Cloud Security Engineer

Cloud Security Engineer

When to Use

• Design and implement org/account guardrails — SCPs, policy constraints, landing zone security
• Harden cloud IAM — roles, trust policies, permission boundaries, federation, break-glass
• Secure cloud networking — segmentation, SG/NSG rules, private endpoints, egress control
• Configure encryption — KMS/CMK policies, default encryption, TLS, secrets managers
• Enable audit and detective controls — CloudTrail/Audit Logs, Config, GuardDuty, CSPM
• Remediate misconfigurations from scans, audits, or Well-Architected security pillar
• Review workload designs for cloud threat patterns (IMDS, public buckets, open SGs)
• Integrate cloud findings into vulnerability and exception workflows
• Support incident forensics with cloud log analysis (with SOC/IR partners)

When NOT to Use

• Company security strategy, policies, board metrics → cybersecurity
• SSO/PAM/SIEM/EDR for corp-wide stack (non-cloud-specific) → information-security-engineer
• SAST/SCA/SBOM and GitHub Actions hardening → devsecops
• Live SOC alert triage and playbooks → soc-analyst
• Cloud telemetry threat hunts and ATT&CK campaigns → threat-hunter
• Authorized exploitation and pentest validation → penetration-tester
• Network/AD/infra pentest from corp paths → network-pentester
• Web/API OWASP testing → web-pentester
• GRC program, audit prep, vendor questionnaires → compliance-specialist
• SOC 2 control narratives and audit binders → compliance-engineer, cloud-compliance-specialist
• Build VPC/RDS without security as primary goal → cloud-engineer
• Landing zone business architecture and migration → cloud-architect
• Cloud program strategy and CCoE investment themes → vp-of-cloud
• Product multi-tenant isolation in app layer → product-infrastructure-security-engineer
• Cloud access tickets and patching → cloud-system-administrator
• Entitlement design, access reviews, federation, PAM → iam-specialist
• Customer security questionnaires, deal compliance fit (architecture) → solutions-architect

Related skills

Core Workflows

1. Scope and shared responsibility

Cloud security boundaries, provider vs customer duties.

See `references/cloud_security_scope.md`.

2. Cloud IAM and identity

Roles, federation, privilege escalation prevention.

See `references/identity_iam_cloud.md`.

3. Network security in cloud

Segmentation, private access, logging.

See `references/network_cloud_security.md`.

4. Data protection and KMS

Encryption, keys, secrets.

See `references/data_encryption_kms.md`.

5. Logging, CSPM, and detection

Audit logs, posture management, native detectors.

See `references/detection_cspm_logging.md`.

6. Architecture review and remediation

Threat patterns, review checklist, fix prioritization.

See `references/secure_cloud_architecture_review.md`.

Outputs

• Guardrail definition — SCP/policy JSON, exceptions, rollout plan
• IAM policy set — least-privilege roles with trust boundaries documented
• Network security diagram — zones, flows allowed/denied, private endpoints
• Remediation backlog — finding, severity, owner, compensating control
• Control evidence — Config rules, scan exports, sample audit log queries
• Architecture review notes — risks, required controls before launch

Principles

• Deny by default — explicit allow for network and IAM
• Security as code — guardrails versioned and reviewed like application code
• Detect and prove — every preventive control has a detective check
• Break-glass is rare and monitored — not a bypass for convenience
• Minimize blast radius — account segmentation and permission boundaries

Cloud security scope

Table of contents

1. Shared responsibility 2. Role boundary 3. Multi-account model 4. Compliance hooks

Shared responsibility

Document which controls apply per workload (IaaS vs PaaS vs SaaS).

Role boundary

Multi-account model

Typical secure structure:

org root (SCPs)
 ├── security / audit (log archive, Security Hub admin)
 ├── shared services (DNS, egress, CI artifacts)
 ├── workload prod / non-prod (separate accounts)
 └── sandbox (strict SCP, auto-cleanup)

Principles:

• No workloads in management account
• Centralized logging — immutable log archive account
• Separate security tooling account for delegated admin
• SCPs deny dangerous APIs (disable root keys, restrict regions)

Compliance hooks

Implement technical controls; partner with compliance-engineer for:

• Control ID mapping (SOC 2, ISO 27001, CIS)
• Evidence retention periods
• Exception register with expiry

Use CIS Benchmarks and provider Well-Architected Security pillar as baselines—not as sole authority without business context.

Data protection and KMS

Table of contents

1. Encryption at rest 2. Encryption in transit 3. Key management 4. Secrets

Encryption at rest

Defaults to enforce:

• Block storage — encrypted volumes/disks; no unencrypted snapshots shared
• Object storage — SSE-KMS or CMEK; block public ACLs/buckets at org level
• Databases — TDE or managed encryption; no public endpoints
• Backups — encrypted; cross-account copy with key policy

SCP/org policy: deny s3:PutObject without encryption headers where applicable.

