Cloud Security Engineer — career path
StationX Advanced
Secure what runs in AWS and Azure. Security+ and both cloud foundations first, then identity, the CCSP and AWS security paths, detection in the cloud, and containers and automation.
The path
Step 1 — Security foundation
The baseline every cloud security role lists.
follows a certification path
Learn
- PathFollow the CompTIA Security+ (SY0-701) path — the entry certification employers expect before anything cloud-specific
Step 2 — AWS foundations
The AWS platform, its services and its shared-responsibility model.
follows a certification path
Learn
- PathFollow the AWS Certified Cloud Practitioner (CLF-C02) path — the AWS entry certification and its labs
Step 3 — Azure foundations
The Azure platform and how Microsoft's cloud is organised.
follows a certification path
Learn
- PathFollow the Microsoft Azure Fundamentals (AZ-900) path — the Azure entry certification and its labs
Step 4 — Identity is the perimeter
Run identity and access in the cloud — the control most breaches go through.
1 course · 23 labs
Learn
- CourseIdentity & Access Management - Azure Active Directory 🔒 StationX Unlimited
3 sections · 46 lectures
- Training Overview 2
- Section 1: Introduction 43
- Audio Version of Training 1
Practise
- Labs+Implement an Identity Management Solution — 23 labs 🔒 StationX Labs+
- Can You Configure Access Reviews in Microsoft Entra ID? [Advanced]
- Can You Configure Application Registrations in Microsoft Entra ID? [Advanced]
- Can You Configure Device Registrations and Manage External Users in Microsoft Entra ID? [Advanced]
- Can You Configure Multifactor Authentication and Self-service in Microsoft Entra ID? [Advanced]
- Can You Configure Roles and Tenant-Wide Settings in Microsoft Entra ID? [Advanced]
- Can You Create and Configure Enterprise Applications in Microsoft Entra ID? [Advanced]
- Can You Implement Access and Single Sign-On for Applications by Using Microsoft Entra ID? [Advanced]
- Can You Implement Conditional Access Policies in Microsoft Entra ID? [Advanced]
- Can You Implement Entitlement Management by Using Microsoft Entra ID? [Advanced]
- Can You Implement and Manage Hybrid Identities and Synchronization in Microsoft Entra ID? [Advanced]
- Can You Manage Identity Protection in Microsoft Entra ID? [Advanced]
- Can You Manage Privileged Access in Microsoft Entra ID? [Advanced]
- Can You Manage Users, Groups, and Administrative Units in Microsoft Entra ID? [Advanced]
- Can You Monitor Microsoft Entra ID?[Advanced]
- Configure Access Reviews in Microsoft Entra ID [Guided]
- Configure Application Registrations in Microsoft Entra ID [Guided]
- Configure Multi-factor Authentication in Microsoft Entra ID [Guided]
- Configure Roles and Tenant Wide Settings in Microsoft Entra ID [Guided]
- Configure Self-Service Password Reset in Microsoft Entra ID [Guided]
- Create and Configure Enterprise Applications in Microsoft Entra ID [Guided]
- Implement and Manage Hybrid Identities and Synchronization in Microsoft Entra ID [Guided]
- Manage Privileged Access in Microsoft Entra ID [Guided]
- Manage Users, Groups, and Administrative Units in Microsoft Entra ID [Guided]
Step 5 — Secure cloud workloads, certified
Cloud security architecture, data and application security — the vendor-neutral certification.
follows a certification path
Learn
- PathFollow the CCSP — Certified Cloud Security Professional path — the cloud security course and the Azure security labs live on this path
Step 6 — Secure AWS
AWS's own security services, hands on.
follows a certification path
Learn
- PathFollow the AWS Certified Security — Specialty path — the AWS security labs live on this path
Step 7 — Detect and respond in the cloud
Monitoring, logging and remediation on both platforms.
