Cloud Security Engineer — career path
StationX Advanced
Secure what runs in AWS and Azure. Security+ and the cloud foundations first, then cloud identity, AWS security, DevSecOps and detection in the cloud, with CCSP for the senior step.
1 course · 12 sections · 255 lectures · 14 labs · ≈ 9 h of hands-on labs
Free to start: the free lessons and guides for this roadmap →
Try a free cloud security lab: Left open (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Security foundation
The baseline every cloud security role lists.
follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
Learn
- PathFollow the CompTIA Security+ (SY0-701) path — the entry certification employers expect before anything cloud-specific
11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
9 steps — The industry-standard entry certification for a cyber security role.
Step 2 — AWS foundations
The AWS platform, its services and its shared-responsibility model.
follows the whole AWS Certified Cloud Practitioner (CLF-C02) roadmap: 3 courses · 20 sections · 140 lectures · 37 labs · ≈ 24 h of hands-on labs
Learn
- PathFollow the AWS Certified Cloud Practitioner (CLF-C02) path — the AWS entry certification and its labs
3 courses · 20 sections · 140 lectures · 37 labs · ≈ 24 h of hands-on labs
2 steps — The entry point to the AWS certification track — services, pricing, security model and the shared responsibility boundary.
Open the full AWS Certified Cloud Practitioner (CLF-C02) roadmap →
Step 3 — Azure foundations
The Azure platform and how Microsoft's cloud is organised.
follows the whole Microsoft Azure Fundamentals (AZ-900) roadmap: 1 course · 12 sections · 192 lectures · 23 labs · at least 13 h of hands-on labs
Learn
- PathFollow the Microsoft Azure Fundamentals (AZ-900) path — the Azure entry certification and its labs; optional if your target employer is AWS-only
1 course · 12 sections · 192 lectures · 23 labs · at least 13 h of hands-on labs
2 steps — The entry point to the Azure track — cloud concepts, core Azure services, and how Microsoft prices and secures them.
Open the full Microsoft Azure Fundamentals (AZ-900) roadmap →
Step 4 — Identity is the perimeter
Run identity and access in the cloud with Microsoft Entra ID — the control most breaches go through.
follows the whole Microsoft Identity and Access Administrator (SC-300) roadmap: 1 course · 8 sections · 260 lectures · 25 labs · ≈ 16 h of hands-on labs
Learn
- PathFollow the Microsoft Identity and Access Administrator (SC-300) path — identity and access administration, with its labs
1 course · 8 sections · 260 lectures · 25 labs · ≈ 16 h of hands-on labs
3 steps — Identity is the new perimeter. SC-300 covers Entra ID, access management, governance and identity protection in depth.
Open the full Microsoft Identity and Access Administrator (SC-300) roadmap →
Step 5 — Secure AWS
AWS's own security services, hands on.
follows the whole AWS Certified Security — Specialty roadmap: 35 labs · ≈ 22 h of hands-on labs
Learn
- PathFollow the AWS Certified Security — Specialty path — labs only: no AWS Security Specialty course is sold here yet; the AWS security labs live on this path
35 labs · ≈ 22 h of hands-on labs
3 steps — Specialist AWS security — detection, incident response, infrastructure protection, identity, data protection, and security foundations and governance in AWS.
Step 6 — Containers, IaC and the pipeline
Docker, Terraform and CI/CD with security built in — where cloud security work increasingly lives. The labs are the two OWASP failures a pipeline exists to prevent: software supply chain, and software or data integrity.
1 course · 12 sections · 255 lectures · 2 labs
Learn
- CourseUltimate DevSecOps Course - With Real Life Scenarios (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
12 sections · 255 lectures
- Training Overview 2
- Section 1: Promotional Video 1
- Section 2: Introduction 5
- Section 3: Linux/Unix For DevOps and Developers 51
- Section 4: Python For Ethical Hackers 47
- Section 5: AWS (Amazon Web Services) For DevOps 48
- Section 6: Jenkins CI/CD 20
- Section 7: Containerization Technology - Docker 30
- Section 8: IAC (Infrastructure As Code) - AWS CloudFormation 19
- Section 10: Continuous Monitoring - AWS CloudWatch 10
- Section 12: Soft Skills for DevOps 13
- Section 13: DevSecOps Practice 1 - Jenkins , Github and AWS 9
No lab here builds or secures a CI/CD pipeline or scans infrastructure code yet; the course teaches that.
Step 7 — Detect and respond in the cloud
Monitoring, logging and remediation in AWS: CloudTrail, Config rules and automated fixes.
12 labs
Practise
- Infra LabsAWS Monitoring, Logging, and Remediation SOA.1 — 12 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Manage AWS Logs by Using CloudTrailLevel: GuidedDuration: 30 min
- Collect Metrics and Logs by Using the CloudWatch AgentLevel: GuidedDuration: 30 min
- Create a CloudWatch AlarmLevel: GuidedDuration: 30 min
- Create Metric FiltersLevel: GuidedDuration: 30 min
- Create a CloudWatch DashboardLevel: GuidedDuration: 30 min
- Configure an SNS Notification for a CloudWatch AlarmLevel: GuidedDuration: 30 min
- Can You Implement Metrics, Alarms, and Filters?Level: AdvancedDuration: 45 min
- Troubleshoot an EC2 Instance by Using a CloudWatch AlarmLevel: GuidedDuration: 30 min
- Configure an Amazon EventBridge Rule That Triggers an ActionLevel: GuidedDuration: 30 min
- Perform Automatic Remediation by Using an AWS Config RuleLevel: GuidedDuration: 30 min
- Can You Remediate Issues by Using Monitoring and Availability Metrics?Level: AdvancedDuration: 45 min
- Can You Configure a Resilient Website That Uses Monitoring and Automatic Remediation?Level: ExpertDuration: 1 h
Step 8 — Secure cloud workloads, certified
Cloud security architecture, data and application security — the vendor-neutral senior certification.
follows the whole CCSP — Certified Cloud Security Professional roadmap: 8 courses · 52 sections · 265 lectures · 57 labs · ≈ 37 h of hands-on labs
Learn
- PathFollow the CCSP — Certified Cloud Security Professional path — the cloud security course and the Azure security labs live on this path — needs 5 years' experience to certify, 4 with a qualifying degree or credential, none with an active CISSP (you can pass the exam first)
8 courses · 52 sections · 265 lectures · 57 labs · ≈ 37 h of hands-on labs
4 steps — Cloud security at architect level. The exam is vendor-neutral, so the labs here practise it on both Azure and AWS.
Open the full CCSP — Certified Cloud Security Professional roadmap →
Where this leads
Choose your next roadmap
Advanced · after the job
The AI-Driven Cloud Security Engineer
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.