# Cloud Security Engineer

> Guides cloud security engineering on AWS, GCP, and Azure—org guardrails (SCPs, org policies), cloud IAM and federation, network segmentation and private connectivity, encryption and KMS, logging and audit to SIEM, CSPM and native detective controls (Config, Security Hub, GuardDuty, SCC, Defender), workload hardening, and secure cloud architecture review with remediation. Use when implementing or auditing cloud security controls, fixing misconfigurations, designing multi-account guardrails, hardening VPC/VNet and data plane access, or integrating cloud audit logs—not for corporate IdP/SIEM/EDR programs broadly (information-security-engineer), CI pipeline gates and SBOM only (devsecops), SOC alert triage (defensive-security-analyst), pentest execution (penetration-tester, network-pentester, web-pentester for app/API), GRC evidence packaging (compliance-engineer), GRC program and audit prep (compliance-specialist), or routine cloud provisioning without security ownership (cloud-engineer).

- Skill: `daemon-blockint-tech/cloud-security-engineer` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/cloud-security-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/cloud-security-engineer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/cloud-security-engineer

---


# Cloud Security Engineer

## When to Use

- Design and implement **org/account guardrails** — SCPs, policy constraints, landing zone security
- Harden **cloud IAM** — roles, trust policies, permission boundaries, federation, break-glass
- Secure **cloud networking** — segmentation, SG/NSG rules, private endpoints, egress control
- Configure **encryption** — KMS/CMK policies, default encryption, TLS, secrets managers
- Enable **audit and detective** controls — CloudTrail/Audit Logs, Config, GuardDuty, CSPM
- Remediate **misconfigurations** from scans, audits, or Well-Architected security pillar
- Review **workload designs** for cloud threat patterns (IMDS, public buckets, open SGs)
- Integrate cloud findings into **vulnerability and exception** workflows
- Support **incident forensics** with cloud log analysis (with SOC/IR partners)

## When NOT to Use

- Company security strategy, policies, board metrics → `cybersecurity`
- SSO/PAM/SIEM/EDR for corp-wide stack (non-cloud-specific) → `information-security-engineer`
- SAST/SCA/SBOM and GitHub Actions hardening → `devsecops`
- Live SOC alert triage and playbooks → `soc-analyst`
- Cloud telemetry threat hunts and ATT&CK campaigns → `threat-hunter`
- Authorized exploitation and pentest validation → `penetration-tester`
- Network/AD/infra pentest from corp paths → `network-pentester`
- Web/API OWASP testing → `web-pentester`
- GRC program, audit prep, vendor questionnaires → `compliance-specialist`
- SOC 2 control narratives and audit binders → `compliance-engineer`, `cloud-compliance-specialist`
- Build VPC/RDS without security as primary goal → `cloud-engineer`
- Landing zone business architecture and migration → `cloud-architect`
- Cloud program strategy and CCoE investment themes → `vp-of-cloud`
- Product multi-tenant isolation in app layer → `product-infrastructure-security-engineer`
- Cloud access tickets and patching → `cloud-system-administrator`
- Entitlement design, access reviews, federation, PAM → `iam-specialist`
- Customer security questionnaires, deal compliance fit (architecture) → `solutions-architect`

## Related skills

| Need | Skill |
|---|---|
| VP cloud program and risk investment themes | `vp-of-cloud` |
| Corporate security tooling and IdP | `information-security-engineer` |
| Pipeline and supply-chain security | `devsecops` |
| Cloud architecture and WAF reviews | `cloud-architect` |
| Enterprise CCoE and regulated program | `enterprise-cloud-architect` |
| Cloud resource implementation | `cloud-engineer` |
| Terraform platform modules | `infrastructure-engineer` |
| GRC program, gap plans, audit coordination | `compliance-specialist` |
| Compliance evidence (org-wide) | `compliance-engineer` |
| Cloud audit evidence and framework mapping | `cloud-compliance-specialist` |
| SOC triage and playbooks | `soc-analyst` |
| Active security IR, cloud log coordination | `incident-responder` |
| Cloud telemetry threat hunts and hunt campaigns | `threat-hunter` |
| Cloud alert investigation and detection tuning | `defensive-security-analyst` |
| Pentest validation | `penetration-tester` |
| Network/AD/infra pentest | `network-pentester` |
| Web/API OWASP pentest | `web-pentester` |
| Product tenancy | `product-infrastructure-security-engineer` |
| Customer deal security/compliance fit memo | `solutions-architect` |
| CVD and disclosure | `technical-program-manager-security-cvd` |
| Cloud audit log forensics and super-timelines after preservation | `digital-forensics-analyst` |
| Security risk registers and treatment prioritization | `security-risk-analyst` |
| IAM lifecycle, access reviews, federation, PAM | `iam-specialist` |

## Core Workflows

### 1. Scope and shared responsibility

Cloud security boundaries, provider vs customer duties.

**See `references/cloud_security_scope.md`.**

### 2. Cloud IAM and identity

Roles, federation, privilege escalation prevention.

**See `references/identity_iam_cloud.md`.**

### 3. Network security in cloud

Segmentation, private access, logging.

**See `references/network_cloud_security.md`.**

### 4. Data protection and KMS

Encryption, keys, secrets.

**See `references/data_encryption_kms.md`.**

### 5. Logging, CSPM, and detection

Audit logs, posture management, native detectors.

**See `references/detection_cspm_logging.md`.**

### 6. Architecture review and remediation

Threat patterns, review checklist, fix prioritization.

**See `references/secure_cloud_architecture_review.md`.**

## Outputs

- **Guardrail definition** — SCP/policy JSON, exceptions, rollout plan
- **IAM policy set** — least-privilege roles with trust boundaries documented
- **Network security diagram** — zones, flows allowed/denied, private endpoints
- **Remediation backlog** — finding, severity, owner, compensating control
- **Control evidence** — Config rules, scan exports, sample audit log queries
- **Architecture review notes** — risks, required controls before launch

## Principles

- **Deny by default** — explicit allow for network and IAM
- **Security as code** — guardrails versioned and reviewed like application code
- **Detect and prove** — every preventive control has a detective check
- **Break-glass is rare and monitored** — not a bypass for convenience
- **Minimize blast radius** — account segmentation and permission boundaries