welcome to the infosec career video
series this set of short videos will
provide a brief look inside cyber
security careers and the experience
needed to enter them today i'll be
speaking with infosec skills author
joseph south about the role of cloud
security engineer so without further ado
let's get into it welcome joe
hi thanks for having me
uh joe let's start with the basics uh
what does a cloud security engineer do
what are what are the day-to-day tasks
of a cloud security engineer
yeah that's uh that's a very interesting
question and it can definitely vary
depending on where your organization is
with their cloud security journey
and uh what they're actually doing what
their market is
uh and so really you know i like to
break it up into three different roles
right so we have a
a junior level cloud security engineer
which is definitely
not a junior role in security overall
and then we have a senior secure cloud
security engineer and then we have a
lead cloud security engineer
and the more junior level role is going
to be responding to different alerts
across the different tools that we have
set up
to be alerted across whichever cloud
provider we may be in
the senior cloud security engineer
is the one that's typically building out
those tools and tuning them and
designing them
really from the ground up and deploying
them
and the lead is identifying gaps in the
environment identifying viable solutions
to fill those gaps
and
really driving the direction of the
cloud security team as a whole
what i like about that is that you we
can we can see the the sort of ladder of
success here so you see what you need to
do to go from one to the next and they
sound like they for the most part have
fairly delineated uh
job roles so i guess to start at the
very ground level how how does one
become
an entry-level cloud security engineer
um what do you need experience first can
you can it be your first job
i would say that it definitely cannot be
your first job okay um because cloud
security
expands or spans across
just about every single domain in
security okay uh and so a cloud security
engineer needs to have experience in
several different domains i'm not just
talking about two domains right i'm
talking about three four five domains
yes across security
and they're deploying tools in those
domains they're working with internal
clients and maybe even some external
facing clients
they really need to have those sorts of
skills and experience under their belt
before they're going into the cloud
where
they're not allowed to touch a cable
right they can't touch the server
they're not able to go do a hard reset
like you would normally do okay it's a
total shift in your thinking
now um
to that end what what types of education
is typically required and or what types
of certs
will help you break in or support this
role or just get the knowledge that you
need to do the role
yeah so i would say the first step is
obviously the experience right so
when you're getting the experience i
always strongly encourage everyone to
go with whatever cloud provider their
company is already in so if your company
is already in azure
start looking at azure search if you're
in aws start looking at aws certs okay
and the first cert that i would start
working to accomplish
or achieve is uh the aws cloud
certified cloud
practitioner sorry that's a mouthful
yeah
that's okay it it really gives you a
very good foundational knowledge of the
cloud and yes it's geared towards aws
but really the foundational knowledge
will work for azure it'll work for gcp
or any other cloud provider
from there
once you have that served under your
belt i would really start looking at the
ccsp okay and the reason why i would do
that is because the ccsp
is very broad it's vendor agnostic it's
not going to be specific to any one
vendor and so the material that you're
going to be learning to achieve that
certification
uh will work no matter what cloud
provider you're in so the topics on you
know encryption i um all of it all of
those foundational topics are going to
be the same
which really puts you ahead of everyone
else because i will be honest i'm in
this field and i don't know very many
other people in this field that have the
ccsp so if you have the ccsp it's really
going to set you apart
gotcha now
uh we talked about some of the skills
that you learned through these
certifications um can you can you lay
them out what are what are some skills
that cloud security engineers need to do
their job well uh like if you're just
gonna start working on learning
something like right after this video
where would you start
yeah that's that's really interesting so
i would take a look at the different
services that the cloud provider is
offering right whichever cloud provider
you're choosing
take a look at the different services
and not just the security services
take a look at how aws deploys ec2s
right and what think of what security
controls you could deploy aws does a
really amazing job azure actually does a
really good job as well
at posting a lot of different white
papers a lot of documents
really walking you through all this
stuff so it's all out there you just
have to look for it
and so
when you're going through and getting
all that knowledge you should also be
developing your soft skills and the best
way to do that is just on the job right
so whatever job you're in
try to work on your soft skills try to
you know be more personable try to
actually uh you know work with people
hear them out listen to them and respond
effectively to whatever they're asking
okay um you mentioned tools before uh
and that you this is a i think it's a
fairly tool intensive uh job can you
talk about some of the common tools that
cloud security engineers use
yeah so i i would say
there's three pretty common ones um and
then the rest are our vendor tools that
you'll get you know experience with on
the job because they're far too
expensive for anyone to purchase on
their own okay
and so
the first one that i always
you know work with honestly is the aws
cli tool
um so it connects right into your aws
