How I'd become a cloud security engineer in 2027: the roadmap in 5 steps

Most cloud security roadmaps are a list of certificates. Collect five, get hired. That isn’t how it works.

Hiring managers test one thing: can you find the problem and fix it, in a real account? This is the five-step path I’d follow in 2027 if I started from zero, with what I’d skip at each step and free resources for every one. Nothing here needs a paid course.

Step	What you’ll be able to do	Proof you’ll have
1. One cloud, deep	Explain who can do what, what can reach what, and how you’d know	Notes on identity, networking and logging in your own account
2. Real breaches	Explain how an attacker would use a mistake	Finished flaws.cloud and one CloudGoat scenario
3. Code to automate	Script a check across an account, write IaC that blocks a mistake	A small Python script and a Terraform module
4. Proof in public	Show working security tools, not claims	3 small GitHub projects, each with a short write-up
5. AI security	Explain prompt injection and how to limit an agent’s access	Notes on the OWASP LLM Top 10 and one lab done

Is it worth it? The numbers

• In the US, the Bureau of Labor Statistics expects jobs for information security analysts to grow 21% from 2025 to 2035, with about 14,100 openings a year. (BLS Occupational Outlook Handbook)
• Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities is now the top way attackers get in: 31% of initial access, ahead of phishing (16%) and stolen credentials (13%). (Verizon DBIR, SC World summary)

Somebody has to find those weaknesses before the attacker does. That’s the job.

Before you start: a lab that can’t surprise you with a bill

Use a personal account that holds nothing important, never a work account.

• AWS: new accounts can start on the free plan: up to $200 in credits for 6 months, and you aren’t billed unless you upgrade to a paid plan. (AWS Free Tier)
• Set a budget alert on day one so you hear about spend before it hurts. (AWS Budgets)
• Turn on MFA for the root or global admin user, then stop using it. Work as a normal user from then on.

Step 1: Pick one cloud and go deep

Do this. Pick AWS or Azure. Not both, not yet. Learn three things really well:

1. Identity: who can do what. Users, roles, policies, and how the cloud decides “allow” or “deny”.
2. Networking: what can reach what. VPCs or VNets, security groups or NSGs, what “public” really means.
3. Logging: how you’d know something happened. CloudTrail on AWS, the Activity log on Azure.

Skip this. Memorising every service. Nobody will quiz you on all two hundred. If you know identity, networking and logging well, you can reason about any service you meet.

Free resources if you pick AWS

• Security best practices in IAM (AWS docs). Read it twice. Most real findings map to one of these.
• Policy evaluation logic (AWS docs). How AWS decides allow or deny. Explicit deny always wins.
• What is Amazon VPC? (AWS docs). Subnets, route tables, security groups.
• What is AWS CloudTrail? (AWS docs). Event history shows the last 90 days of management events at no charge.
• Free digital training: Security (AWS). Free AWS Security Best Practices courses on Skill Builder: overview, monitoring and alerting, network infrastructure.

Free resources if you pick Azure

• Introduction to security, compliance and identity concepts (Microsoft Learn, beginner).
• What is Azure RBAC? (Microsoft docs). Roles, scopes and how access is decided.
• Azure network security groups overview (Microsoft docs).
• Activity log in Azure Monitor (Microsoft docs). Kept for 90 days at no charge.
• Secure access to resources by using Microsoft Entra (Microsoft Learn). MFA, Conditional Access and just-in-time admin.

Already on Google Cloud? The same three topics apply. Start with the IAM overview.

Step 2: Learn how real breaches happen

Do this. Read real incident write-ups and play through real mistakes. Leaked access keys. Public buckets. Roles with far too much power. Most of what you’ll fix at work is a setting someone forgot. When you can explain how an attacker would use a mistake, step by step, you’re thinking like a security engineer.

Skip this. Hacking tools you’ll never use at work. You don’t need to master exploit frameworks to secure a cloud account. You need to read logs and spot the bad setting.

Free resources

• flaws.cloud. A free AWS challenge in levels: each level is a real-world mistake you find and use. No account of your own needed.
• flaws2.cloud. The sequel, with an attacker path and a defender path where you investigate the logs of an attack. Do both.
• CloudGoat (Rhino Security Labs). Open-source “vulnerable by design” AWS scenarios you deploy into your own lab account. Run destroy when you finish so nothing keeps running.
• MITRE ATT&CK Cloud matrix. The shared vocabulary for what attackers do in cloud and identity platforms.
• Public AWS customer security incidents. A community-maintained list of real, publicly disclosed incidents with their root cause. Pick one a week and explain it in your own words.
• Verizon Data Breach Investigations Report. Read the summary once a year to know what’s actually happening.

Want a worked example? Read what happens in the first 5 minutes after an AWS key leaks.

