Cloud Security Engineer

☐ Networking & Protocols · Required · 6 hrs

TCP/IP, DNS, TLS/SSL, HTTP/S, firewalls, VPNs. Every cloud security control maps to a network boundary.

• What is a Network? (Networking): https://chaduvuko.com/learn/networking/what-is-a-network
• The TCP/IP Model — How the Internet Works (Networking): https://chaduvuko.com/learn/networking/tcp-ip-model
• DNS — How Domain Names Become IP Addresses (Networking): https://chaduvuko.com/learn/networking/dns
• HTTP and HTTPS — The Protocol Powering the Web (Networking): https://chaduvuko.com/learn/networking/http-and-https

☐ Linux & Scripting · Required · 5 hrs

File permissions, process isolation, bash + Python scripting. Automate security checks and policy enforcement.

• Linux and Shell Scripting for Data Engineers (Data Engineering): https://chaduvuko.com/learn/data-engineering/linux-shell

☐ Cloud Fundamentals (AWS/Azure) · Required · 10 hrs

Compute, storage, networking, IAM, logging services. You can't secure what you don't understand.

• AWS Introduction (AWS): https://chaduvuko.com/learn/aws/introduction
• Azure Introduction (Microsoft Azure): https://chaduvuko.com/learn/azure/introduction
• GCP Introduction (Google Cloud): https://chaduvuko.com/learn/gcp/introduction

☐ Cryptography & PKI · Required · 4 hrs

Symmetric/asymmetric encryption, digital signatures, certificates, KMS. Encryption is how cloud data stays confidential.

• Cryptography From Scratch (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/cryptography-fundamentals
• TLS — How Encryption Protects Every HTTPS Request (Networking): https://chaduvuko.com/learn/networking/tls-ssl

☐ IAM & Permissions · Required · 8 hrs

AWS IAM / Azure RBAC / GCP IAM, least privilege, permission boundaries, service accounts, cross-account roles. 90% of cloud breaches involve misconfigured IAM.

• Identity and Access Management — MFA, RBAC, Privileged Access (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/identity-access-management
• Cloud Security — Shared Responsibility and IAM Misconfiguration (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/cloud-security

☐ Cloud Network Security · Required · 7 hrs

VPC design, security groups, NACLs, private endpoints, VPC peering, WAF, DDoS protection. The perimeter for cloud workloads.

• Networking Deep Dive — Subnets, Routing, Firewalls, VPNs (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/networking-deep-dive
• Firewalls, ACLs, and Stateful Inspection (Networking): https://chaduvuko.com/learn/networking/firewalls-and-acls
• IDS and IPS — Detecting Attacks on the Wire (Networking): https://chaduvuko.com/learn/networking/ids-and-ips

☐ Security Logging & Monitoring · Required · 5 hrs

CloudTrail / Azure Monitor / Audit Logs, SIEM integration, GuardDuty / Defender for Cloud, anomaly detection. You can't defend what you can't see.

• SIEM and Log Analysis — Finding Attacks in the Noise (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/siem-log-analysis

☐ CSPM & Compliance · Required · 5 hrs

Cloud Security Posture Management, AWS Security Hub / Microsoft Defender, CIS benchmarks, compliance frameworks (SOC 2, ISO 27001, FedRAMP). Continuous posture monitoring.

• Cloud Security — Shared Responsibility and IAM Misconfiguration (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/cloud-security
• Compliance Frameworks — NIST, SOC 2, ISO 27001, PCI-DSS (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/compliance-frameworks

☐ Secrets Management · Required · 4 hrs

HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, secret rotation. Hardcoded credentials are the #1 cloud security mistake.

• Azure Key Vault (Microsoft Azure): https://chaduvuko.com/learn/azure/key-vault

☐ Container & K8s Security · Required · 8 hrs

Image scanning (Trivy), OPA/Gatekeeper, Pod Security Admission, network policies, RBAC in K8s, runtime security (Falco). Containers changed the attack surface.

• API Security and Container Security (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/api-container-security

☐ DevSecOps · Required · 6 hrs

SAST/DAST in pipelines, dependency scanning (Dependabot/Snyk), SBOM, shift-left security, security gates in CI/CD. Security moves into the pipeline.

• DevSecOps — Security Embedded in the Pipeline (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/devsecops

☐ Zero Trust Architecture · Recommended · 6 hrs

Never trust, always verify. BeyondCorp model, identity-aware proxy, microsegmentation, continuous validation. The modern security architecture model.

• Security Architecture — Defense in Depth and Zero Trust (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/security-architecture

☐ Cloud Incident Response · Required · 6 hrs

Cloud forensics, memory/disk acquisition, IR playbooks for cloud breaches, containment without losing evidence. Fast response limits blast radius.

• Incident Response — From Alert to Recovery (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/incident-response

☐ Certification (AWS Security / CCSP) · Recommended · 20 hrs

AWS Certified Security Specialty, CCSP, or Azure Security Engineer. Opens doors significantly at service companies and MNCs.

• Security Certifications — Which One to Get First (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/security-certifications