Encryption in transit

• TLS 1.2+ on all customer and internal APIs
• Managed certs (ACM, etc.) with auto-renewal
• mTLS for high-risk service mesh where required
• Disable legacy protocols on load balancers

Key management

Avoid hardcoded keys in AMIs, user-data, or templates — scan in CI (devsecops).

Secrets

• Secrets Manager / Parameter Store / Key Vault — not plain env in task defs
• Rotation lambdas or native rotation enabled
• RBAC on secret read; audit GetSecretValue
• No secrets in CloudFormation/Terraform state unencrypted — use references + backend encryption

App-layer secret design for multi-tenant products → product-infrastructure-security-engineer.

Logging, CSPM, and detection

Table of contents

1. Audit logging 2. Posture management 3. Native threat detection 4. SIEM integration

Audit logging

Org-wide mandatory:

Protect logs:

• Immutable storage; separate audit account
• Alert on trail disable, policy change, root login
• Retention meets legal and compliance-engineer requirements

Posture management

CSPM / native posture tools:

• AWS Security Hub + Config rules (CIS conformance packs)
• GCP Security Command Center
• Azure Defender for Cloud + regulatory compliance dashboard

Workflow:

1. Enable org-wide with delegated admin account 2. Baseline rules — fail on critical misconfigs (public S3, open SG, no MFA on root) 3. Route findings to ticketing; SLA by severity 4. Track mean time to remediate; exception register with expiry

Native threat detection

Enable and tune:

• GuardDuty / Defender for Cloud / SCC threat detectors
• VPC Flow–based anomaly where available
• Integrate with SOAR playbooks (defensive-security-analyst for alert handling)

Tune suppressions carefully; document false positives.

SIEM integration

Forward to corporate SIEM (information-security-engineer):

• Normalize fields (account, region, principal, resource ARN)
• High-value detections: IAM policy change, SG open to world, KMS disable, snapshot public
• Correlate with IdP sign-in and EDR where available

Cloud-security-engineer owns cloud log pipeline quality; SOC owns detection logic and response tiers.

Cloud IAM and identity

Table of contents

1. Human access 2. Workload identity 3. Privilege escalation paths 4. Reviews and break-glass

Human access

• Federate console/API via corporate IdP (information-security-engineer for IdP design)
• MFA required for all human principals; no password-only IAM users
• Permission sets (AWS SSO) or group-based RBAC — not direct admin on accounts
• Session duration limits; no permanent access keys for humans

Workload identity

Rules:

• One role per workload function; no shared “super” role
• Permission boundaries on roles that can create IAM
• Scope resource ARNs in policies; avoid * on Action and Resource together

Privilege escalation paths

Audit regularly for:

Use IAM Access Analyzer, policy simulation, and pentest findings (offensive-security-analyst).

Reviews and break-glass

• Quarterly access review with evidence export per account
• Break-glass role: MFA, short session, alert on use, post-use review
• Remove unused roles and inline policies; prefer managed policy versions

Operational grants → cloud-system-administrator; security standard → this skill.

Network security in cloud

Table of contents

1. Segmentation 2. Ingress and egress 3. Private connectivity 4. Logging and inspection

Segmentation

Design tiers:

Avoid flat VPCs with wide SG rules (0.0.0.0/0 on SSH/RDP/DB ports).

Ingress and egress

Ingress:

• WAF on public HTTP(S) where applicable
• Default deny SG/NSG; document each allow rule owner
• No admin ports on 0.0.0.0/0

Egress:

• Restrict outbound to required FQDNs/IPs where possible (egress firewall, NAT with filtering)
• Block metadata abuse — IMDSv2 required on AWS; restrict metadata access on containers

Private connectivity

Prefer over public internet for service-to-service:

• AWS PrivateLink / GCP Private Service Connect / Azure Private Link
• VPC/VNet peering or Transit Gateway — document routing and NACL/SG at both ends
• Hybrid: VPN or Direct Connect/Interconnect with encryption

Logging and inspection

Enable and retain:

Centralize to security log archive; integrate per detection_cspm_logging.md.

Optional: IDS/IPS, NGFW appliances — architecture sign-off with cloud-architect.

Secure cloud architecture review

Table of contents

1. Review triggers 2. Checklist 3. Common misconfigurations 4. Remediation prioritization

Review triggers

Run review before:

• New workload landing in prod account
• Internet-exposed service launch
• Cross-account trust or peering
• Handling regulated or PII data
• Major migration wave (cloud-architect coordinates)

Checklist

Pair with Well-Architected Security pillar and threat model for critical systems.

Common misconfigurations

Validate fixes with Config rule or rescan — not only console spot check.

Remediation prioritization

Document compensating controls for accepted risk: owner, expiry, detection in place.

Pentest validation of fixes → offensive-security-analyst.