfirmedYou spot the main risks, explain each control in simple words and ask the right questions about the context.
- SeniorYou lead the review, set priorities by risk and point out what to fix first before you are asked.
- Staff and PrincipalYou run most of the interview as a peer, connect controls to the rules and the strategy of the company and to several teams.
How to prepare as a cloud security engineer
Practical advice for each step of a cloud security process, from the way you introduce yourself to the questions you ask at the end of each interview.
Start with the security controls and cloud environments you worked on, their scale and your part in them. Mention your stack in one sentence, then close with what you want next.
For each one, prepare the context, the constraints, your decision, the options you set aside, the result and what you would change today. Say "we" for the team and "I" for your own part.
In a design review, start with identities and access, then the network, the data and the logs, and explain each risk.
Prepare one cloud incident you handled, with how you found it, what you did and what you changed after.
Prepare how NIS2, DORA, SOC 2 or ISO 27001 shaped your work, with one concrete example.
Rules on AI coding assistants differ from one company to the next, and sometimes from one step to the next. Ask before each step, and when they are allowed, explain what you ask the tool and how you check its output.
- Walk us through a security control you deployed across many accounts.
- You find access keys in a public repository. What do you do?
- How do you get engineering teams to fix findings?
- How would you secure a new Kubernetes cluster?
- Which clouds and security tools does the team use?
- Which rules and standards apply to the company?
- How do security and engineering teams share the work?
- Who handles cloud incidents, and how?
- Which audits are planned this year?
- How does the team use AI coding tools day to day?
Where cloud security engineers come from, and where they go
The roles people most often hold before this one, and the ones they most often move to.
Some cloud security engineers start as security analysts, and some move to security architect roles.