account and you can manage your entire
account right from
you know your terminal window or your
cli whichever it might be right
the next one is steampipe it's a newer
open source tool
uh but it's used to actually run
security audits across multiple cloud
environments at the same time and you
can map those controls across all the
different cloud providers and so that is
extremely helpful because to be quite
honest the tools that do it that you
actually have to pay for
um
so some of them do it really well um but
they're also very expensive and so
organizations are looking for
alternatives and if you know
an open source version of a tool
um
you know you're going to be even more
valuable even if they have that paid for
tool because you already know how it
works you already know what to expect so
those first couple that you mentioned
those are those are open source those
are things that people can start messing
around with on their own
yeah absolutely and scout suite is
another one that's open source that is a
great tool to manage your cloud
environment
excellent um so where do cloud security
engineers work what type of job options
are available what what job sectors is
it i imagine with cloud expanding the
way it is it's kind of everywhere right
yeah at this point
every company is in the cloud or they're
going to the cloud or they're thinking
about the cloud yeah so
everyone is hiring for cloud security
professionals i
it sounds a bit crazy right because
maybe you're not used to hearing that
but honestly in security there there is
only a shortage of people no shortage of
jobs yes for sure and so you can work
across any industry in the world you can
work for any company in the world and
you can do it from your your home
because nine times out of ten they're
going to be remote
unless you're working for the federal
government then it's illegal to work
remote
yeah yeah exactly uh now uh to to that
end um
i guess there's a lot of different types
of jobs as well i mean do cloud security
people generally tend to work for the
the single company are their vendors
they're freelancers consultants uh or
all the above
you know i i would say really all the
above
so if you're you know in cloud security
it's very easy to start doing freelance
work start doing consulting work on the
side
um or even you know change organizations
fairly easily
me personally i you know work for an
organization and i do a bit of side work
on the side
and i know
i know several people that do that exact
same thing
now um for people who might be working
or moving towards cloud security
engineer maybe they decide part way
through that it's not the career
position for them how easy is it to
pivot into other roles what types of
skills
that you learn from cloud security
engineer are there ways that you can use
that in in other related fields yeah
absolutely so if we're just focusing on
other security roles
if you make it to be a cloud security
engineer you can go into any other
security role so really i mean just
about any other security role that you
may have a focus on like you could go
into iem security role where you're
deploying a technology
you work on sims edrs whatever it might
be
if you want to go up a level you could
also go and become an architect so
what's an architect an architect is
having the you know thousand foot view
of the organization
identifying some gaps in technology
stacks
um but you know a lot of the times
that's really what they're there for
they're there to manage the environment
and as a cloud security engineer like i
said before you need to know the whole
environment so you're already a step
ahead of most people that are trying to
become architects
and if you don't want to be an architect
you can easily jump into being a manager
right because you're managing
so much in your day-to-day job
especially when you're a senior or a
lead cloud security engineer
that you're basically a manager you're
managing yourself you're managing your
colleagues
um and i don't mean managing it like
with an iron fist right yeah i mean you
know you're working with these other
people that are on your team to you know
achieve a certain goal that you may have
now as we close off here for our
listeners who are ready to get started
and start learning today what's
something they can do right now that'll
move them toward the goal of becoming a
professional cloud security engineer
yeah so i think that that's a great
question that has a lot of different
facets to it
and a few things
that i don't hear enough cloud security
professionals talking about
is
you know when you want to jump into any
sort of security role right the first
thing that you want to do
is get up on the news right learn about
what's actually going on in the security
industry secondly would be to find a
video series or a podcast
a video series like this video series or
my own podcast security unfiltered right
both of those are great ways and there's
other podcasts out there that are also
doing a fantastic job that help people
get into this field
and then you know aside from that
if you nail those two things i would
start looking at certifications right
the aws certification that i mentioned
you don't require
any any experience there's no years of
experience that is required with the
ccsp it is required that you have five
years you can pass that cert and they
will still not issue it to you if you
don't have the years of experience right
and so if you can do those three things
you're you are ahead of the curve like
by far and it's going to be much easier
for you to make this jump or transition
into this line of of work and security
alright joseph self thank you very much
for your time and insight today i'm
really i'm really glad to talk to you
today
yeah thanks for having me i appreciate
it
uh is everyone listening thank you uh
for checking us out if you'd like to
know more about other cyber security job
roles please check out the rest of
infosec's career video series and check
out infosec skills at infosec institute
dot com slash skills we'll talk to you
soon
[Music]