Step 3: Code enough to automate

Do this. Learn Python and infrastructure as code with Terraform. You don’t need to be a developer. You need two things: a script that checks a hundred accounts while you sleep, and a policy that blocks a mistake before it’s deployed.

Skip this. Learning five languages. One scripting language and one IaC tool, used well, covers most of the job.

Free resources

• The Python Tutorial (python.org). Chapters 1 to 9 are enough to start.
• Boto3 quickstart (AWS). Python for AWS: list buckets, read IAM, call any API.
• Azure for Python developers (Microsoft Learn). The same idea for Azure.
• Terraform get-started tutorials for AWS or Azure (HashiCorp). Create, change and destroy real infrastructure from code.
• Checkov. An open-source scanner that flags misconfigurations in Terraform and other IaC before deployment. Run it on your own Terraform and fix what it finds.

Step 4: Build proof, in public

Do this. Three small projects on GitHub:

1. Public storage finder. A script that finds every public bucket (or blob container) in an account.
2. Over-powered roles. A script that flags roles that can do far more than they ever use.
3. Logging-off alarm. An alert that fires when someone turns off logging (for example the CloudTrail StopLogging or DeleteTrail calls).

For each one, write a short README: what it finds, why it matters, and how you’d fix it. That beats another line on your CV, because an interviewer can open it and see your thinking.

Skip this. A big “cloud security platform” that never ships. Three small tools that work beat one large tool that’s half done.

Free resources

• Blocking public access to your Amazon S3 storage (AWS docs). The settings your project 1 should check.
• Remediate anonymous read access to blob data (Microsoft docs). The Azure version, with a ready Resource Graph query.
• Refine permissions using last accessed information (AWS docs). The data behind project 2: which permissions a role has never used.
• Create an EventBridge rule that reacts to AWS API calls via CloudTrail (AWS docs). The tutorial uses StopInstances; swap in StopLogging and you have project 3.
• Prowler. An open-source cloud security scanner. Run it against your lab and compare its findings with your own scripts.
• About READMEs (GitHub Docs). Where your write-up lives.

Step 5: Add AI security

Do this. Companies are giving AI agents access to code, email and cloud accounts. Very few people know how to secure that. Learn three things: prompt injection, agent permissions (what an agent can reach, with whose credentials), and the OWASP Top 10 for LLM applications. That’s where the gap is right now, and your cloud identity skills from step 1 transfer directly.

Skip this. Training your own models or deep machine-learning maths. To secure AI apps you need to understand how they’re wired together, not how to build a model.

Free resources

• OWASP Top 10 for LLM Applications (OWASP GenAI Security Project). Start here. For what changed in the 2026 edition, see our note.
• Web LLM attacks (PortSwigger Web Security Academy, free). Explanations plus hands-on labs.
• MCP security best practices (Model Context Protocol spec). Token passthrough, confused deputy, SSRF and scope minimisation for agent tool servers.
• MITRE ATLAS. ATT&CK-style tactics, techniques and real case studies for attacks on AI systems.
• NIST AI 600-1: Generative AI Profile (NIST). The risk language governance teams will use with you.
• Our own: 6 real AI agent hijacks and the 5 fixes, and the free course lesson It’s OK not to know this yet.

Certificates: when

Get one. After the projects, not before. Use the exam to find and fill your gaps, not to replace your proof.

• AWS Certified Security – Specialty (SCS-C03). Updated in December 2025, and Identity and Access Management is now the biggest domain at 20%. 65 questions, 170 minutes, 300 USD. (AWS certification page, official exam guide, Pluralsight on the update)
• Azure: SC-500, Cloud and AI Security Engineer Associate. Microsoft retired AZ-500 on 31 August 2026 and recommends SC-500 instead. It covers identity and governance, storage, databases and networking, compute, and security posture, now including AI workloads. The Microsoft Learn learning paths for it are free. (AZ-500 retirement notice, SC-500 certification, study guide, course SC-500T00)
• Google Cloud: Professional Cloud Security Engineer. Two hours, 200 USD; Google recommends 3+ years of industry experience including 1+ year on Google Cloud. A good second certificate, not a first step. (Google Cloud)

The exam prices above are the vendors’ list prices in USD; your local price can differ.

Recap

One cloud, deep. How breaches really happen. Enough code to automate. Three public projects. And AI security on top. Do that, and you won’t just pass interviews. You’ll be useful on day one.

My rule of thumb after more than 15 years in this field: the people who get hired are the ones who can show me a finding, explain why it matters, and fix it. Everything on this page is free. The only cost is your time.

What’s next

• Watch the episode: all videos.
• AI Security in 90 Days starts 1 Nov. One idea a day, for ninety days, easy to advanced. Follow The Sec Guy on Instagram or YouTube.
• Go deeper on step 5: start with the free lesson It’s OK not to know this yet, then see the full AI Security Engineer course and its curriculum.