Cloud Security Engineer.

An engineer who owns the security of an organization's cloud footprint — IAM design, IaC guardrails, CSPM/CNAPP tuning, control-plane hardening, container and Kubernetes security, and partnership with platform teams. It belongs to the Roles & Careers category of cybersecurity.

An engineer who owns the security of an organization's cloud footprint — IAM design, IaC guardrails, CSPM/CNAPP tuning, control-plane hardening, container and Kubernetes security, and partnership with platform teams.

A Cloud Security engineer is the role that designs, builds, and operates the security controls protecting an organization's AWS, Azure, GCP, and Kubernetes environments. Day-to-day work spans IAM architecture (least-privilege role design, SCPs, Conditional Access, workload identity), infrastructure-as-code guardrails (OPA/Sentinel/Checkov in CI), CSPM/CNAPP tuning (Wiz, Prisma Cloud, Defender for Cloud, Lacework), container and Kubernetes security (admission policies, image signing, runtime monitoring with Falco / Tetragon), key and secret management, observability and detection (CloudTrail / Activity Log / Audit Logs into SIEM with detection content for control-plane abuse, IMDS exfiltration, IAM anomalies), and incident response for cloud-specific scenarios. The discipline overlaps DevSecOps and platform engineering; many cloud security teams ship paved-road infrastructure modules so application teams inherit secure defaults. Strong cloud security engineers know one cloud deeply, multiple cloud-native attack chains (token theft, SSRF-to-IMDS, supply-chain Lambda/Action), and at least one IaC language. Certifications often associated with the role: AWS Security Specialty, Azure AZ-500, GCP PCSE, CCSP, GIAC GCSA / GCPN, and increasingly Kubernetes-focused CKS.

Defences for Cloud Security Engineer typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cloud security architect, Cloud DevSecOps engineer.