21 labs
Learn
- CourseCovered in Introduction to Cloud Security with Microsoft Azure — monitoring and threat-protection sections 🔒 StationX Unlimited
Practise
- Labs+Microsoft Defender — 9 labs 🔒 StationX Labs+
- Advanced Threat Hunting with Microsoft 365 Defender [Guided]
- Comprehensive Security Management with Microsoft Defender and Entra ID [Advanced]
- Incident Response with Microsoft Defender XDR [Expert]
- Introduction to Microsoft Defender Overview [Guided]
- Microsoft Defender for Cloud Apps [Guided]
- Microsoft Defender for Endpoint [Guided]
- Microsoft Defender for Identity Setup [Guided]
- Microsoft Defender for Office 365 [Guided]
- Working with Microsoft Defender Products [Prerequisite Lab]
- Labs+AWS Monitoring, Logging, and Remediation SOA.1 — 12 labs 🔒 StationX Labs+
- Can You Configure a Resilient Website That Uses Monitoring and Automatic Remediation? [Expert]
- Can You Implement Metrics, Alarms, and Filters? [Advanced]
- Can You Remediate Issues by Using Monitoring and Availability Metrics? [Advanced]
- Collect Metrics and Logs by Using the CloudWatch Agent [Guided]
- Configure an Amazon EventBridge Rule That Triggers an Action [Guided]
- Configure an SNS Notification for a CloudWatch Alarm [Guided]
- Create Metric Filters [Guided]
- Create a CloudWatch Alarm [Guided]
- Create a CloudWatch Dashboard [Guided]
- Manage AWS Logs by Using CloudTrail [Guided]
- Perform Automatic Remediation by Using an AWS Config Rule [Guided]
- Troubleshoot an EC2 Instance by Using a CloudWatch Alarm [Guided]
Step 8 — Containers and automation
Kubernetes and the pipeline — where cloud security work increasingly lives.
1 course · 26 labs
Learn
- CourseThe DevOps Essentials - The Handbook 🔒 StationX Unlimited
3 sections · 22 lectures
- Training Overview 2
- Section 1: Introduction 19
- Audio Version of the Training 1
Practise
- Labs+Kubernetes Installation & Configuration — 13 labs 🔒 StationX Labs+
- Can You Create Objects in a Kubernetes Cluster? [Advanced]
- Can You Deploy a Kubernetes Cluster? [Expert]
- Can You Install and Configure a Kubernetes Cluster? [Advanced]
- Can You Manage Pod Scheduling in a Kubernetes Cluster? [Advanced]
- Can You Manage Resources in a Kubernetes Cluster? [Advanced]
- Create Cluster Objects by Using Declarative Commands [Guided]
- Create Cluster Objects by Using Imperative Commands [Guided]
- Create a Kubernetes Cluster Deployment [Guided]
- Getting Started with Kubernetes Cluster Administration [Getting Started]
- Initialize a Kubernetes Cluster [Guided]
- Install Kubernetes Cluster Components [Guided]
- Organize Kubernetes Cluster Resources by Using Namespaces [Guided]
- Retrieve Kubernetes Core Component Information by Using kubectl [Guided]
- Labs+Azure DevOps — 13 labs 🔒 StationX Labs+
- Add an Azure DevOps Webhook by Using Azure Automation [Guided]
- Can You Configure a Trunk-Based Branching Strategy in Azure DevOps Services? [Advanced]
- Can You Manage Merge Conflicts in Azure DevOps Services? [Advanced]
- Create a Pipeline in Azure DevOps [Guided]
- Create and Use Repositories in Azure DevOps Services (ADOS) [Guided]
- Install and Configure Azure DevOps Services (ADOS) Prerequisite Technologies [Prerequisite Lab]
- Integrate Azure Boards with Git Repositories [Guided]
- Manage Branches and Use a Feature Branch Branching Strategy in Azure DevOps Services [Guided]
- Manage Pull Requests and Perform Reversions in Azure DevOps Services [Guided]
- Set Branching Policies and Restrictions in Azure DevOps Services [Guided]
- Use Terraform with AWS Cloud9 to Deploy Resources [Guided]
- Use Terraform with AWS CloudShell to Deploy Resources [Guided]
- Use Terraform with the Azure Shell to Deploy Resources [Guided]
Free resources
Where this leads
- Microsoft Cybersecurity Architect (SC-100) — Advanced
- CISSP — Certified Information Systems Security Professional — Advanced
Advanced · after the job
The AI-Driven Cloud Security Engineer
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.